diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 9c3f661..8a80bb7 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -53,6 +53,9 @@ jobs:
       contents: read
       security-events: write
     uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+    with:
+      # Audit reports via SARIF; job status should mean "scan ran", not "repo has vulns".
+      fail-on-vuln: false
 
   trivy-audit:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'