diff --git a/.gitignore b/.gitignore
index 430eddbd0..88a9f5c19 100644
--- a/.gitignore
+++ b/.gitignore
@@ -205,3 +205,7 @@ source/Calamari.Tests/Some sample text
 # Claude Code: per-developer files
 CLAUDE.local.md
 .claude/settings.local.json
+
+# Python bytecode from scripts/
+__pycache__/
+*.pyc
diff --git a/scripts/scan-calamari-cves/README.md b/scripts/scan-calamari-cves/README.md
index c7b9d13a9..c7b8f8661 100644
--- a/scripts/scan-calamari-cves/README.md
+++ b/scripts/scan-calamari-cves/README.md
@@ -3,11 +3,21 @@
 Run `./scan.sh`. Takes about ten minutes, most of it downloading a ~270 MB package.
 
 ```bash
-./scan.sh                # latest main-branch CI build
-./scan.sh 2026.3.508     # a specific published version
-./scan.sh --local        # publish from your working tree and scan that
+./scan.sh                              # latest main-branch CI build
+./scan.sh 2026.3.508                   # a specific published version
+./scan.sh 2025.3.417 2026.3.508        # several, e.g. the supported release tips
+./scan.sh --local                      # publish from your working tree and scan that
+./scan.sh --previous-state=old.json 2026.3.508   # only tell me what changed
 ```
 
+`--previous-state` makes the script exit **3** when the reported CVE set differs from that
+file, so a shell or CI job can treat "the answer changed" as the actionable event. Without
+it the script always exits 0.
+
+Under `--octopus` it always exits 0 and reports change through the `HasNewFindings` output
+variable instead. Octopus fails a step on any non-zero exit, and "the set changed" is
+precisely the case that needs the notify and save-state steps to run.
+
 ## Why this rather than `dotnet list package --vulnerable`
 
