diff --git a/.github/workflows/build-containers.yaml b/.github/workflows/build-containers.yaml
index 5566bf7de..0aa906558 100644
--- a/.github/workflows/build-containers.yaml
+++ b/.github/workflows/build-containers.yaml
@@ -55,14 +55,19 @@ jobs:
       
       # if push to master of release, run trivy scan on the image
       - name: Trivy scan
-        #if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         uses: aquasecurity/trivy-action@0.28.0
         with:
-          image-ref: ghcr.io/${{ github.repository }}/fedn:${{ steps.meta1.outputs.sha }}
-          format: table
+          image-ref: ghcr.io/${{ github.repository }}/fedn:master
+          format: 'sarif'
+          output: 'trivy-results.sarif'
           exit-code: 0
           severity: HIGH,CRITICAL
           ignore-unfixed: false
           vuln-type: os,library,application
-          light: false
-          token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+      
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        with:
+          sarif_file: 'trivy-results.sarif'
\ No newline at end of file