diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 013448e..9ae6265 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,6 +120,7 @@ jobs:
     needs: build-vxmetadataupdater
     permissions:
       packages: read
+      security-events: write
     env:
       TRIVY_DISABLE_VEX_NOTICE: true
     steps: