diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 707d4df..baac757 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -21,5 +21,15 @@ jobs:
       - name: Sanity checks
         run: make sanity
 
+      - name: Scan image
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "donk"
+          format: "table"
+          exit-code: "1"
+          # ignore-unfixed: true
+          # vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+
       # - name: Kind sanity checks
       #   run: make kind-sanity