 **They answer different questions, and the local one over-reports.**
@@ -76,3 +86,43 @@ regression test for it passes on the *vulnerable* version, which is the proof.
 - Vulnerability databases move daily. `CVE-2026-44788` was absent from the NuGet audit
   source at 10:45 and present by 15:00 on the same day. Re-run rather than cite an old
   result.
+
+## Running it on a schedule
+
+The script only helps someone who thinks to run it, and two independent things change the
+answer:
+
+1. **The artifact changes** — a new build bundles a new .NET runtime.
+2. **The world changes** — a CVE is published against an artifact that has not moved.
+   Nothing in this repo changes. Only a schedule catches this, and it is the one that bites
+   (see the `CVE-2026-44788` note under Caveats).
+
+The `Scan Calamari for CVEs` runbook in the `calamari-cve-scanning` Octopus project runs
+this script daily and posts to Slack **only when the set changes**. It invokes the script
+straight from this repo, so there is one implementation and the runbook tracks `main`.
+
+`--octopus` is what it passes: read the previous state from the `Calamari.CveScan.State`
+variable, write the new state, `HasNewFindings` and `SlackSummary` back as output variables,
+and attach the raw scanner JSON as run artifacts.
+
+### Scanners in and out of containers
+
+By default the two scanners run as docker containers, so a local run needs no install step.
+Inside an Octopus execution container the step is *already* in a container, so
+docker-in-docker is unavailable — `--runner=native` (auto-detected) uses `trivy` and `grype`
+from `PATH` instead, installing them if missing.
+
+Those installs are **unpinned**, which is weaker than it should be for a scheduled job: a
+scanner upgrade and a genuine new CVE look identical in the diff. Set `TRIVY_VERSION` /
+`GRYPE_VERSION` to pin, or bake both into a pinned execution container image.
+
+### Why runtime drift is part of the state
+
+The comparison also flags a bundled runtime that trails the current patch, or has fallen out
+of support, using Microsoft's published releases index. That signal matters on its own —
+per the EOL trap below, a clean runtime scan on an old artifact usually means nobody is
+publishing advisories any more, not that it is safe.
+
+It is folded into the stored state rather than reported every run. A runtime that
+permanently trails would otherwise fire an identical alert every night, which is how an
+alert becomes something everyone mutes.
diff --git a/scripts/scan-calamari-cves/compare.py b/scripts/scan-calamari-cves/compare.py
new file mode 100755
index 000000000..7b4f40cf9
--- /dev/null
+++ b/scripts/scan-calamari-cves/compare.py
@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""Aggregate per-version summaries, compare against previous state, report changes.
+
+Called by scan.sh after every version has been scanned. Reads
+<workdir>/<label>/summary.json plus <workdir>/previous.json, writes
+<workdir>/summary.json (the new state) and <workdir>/slack.txt (the notification
+body), and prints the human diff.
+
+Exit code 3 means "the answer changed" - that is the actionable event for a
+scheduler. Exit 0 means nothing moved, so a nightly run stays quiet.
+"""
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+RELEASES_INDEX = "https://raw.githubusercontent.com/dotnet/core/main/release-notes/releases-index.json"
+
+
+def parse_version(v):
+    parts = []
+    for chunk in str(v).split("."):
+        try:
+            parts.append(int(chunk))
+        except ValueError:
+            parts.append(0)
+    return tuple(parts)
+
+
+def latest_patches():
+    """{channel: latest runtime} from Microsoft, or {} if unreachable.
+
+    Best effort on purpose. A scan that cannot reach GitHub should still report its
+    CVE findings rather than fail.
+    """
+    try:
+        with urllib.request.urlopen(RELEASES_INDEX, timeout=20) as r:
+            doc = json.loads(r.read())
+    except Exception:
+        return {}
+    out = {}
+    for entry in doc.get("releases-index") or []:
+        channel = entry.get("channel-version")
+        latest = entry.get("latest-runtime")
+        if channel and latest:
+            out[channel] = {"latest": latest, "eol": entry.get("eol-date"),
+                            "support": entry.get("support-phase")}
+    return out
+
+
+def runtime_notes(runtimes, patches):
+    """Flag bundled runtimes that trail the current patch, or are out of support.
+
+    This matters independently of any CVE. A self-contained app carries its own
+    runtime, and Microsoft stops publishing advisories for out-of-support versions -
+    so scanners go quiet on exactly the artifacts that deserve the most suspicion.
+    A clean runtime scan on an old artifact is not evidence it is safe.
+    """
+    notes = []
+    for rt in runtimes:
+        channel = ".".join(str(rt).split(".")[:2])
+        info = patches.get(channel)
+        if not info:
+            continue
+        if parse_version(rt) < parse_version(info["latest"]):
+            notes.append(f"{rt} trails the current {channel} patch ({info['latest']})")
+        phase = (info.get("support") or "").lower()
+        if phase and phase not in ("active", "maintenance", "lts"):
+            notes.append(f"{rt} is {phase}" + (f", EOL {info['eol']}" if info.get("eol") else ""))
+    return notes
+
+
+def advisory_url(ident):
+    """Where an identifier resolves.
+
+    Both schemes turn up here: the two scanners name the same underlying advisory
+    differently - Trivy reports CVE-2026-44788 where Grype reports GHSA-6c8g-7p36-r338.
+    """
+    if str(ident).upper().startswith("GHSA-"):
+        return f"https://github.com/advisories/{ident}"
+    return f"https://nvd.nist.gov/vuln/detail/{ident}"
+
+
+def main():
+    workdir = Path(sys.argv[1])
+    labels = sys.argv[2:]
+
+    state = {}
