diff --git a/.github/workflows/ci.py b/.github/workflows/ci.py
index 06c195568..f56934918 100644
--- a/.github/workflows/ci.py
+++ b/.github/workflows/ci.py
@@ -225,8 +225,11 @@ def install_grype(exe: str = '/tmp/grype') -> str:
     'CVE-2025-12781',
     'CVE-2025-11468',
     'CVE-2026-2297',
+    'CVE-2026-3644',
+    'CVE-2026-4224',
     # github.com/nwaples/rardecode/v2
     'CVE-2025-11579', # rardecode is version 2.2.1, not vulnerable
+    'CVE-2026-2673',  # openssl fix not released
 ]