diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b4117e2..5995db5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -274,7 +274,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install Trivy
         run: |
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.2/contrib/install.sh | sh -s -- -b /usr/local/bin  # nosemgrep: download-and-execute
       # `siax/sbom/` är CycloneDX-evidenens för REDAN BYGGDA images (release-kedjan),
       # inte källberoenden. Att scanna dem här återrapporterar gamla image-versioner
       # (next 16.3.x, sharp 0.35.4) och blockerar källfixar som redan är patchade.
diff --git a/.gitea/workflows/health-check.yml b/.gitea/workflows/health-check.yml
index 5fb23df..1fb2a10 100644
--- a/.gitea/workflows/health-check.yml
+++ b/.gitea/workflows/health-check.yml
@@ -19,6 +19,6 @@ jobs:
           for f in README.md LICENSE .gitignore; do [ -f "$f" ] || echo "::warning file=$f,title=Missing::$f is missing"; done
           [ -f .gitea/workflows/ci.yml ] || echo "::warning title=No CI::No CI workflow found"
       - name: Install Trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.2/contrib/install.sh | sh -s -- -b /usr/local/bin  # nosemgrep: download-and-execute
       - name: Secret scan
         run: trivy fs --scanners secret --exit-code 0 .
\ No newline at end of file
diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml
index 2217521..09649bb 100644
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install Trivy
         run: |
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.2/contrib/install.sh | sh -s -- -b /usr/local/bin  # nosemgrep: download-and-execute
       # A nightly scan exists to catch CVEs published against code that did
       # not change. With `--exit-code 0` it could never report failure, so it
       # could never raise that alarm -- the one job whose entire purpose is