diff --git a/README.md b/README.md
index b9b706a..c9f8b36 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Mount your project at `/app` and run with no arguments. The container
 automatically runs the full Go workflow:
 
 ```
-go mod tidy  →  gofmt -w .  →  go vet ./...  →  go test ./...  →  go build ./...
+go mod tidy  →  gofmt -w .  →  go vet ./...  →  govulncheck ./...  →  go test ./...  →  go build ./...
 ```
 
 ```shell
diff --git a/rootfs/usr/local/bin/go-workflow b/rootfs/usr/local/bin/go-workflow
index 21c1cd4..14e2c1c 100755
--- a/rootfs/usr/local/bin/go-workflow
+++ b/rootfs/usr/local/bin/go-workflow
@@ -61,9 +61,11 @@ run_step "go mod tidy" go mod tidy
 run_step "gofmt -w ." gofmt -w .
 # 3. Catch suspicious constructs
 run_step "go vet ./..." go vet ./...
-# 4. Run tests — fail fast before wasting time on a build
+# 4. Scan dependencies against the Go vulnerability database
+run_step "govulncheck ./..." govulncheck ./...
+# 5. Run tests — fail fast before wasting time on a build
 run_step "go test ./..." go test ./...
-# 5. Build all main packages; output lands alongside source in each package dir
+# 6. Build all main packages; output lands alongside source in each package dir
 run_step "go build ./..." go build "${BUILD_FLAGS[@]}" ./...
 
 echo "✅ Done."