Add container image vulnerability scanning to all CI pipelines using Trivy or Grype. Block deployments with critical CVEs.