+    for label in labels:
+        path = workdir / label / "summary.json"
+        if path.exists():
+            s = json.loads(path.read_text())
+            state[label] = {"runtime": s.get("runtime", []), "cves": s.get("cves", [])}
+
+    try:
+        previous = json.loads((workdir / "previous.json").read_text() or "{}")
+        if not isinstance(previous, dict):
+            previous = {}
+    except Exception:
+        previous = {}
+
+    patches = latest_patches()
+
+    changed = False
+    plain, slack = [], []
+
+    # The same report is rendered twice: once for the task log, once for Slack. Slack
+    # gets bullets and links; the log gets bare URLs, which stay clickable in a terminal
+    # and readable in Octopus.
+    def emit(p, s_=None):
+        plain.append(p)
+        slack.append(p if s_ is None else s_)
+
+    def emit_ids(ids, indent="  "):
+        for ident in sorted(ids):
+            emit(f"{indent}- {ident}  {advisory_url(ident)}",
+                 f"{indent}\u2022 <{advisory_url(ident)}|{ident}>")
+
+    # Drift is folded into the state rather than reported standalone. A runtime that
+    # permanently trails the current patch would otherwise alert on every single run,
+    # which is how an alert becomes something everyone mutes.
+    for label, now in state.items():
+        now["drift"] = runtime_notes(now["runtime"], patches)
+
+    for label in labels:
+        now = state.get(label)
+        if now is None:
+            continue
+        before = previous.get(label)
+        cves_now = set(now["cves"])
+
+        if before is None:
+            # No baseline for this version. Report it once so the first run establishes
+            # what "normal" looks like, rather than silently adopting it.
+            changed = True
+            emit(f"{label} - first scan, establishing the baseline",
+                 f"*{label}* - first scan, establishing the baseline")
+            emit(f"  runtime: {', '.join(now['runtime']) or 'none found'}")
+            if cves_now:
+                emit(f"  {len(cves_now)} distinct CVE(s):")
+                emit_ids(cves_now)
+            else:
+                emit("  no CVEs reported")
+            for note in now["drift"]:
+                emit(f"  runtime drift: {note}")
+            continue
+
+        cves_before = set(before.get("cves") or [])
+        added = sorted(cves_now - cves_before)
+        removed = sorted(cves_before - cves_now)
+        rt_before = list(before.get("runtime") or [])
+        rt_changed = rt_before != list(now["runtime"])
+        drift_before = list(before.get("drift") or [])
+        drift_new = [d for d in now["drift"] if d not in drift_before]
+
+        if added or removed or rt_changed or drift_new:
+            changed = True
+            emit(f"{label}", f"*{label}*")
+            if added:
+                emit(f"  NEW ({len(added)}):")
+                emit_ids(added)
+            if removed:
+                emit(f"  no longer reported ({len(removed)}):")
+                emit_ids(removed)
+            if rt_changed:
+                emit(f"  runtime: {', '.join(rt_before) or 'none'}"
+                     f" -> {', '.join(now['runtime']) or 'none'}")
+            for note in drift_new:
+                emit(f"  runtime drift: {note}")
+
+    print("\nCompared against previous state")
+    if not previous:
+        print("  no previous state supplied - this run establishes the baseline")
+    if changed:
+        for line in plain:
+            print("  " + line)
+    else:
+        print("  no change: same distinct CVE set, same bundled runtime")
+
+    # Merge into the previous state rather than replacing it. A run only scans the versions
+    # it was asked for, so replacing would drop every other version's baseline: an ad-hoc
+    # "scan the version this customer reported" run would silently wipe the scheduled
+    # baseline, and the next scheduled run would re-alert from scratch as a first scan.
+    merged = dict(previous)
+    merged.update(state)
+    (workdir / "summary.json").write_text(json.dumps(merged, indent=2, sort_keys=True))
+    (workdir / "slack.txt").write_text("\n".join(slack) if slack else "No change.")
+
+    sys.exit(3 if changed else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/scan-calamari-cves/scan.sh b/scripts/scan-calamari-cves/scan.sh
index 879dd4250..67f824ce4 100755
--- a/scripts/scan-calamari-cves/scan.sh
+++ b/scripts/scan-calamari-cves/scan.sh
@@ -7,114 +7,237 @@
 # scanners never see. This script scans the real shipped artifact instead.
 #
 # Usage:
-#   ./scan.sh                      # scan the latest main-branch CI build from feedz
-#   ./scan.sh 2026.3.508           # scan a specific published version
-#   ./scan.sh --local              # publish from the working tree and scan that
+#   ./scan.sh                          # scan the latest main-branch CI build from feedz
+#   ./scan.sh 2026.3.508               # scan a specific published version
+#   ./scan.sh 2025.3.417 2026.3.508    # scan several, e.g. the supported release tips
+#   ./scan.sh --local                  # publish from the working tree and scan that
 #
-# Requires: docker (or OrbStack), curl, unzip, python3. dotnet only for --local.
+# Comparing against a previous result:
+#   ./scan.sh --previous-state=old.json 2026.3.508
+#
+# Exits 3 when the reported CVE set differs from that previous state, so CI or a shell
+# can treat "the answer changed" as the actionable event. A plain run with no previous
+# state always exits 0. Under --octopus it always exits 0 and signals change through the
+# HasNewFindings output variable instead, because Octopus fails a step on any non-zero
+# exit and "changed" is the case that most needs the later steps to run.
+#
+# Requires: curl, unzip, python3, and either docker (default) or trivy+grype on PATH.
+# dotnet only for --local.
 
