diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 2e48d22..c8885f0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -248,35 +248,37 @@ jobs:
       TRIVY_VERSION: "0.76.1"
       TRIVY_SEVERITY: "HIGH,CRITICAL"
     steps:
-      - name: install trivy
-        run: |
-          set -euo pipefail
-          curl -fsSL -o /tmp/trivy.tar.gz \
-            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-          tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy
-          chmod +x /usr/local/bin/trivy
-          trivy --version
-
+      # trivy запускается официальным образом через docker-сокет: не требует
+      # скачивания бинаря (github releases отдаёт медленно) + БД кэшируется в
+      # /opt/trivy-cache на build-хосте.
       - name: "trivy image (HIGH/CRITICAL -> fail)"
         run: |
           set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
           echo "scan: ${IMAGE}"
-          trivy image \
-            --image-src docker \
-            --scanners vuln \
-            --severity "$TRIVY_SEVERITY" \
-            --ignore-unfixed \
-            --exit-code 1 \
-            --format table \
-            "$IMAGE" 2>&1 | tee trivy-report.txt
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /opt/trivy-cache:/root/.cache/trivy \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
+              --image-src docker --scanners vuln \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
+              --exit-code 1 --format table "$IMAGE" 2>&1 | tee trivy-report.txt
 
       - name: trivy json report
         if: always()
         run: |
+          set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
-          trivy image --image-src docker --scanners vuln --severity "$TRIVY_SEVERITY" \
-            --ignore-unfixed --format json -o trivy-report.json "$IMAGE" || true
+          mkdir -p reports
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /opt/trivy-cache:/root/.cache/trivy \
+            -v "$PWD/reports:/reports" \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
+              --image-src docker --scanners vuln \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
+              --format json -o /reports/trivy-report.json "$IMAGE" || true
+          cp reports/trivy-report.json ./trivy-report.json 2>/dev/null || true
 
       - name: upload trivy report
         if: always()