diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d576093..7126b19 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,6 +16,15 @@ jobs:
         run: |
           docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
           docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
+      - name: Backend dependency vulnerability scan (HIGH/CRITICAL)
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          scan-type: fs
+          scan-ref: backend
+          format: table
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
       - name: Remove CI stack
         if: always()
         run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans