diff --git a/.github/actions/scout/action.yml b/.github/actions/scout/action.yml
new file mode 100644
index 0000000..1bde6f0
--- /dev/null
+++ b/.github/actions/scout/action.yml
@@ -0,0 +1,43 @@
+name: Scan image vulnerabilities
+description: Report all CVEs and reject fixable high or critical vulnerabilities
+inputs:
+  image:
+    description: Exact local or registry image reference to scan
+    required: true
+  platform:
+    description: Platform to scan when using a registry image
+    required: false
+  only-fixed:
+    description: Limit the release gate to vulnerabilities with an available fix
+    default: 'true'
+  dockerhub-user:
+    description: Docker Hub user for Scout authentication
+    required: true
+  dockerhub-password:
+    description: Docker Hub token for Scout authentication
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Report all vulnerabilities
+      uses: docker/scout-action@v1
+      with:
+        command: cves
+        image: ${{ inputs.image }}
+        platform: ${{ inputs.platform }}
+        exit-code: false
+        write-comment: false
+        dockerhub-user: ${{ inputs.dockerhub-user }}
+        dockerhub-password: ${{ inputs.dockerhub-password }}
+    - name: Check high and critical vulnerabilities
+      uses: docker/scout-action@v1
+      with:
+        command: cves
+        image: ${{ inputs.image }}
+        platform: ${{ inputs.platform }}
+        only-severities: critical,high
+        only-fixed: ${{ inputs.only-fixed }}
+        exit-code: true
+        write-comment: false
+        dockerhub-user: ${{ inputs.dockerhub-user }}
+        dockerhub-password: ${{ inputs.dockerhub-password }}
diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index d2759a0..ec222ed 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -35,6 +35,7 @@ jobs:
   build:
     needs: setup
     strategy:
+      fail-fast: false
       matrix:
         ruby: ${{ fromJson(needs.setup.outputs.ruby-versions) }}
         arch:
@@ -61,6 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Build and test
+        id: build-image
         env:
           RUBY_VER: ${{ matrix.ruby.version }}
           ARCH: ${{ matrix.arch }}
@@ -70,6 +72,14 @@ jobs:
         run: |
           make
           make test
+          echo "image=$(make --no-print-directory -s image-ref)" >> "$GITHUB_OUTPUT"
+      - name: Scan image
+        if: github.event_name == 'push'
+        uses: ./.github/actions/scout
+        with:
+          image: local://${{ steps.build-image.outputs.image }}
+          dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
       - uses: docker/login-action@v4
         if: github.event_name == 'push'
         with:
diff --git a/Makefile b/Makefile
index 23be189..de37a43 100644
--- a/Makefile
+++ b/Makefile
@@ -103,3 +103,8 @@ endif
 	-docker rm -f $(NAME)
 
 release: build push
+
+# Keep CI scans aligned with the version, variant and architecture built by make.
+.PHONY: image-ref
+image-ref:
+	@printf '%s\n' '$(REPO):$(TAG)'