diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e3ece3f..2c02355 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,6 +5,8 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+  schedule:
+    - cron: '17 5 * * *'
 
 permissions:
   contents: read
@@ -20,6 +22,7 @@ jobs:
           fetch-depth: 0
       - name: Relevant changes
         id: changes
+        if: github.event_name != 'schedule'
         run: |
           if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
             git fetch --no-tags origin "$GITHUB_BASE_REF"
@@ -39,6 +42,7 @@ jobs:
           fi
           echo "base=$base" >> "$GITHUB_OUTPUT"
       - name: CHANGELOG entry for data changes
+        if: github.event_name != 'schedule'
         run: |
           base='${{ steps.changes.outputs.base }}'
           if ! git diff --quiet "$base"...HEAD -- data testdata/shipped_shape.txt && git diff --quiet "$base"...HEAD -- CHANGELOG.md; then
@@ -55,6 +59,11 @@ jobs:
       - name: Lowest supported Go
         if: ${{ !cancelled() && steps.changes.outputs.code == 'true' }}
         run: docker build --build-arg GO_VERSION=1.22.12 --target portable .
+      # Runs on every event, and daily, since a vulnerability is published without a change
+      # here; `--no-cache-filter` keeps a cached pass from hiding one.
+      - name: Known vulnerabilities in this Go release and the module
+        if: ${{ !cancelled() }}
+        run: docker build --no-cache-filter vulnerabilities --target vulnerabilities .
       - name: Package repositories, signed with throwaway keys
         if: ${{ !cancelled() && steps.changes.outputs.packaging == 'true' }}
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index b32d2bd..cd8d808 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # Rules
 
-- Go runs only through `docker compose run --rm <test|vet|fmt|build|cyclo|generate>`; the merge gate is `docker build .`, CI's changelog check and, for a change the README's Development section lists, its package-repository checks.
+- Go runs only through `docker compose run --rm <test|vet|fmt|build|cyclo|generate>`; the merge gate is `docker build .`, CI's changelog check, its known-vulnerabilities check and, for a change the README's Development section lists, its package-repository checks.
 - Tests first, in their own commit; the implementation follows in the next. A re-pin of seeded output or of `testdata/shipped_shape.txt` is its own commit.
 - A change under `data/` or to the shape pin adds its `CHANGELOG.md` entry under `Unreleased` in the same PR, and so does a change to a flag, an exit code, an exported name, a fence, a builtin or the lowest Go; what is major is the README's Versioning table.
 - One-line commit messages: no ticket prefix, no repo name, no authorship trailers.
diff --git a/Dockerfile b/Dockerfile
index 5cf3da1..619948a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,11 @@ RUN go vet ./... && \
 	go run github.com/fzipp/gocyclo/cmd/gocyclo@v0.6.0 -over 14 -ignore _test . && \
 	go test -race ./...
 
+FROM golang:${GO_VERSION} AS vulnerabilities
+WORKDIR /app
+COPY . .
+RUN go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 -scan module
+
 FROM python:3.14.8-slim AS release-tooling
 COPY release-tooling/ /release-tooling/
 RUN python3 -m unittest discover -s /release-tooling -p '*_test.py' && touch /tested
diff --git a/README.md b/README.md
index 7d58903..60de9d0 100644
--- a/README.md
+++ b/README.md
@@ -1219,8 +1219,15 @@ check and the release tooling's tests:
 docker build .                                                  # latest
 docker build --build-arg GO_VERSION=1.22.12 --target portable . # lowest supported
 GO_VERSION=1.22.12 docker compose run --rm test                 # the same tests, without the image build
+docker build --no-cache-filter vulnerabilities --target vulnerabilities .  # known vulnerabilities
 ```
 
+The last line runs `govulncheck` over the Go release the gate builds with and the module's
+requirements, and fails on any known vulnerability, whether or not fejkdata calls it: the
+release binaries carry that Go release, and image scanners flag it. CI runs it on every pull
+request and push, and daily, and a release waits for it. A failure is fixed by raising
+`GO_VERSION`, which Renovate opens a pull request for.
+
 A change to Go code, `release-tooling/`, the `Dockerfile`, `.dockerignore`, the licence
 files or either workflow also runs the package-repository checks. They build the release
 binaries for every platform and the apt, dnf and apk repositories, sign the repositories