diff --git a/.github/workflows/main-deploy.yml b/.github/workflows/main-deploy.yml
index 0e06d1c..7b3372a 100644
--- a/.github/workflows/main-deploy.yml
+++ b/.github/workflows/main-deploy.yml
@@ -21,6 +21,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run type checking
         run: npm run check
 
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 74bf10b..643097f 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -21,6 +21,10 @@ jobs:
 
       - name: Install dependencies
         run: npm ci
+
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run linting
         run: npm run lint
   check:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f245665..8c37478 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,7 +62,20 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push Docker images
+      - name: Build Docker image
+        run: docker build -t openreception/open-reception:${{ github.ref_name }} .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "openreception/open-reception:${{ github.ref_name }}"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+
+      - name: Push Docker images
         run: npm run docker:build-and-push
 
       - name: Create Release Archive