diff --git a/.forgejo/workflows/trivy-scan.yml b/.forgejo/workflows/trivy-scan.yml
new file mode 100644
index 0000000..7f35055
--- /dev/null
+++ b/.forgejo/workflows/trivy-scan.yml
@@ -0,0 +1,28 @@
+name: Trivy Vulnerability Scan
+on: [push]
+jobs:
+  trivy:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'json'
+          output: 'trivy-results.json'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          exit-code: '0'
+      - name: Upload results to DefectDojo
+        run: |
+          curl -s -X POST "${{ secrets.DEFECTDOJO_URL }}/api/v2/import-scan/" \
+            -H "Authorization: Token ${{ secrets.DEFECTDOJO_API_KEY }}" \
+            -F "scan_type=Trivy Scan" \
+            -F "file=@trivy-results.json" \
+            -F "product_name=${{ github.repository }}" \
+            -F "engagement_name=CI Scans" \
+            -F "auto_create_context=true" \
+            -F "active=true" \
+            -F "verified=false" \
+            -F "minimum_severity=Low"