diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index d43361b..c14d56f 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -116,7 +116,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan notebooks
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
@@ -174,7 +174,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan zotero
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
@@ -232,7 +232,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan docs
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
@@ -290,7 +290,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan api
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
@@ -348,7 +348,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan bcda
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o bcda-scan.json local/bcda:build
@@ -406,7 +406,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan llm
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o llm-scan.json local/llm:build
@@ -464,7 +464,7 @@ jobs:
 
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Scan mc
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o mc-scan.json local/mc:build
diff --git a/.gitea/workflows/harden.yml b/.gitea/workflows/harden.yml
index 9a3e6e3..4dfe506 100644
--- a/.gitea/workflows/harden.yml
+++ b/.gitea/workflows/harden.yml
@@ -30,7 +30,7 @@ jobs:
           CRANE_INSECURE: "true"
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Set up uv
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
diff --git a/.gitea/workflows/rebuild-all.yml b/.gitea/workflows/rebuild-all.yml
index b4014d3..19f4433 100644
--- a/.gitea/workflows/rebuild-all.yml
+++ b/.gitea/workflows/rebuild-all.yml
@@ -28,7 +28,7 @@ jobs:
           CRANE_INSECURE: "true"
 
       - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1
 
       - name: Set up uv
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
diff --git a/dev/scripts/backends/gitea.py b/dev/scripts/backends/gitea.py
index 2a4e81e..b8a2e31 100644
--- a/dev/scripts/backends/gitea.py
+++ b/dev/scripts/backends/gitea.py
@@ -19,7 +19,7 @@ from backends.github import (
 # Renovate bumps these via the regex manager in renovate.json; re-run
 # gen_config.py after a bump.
 # renovate: datasource=docker depName=aquasec/trivy
-TRIVY_VERSION = "0.76.0"
+TRIVY_VERSION = "0.76.1"
 # renovate: datasource=docker depName=gcr.io/go-containerregistry/crane
 CRANE_VERSION = "0.22.1"