diff --git a/.gitea/workflows/security-scan.yml b/.gitea/workflows/security-scan.yml
index 221aa45..3d23f45 100644
--- a/.gitea/workflows/security-scan.yml
+++ b/.gitea/workflows/security-scan.yml
@@ -49,7 +49,13 @@ jobs:
         # trivy-action wrapper does nested checkouts and auth-juggling that
         # does not play well with Self-Hosted Gitea Actions, this is more
         # robust and a smaller surface.
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin
+        #
+        # Version pinned: the install script otherwise hits api.github.com to
+        # resolve "latest", which is unauthenticated and burns through the
+        # self-hosted runner's GitHub rate-limit on each push. Pinning skips
+        # the API call entirely. Renovate-bot keeps the version current:
+        # renovate: datasource=github-releases depName=aquasecurity/trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.70.0
 
       - name: Run Semgrep SAST
         # --config=auto pulls language-appropriate rule packs from semgrep.dev