diff --git a/.github/workflows/container-image-scan.yml b/.github/workflows/container-image-scan.yml
index df0d4c0..fdf8b59 100644
--- a/.github/workflows/container-image-scan.yml
+++ b/.github/workflows/container-image-scan.yml
@@ -37,10 +37,15 @@ jobs:
             image: 'nvcr.io/nvidia/k8s/dcgm-exporter:latest'
           - name: otel-collector-contrib
             image: 'otel/opentelemetry-collector-contrib@sha256:fd328de2552466ad78385e1b1289c3f2402b1c45f265b252aab1955b42845ac1'
+          # Drift monitor, not the deployment ref: compose runs these images at
+          # their pinned digests (guarded by tests/test_container_security_scan.py).
+          # Scanning the floating tags here keeps the weekly CI able to detect an
+          # upstream rebuild clearing pcre2 CVE-2026-103111 (#111) — pinning the
+          # matrix to the frozen digest would mute that re-pin signal.
           - name: clamav
-            image: 'clamav/clamav:latest@sha256:7659dcb0db47941d3cf8336af84bbb63c7e70b76fc00601774358412b42ed186'
+            image: 'clamav/clamav:latest'
           - name: clamav-base
-            image: 'clamav/clamav:latest_base@sha256:4bd758114dbe0964edf6742cd8ddd98ed73eb8fcd70ce8bb4f53b19a79f07fe1'
+            image: 'clamav/clamav:latest_base'
           - name: rsigma
             image: 'ghcr.io/timescale/rsigma:0.19.0'
           - name: goflow2