diff --git a/.github/workflows/vuln-scan.yml b/.github/workflows/vuln-scan.yml
index 4b7c8be49..f356ddf3d 100644
--- a/.github/workflows/vuln-scan.yml
+++ b/.github/workflows/vuln-scan.yml
@@ -1,6 +1,8 @@
 name: Vulnerability Scan
 
 on:
+  release:
+    types: [published]
   pull_request:
     paths:
       - 'cmd/**'
@@ -11,20 +13,9 @@ on:
       - '.github/workflows/vuln-scan.yml'
       - '.github/workflows/docker-release.yml'
       - '.github/workflows/docker-snapshot.yml'
-  push:
-    branches:
-      - main
-    paths:
-      - 'cmd/**'
-      - 'internal/**'
-      - 'database/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/vuln-scan.yml'
-      - '.github/workflows/docker-release.yml'
-      - '.github/workflows/docker-snapshot.yml'
+  workflow_dispatch:
   schedule:
-    - cron: '0 4 * * 1'
+    - cron: '0 4 */2 * *'
 
 concurrency:
   group: vuln-scan-${{ github.ref }}
diff --git a/docu/security/SUPPLY_CHAIN_SECURITY.md b/docu/security/SUPPLY_CHAIN_SECURITY.md
index 9d71b8dd7..009d4d7ce 100644
--- a/docu/security/SUPPLY_CHAIN_SECURITY.md
+++ b/docu/security/SUPPLY_CHAIN_SECURITY.md
@@ -121,7 +121,7 @@ Release workflow enforces semantic version parsing from the Git tag.
 The repository provides a report-only Trivy workflow for continuous visibility.
 
 - Repository filesystem scans (`scan-type: fs`) cover source and dependency manifests.
-- Container image scans (`scan-type: image`) build and scan each service image on `push` to `main` and on scheduled runs.
+- Container image scans (`scan-type: image`) build and scan each service image on scheduled runs.
 - Findings are uploaded as SARIF.
 - Current mode does not fail builds.
 - Maintainers can later switch to fail on threshold (for example `HIGH,CRITICAL`) once baseline noise is reduced.