diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index e623629a..b9045517 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -168,7 +168,7 @@ jobs:
           # to handle golang.org/x packages which report as compound license
           allow-licenses: >-
             MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC,
-            BlueOak-1.0.0, OFL-1.1,
+            BlueOak-1.0.0, OFL-1.1, CC-BY-4.0, MPL-2.0,
             LicenseRef-scancode-google-patent-license-golang,
             BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang