diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c999dba..84fffad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         run: npm test
         env:
           NODE_ENV: test
-          JWT_SECRET: "${{ secrets.JWT_SECRET }}"
+          JWT_SECRET: ci-test-demo-secret
           STORAGE_BACKEND: json
 
       - name: Check for vulnerabilities
@@ -50,10 +50,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: [REDACTED:high_entropy:21b90074]@v3
+        uses: docker/setup-buildx-action@v3
 
       - name: Build image for scanning
-        uses: [REDACTED:high_entropy:3e3fdc23]@v5
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: false
@@ -68,6 +68,7 @@ jobs:
           exit-code: 1
           severity: CRITICAL,HIGH
           ignore-unfixed: true
+          trivyignores: .trivyignore
 
       - name: Trivy - Helm chart misconfiguration scan
         uses: aquasecurity/trivy-action@master
@@ -106,7 +107,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: [REDACTED:high_entropy:21b90074]@v3
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -125,7 +126,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: [REDACTED:high_entropy:3e3fdc23]@v5
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: true
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..d101eff
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,9 @@
+# Base image system npm vulnerabilities (node:lts-alpine)
+# These are in /usr/local/lib/node_modules/npm/ — NOT app dependencies.
+# Safe to ignore until the base image is updated.
+
+# path-to-regexp: ReDoS via malformed URL parameters (system npm)
+CVE-2026-4867
+
+# picomatch: ReDoS via crafted extglob patterns (system npm)
+CVE-2026-33671
\ No newline at end of file
diff --git a/chart/values.yaml b/chart/values.yaml
index 64a34fb..08c59be 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -28,7 +28,7 @@ securityContext:
   capabilities:
     drop:
     - ALL
-  readOnlyRootFilesystem: false
+  readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 1000
 
@@ -84,7 +84,7 @@ env:
 
 # Sensitive environment variables sourced from Kubernetes Secrets
 # Create the secret first:
-#   kubectl create secret generic isms-builder-secrets [REDACTED:high_entropy:759cd97e]
+#   kubectl create secret generic isms-builder-secrets --from-literal=jwt-secret=YOUR_SECRET_HERE
 secretEnv:
   JWT_SECRET:
     secretName: isms-builder-secrets