diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index bee3fbd5..ca007708 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -302,6 +302,10 @@ jobs:
           image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table
 
   k8s-version-matrix-tests:
     # These should match the permissions in the called workflow.
diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml
index 89d6d884..6c12caf8 100644
--- a/.github/workflows/scan-images.yml
+++ b/.github/workflows/scan-images.yml
@@ -47,3 +47,7 @@ jobs:
           image: ${{ env.REGISTRY }}:${{ matrix.tag }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 1334c5d6..2b1d270d 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch
 
 # prometheus-config-reloader version, built from source in the "reloader" stage.
 # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md).
-ARG RELOADER_VERSION=v0.91.0
+ARG RELOADER_VERSION=v0.93.1
 
 # Multi-stage Docker build with platform-specific cache optimization:
 # 1. base-tools: Install system packages and tools (cached per platform)
@@ -90,9 +90,12 @@ WORKDIR /reloader-src
 RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \
         https://github.com/prometheus-operator/prometheus-operator.git .
 
-# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up.
+# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354
+# and GO-2026-6355 open against it. This is an exact version and so downgrades
+# as readily as it upgrades: check what upstream resolves before touching it,
+# and delete it once upstream passes it rather than bumping it forever.
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
-    go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0
+    go get golang.org/x/crypto@v0.56.0
 
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
     --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \