diff --git a/.woodpecker/security-scan.yml b/.woodpecker/security-scan.yml
index 605bc6d5..2b3d39eb 100644
--- a/.woodpecker/security-scan.yml
+++ b/.woodpecker/security-scan.yml
@@ -32,7 +32,7 @@ steps:
           i=$$((i+1))
           out="trivy-image-$$i.json"
           echo "=== [$$i] $$img -> $$out ==="
-          trivy image --skip-db-update --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
+          trivy image --skip-db-update --scanners vuln --timeout 15m --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
         done < /tmp/images.txt
     failure: ignore
 
@@ -40,8 +40,16 @@ steps:
     # Auto-fix run: only on master (cron / manual / direct push). On the
     # bot's own PR branches, the scans re-run as a re-validation gate but
     # this step is skipped — otherwise we'd fork-bomb PRs.
+    #
+    # status: [success, failure] is required: image-scans has
+    # `failure: ignore` to avoid failing the workflow on a single
+    # bad image, but Woodpecker still skips downstream steps after
+    # a failed step unless they explicitly opt in. The agent's gating
+    # logic handles missing/empty JSON files gracefully — better to
+    # always reach the gate than silently skip on a flaky scan.
     when:
       - branch: master
+        status: [success, failure]
     image: gitea.renner.uno/gitea_admin/ci-claude:2026-05-01
     environment:
       CLAUDE_CODE_OAUTH_TOKEN: