diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 09791f1..68961d7 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -136,7 +136,7 @@ jobs:
               run: /tmp/semgrep/bin/semgrep scan --config p/javascript --config p/typescript --metrics off --sarif --output semgrep-results.sarif src scripts
             - name: Dependency and secret scan
               if: ${{ !cancelled() }}
-              run: trivy fs --format sarif --output trivy-results.sarif --skip-dirs node_modules,dist,coverage .
+              run: trivy fs --db-repository public.ecr.aws/aquasecurity/trivy-db:2 --format sarif --output trivy-results.sarif --skip-dirs node_modules,dist,coverage .
             - name: Security reports
               if: ${{ always() }}
               uses: https://gitea.com/actions/upload-artifact@v3
diff --git a/docs/gitea-actions.md b/docs/gitea-actions.md
index 696f21b..39e8dcf 100644
--- a/docs/gitea-actions.md
+++ b/docs/gitea-actions.md
@@ -36,6 +36,8 @@ branch slug; stable promotions share one group and are not cancelled in progress
 Validation uses Node 24.21.0 and Bun 1.4.2 with the frozen lockfile. The image
 job uses Docker 29.8.2 and its matching Docker-in-Docker service. Scanner
 versions are Semgrep 1.180.0 and Trivy 0.75.0; Trivy downloads are checksum-checked.
+Trivy downloads its vulnerability database from Aqua's public ECR mirror because
+the default registries returned a missing database blob and a download timeout.
 Jobs select the `ubuntu-latest` label and require Linux container-job support.
 Allow at least the preserved 2 GiB Node heap plus runner and container overhead.