diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml
index be9559f8bf..e35937c300 100644
--- a/.github/workflows/trivy-analysis.yml
+++ b/.github/workflows/trivy-analysis.yml
@@ -10,7 +10,7 @@ defaults:
 jobs:
 
   analysis:
-    name: Vulnerability scanner for nightly containers
+    name: Vulnerability scanner for containers
     runs-on: ubuntu-latest
     if: github.repository == 'keycloak/keycloak'
     strategy:
@@ -18,15 +18,22 @@ jobs:
         container: [keycloak, keycloak-operator]
       fail-fast: false
     steps:
+      - name: Extract release ID
+        id: release
+        run: echo "id=${GITHUB_REF#refs/heads/release/}" >> $GITHUB_OUTPUT
+        
+      - name: Checkout code
+        uses: actions/checkout@v4
+        
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.29.0
         with:
-          image-ref: quay.io/keycloak/${{ matrix.container }}:nightly
+          image-ref: quay.io/keycloak/${{ matrix.container }}:${{ steps.release.outputs.id }}
           format: sarif
           output: trivy-results.sarif
           severity: MEDIUM,CRITICAL,HIGH
           ignore-unfixed: true
-          version: v0.57.1
+          security-checks: vuln
           timeout: 15m
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
@@ -36,4 +43,3 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: trivy-results.sarif
-          category: ${{ matrix.container }}