 set -euo pipefail
 
-WORKDIR="${TMPDIR:-/tmp}/calamari-cve-scan"
+WORKDIR="${CALAMARI_SCAN_WORKDIR:-}"
 FEED="https://f.feedz.io/octopus-deploy/dependencies/nuget/v3"
 PKG="octopus.calamari.consolidated"
 MODE="feed"
-VERSION=""
+RUNNER="${SCAN_RUNNER:-auto}"
+OCTOPUS=0
+PREV_STATE_FILE=""
+VERSIONS=()
 
 for arg in "$@"; do
   case "$arg" in
     --local) MODE="local" ;;
-    --help|-h) sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
-    *) VERSION="$arg" ;;
+    --octopus) OCTOPUS=1 ;;
+    --runner=*) RUNNER="${arg#*=}" ;;
+    --previous-state=*) PREV_STATE_FILE="${arg#*=}" ;;
+    --help|-h) sed -n '2,24p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    --*) echo "unknown option: $arg" >&2; exit 2 ;;
+    *) VERSIONS+=("$arg") ;;
   esac
 done
 
-say() { printf '\n\033[1m%s\033[0m\n' "$*"; }
+# Octopus collects artifacts from the step's working directory on the host. When the step
+# runs in an execution container, anything written to /tmp lives and dies inside that
+# container, so artifacts registered from there are gone before collection.
+if [ -z "$WORKDIR" ]; then
+  if [ "$OCTOPUS" = 1 ]; then WORKDIR="$PWD/calamari-cve-scan"; else WORKDIR="${TMPDIR:-/tmp}/calamari-cve-scan"; fi
+fi
+
+# Only colour a real terminal. Octopus captures stdout into a task log, where raw
+# escape codes show up verbatim and make the log harder to read, not easier.
+if [ -t 1 ]; then BOLD=$'\033[1m'; RESET=$'\033[0m'; else BOLD=''; RESET=''; fi
+say()  { printf '\n%s%s%s\n' "$BOLD" "$*" "$RESET"; }
 note() { printf '  %s\n' "$*"; }
 
-rm -rf "$WORKDIR"; mkdir -p "$WORKDIR/scan"
+rm -rf "$WORKDIR"; mkdir -p "$WORKDIR"
 
-if [ "$MODE" = "local" ]; then
-  say "Publishing from the working tree (self-contained linux-x64, as shipped)"
-  REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-  dotnet publish "$REPO_ROOT/source/Calamari/Calamari.csproj" \
-    -c Release -f net8.0 -r linux-x64 --self-contained true \
-    -o "$WORKDIR/scan" >/dev/null
-  note "published $(find "$WORKDIR/scan" -name '*.dll' | wc -l | tr -d ' ') DLLs"
-  note "NOTE: this uses YOUR SDK's runtime pack, which may differ from CI's."
-  note "      Compare against a feed scan before drawing conclusions."
-else
-  if [ -z "$VERSION" ]; then
-    say "Finding the latest published Calamari"
-    VERSION=$(curl -fsS "$FEED/registration/$PKG/index.json" \
-      | python3 -c "import json,sys,urllib.request
+# ---------------------------------------------------------------------------
+# Scanners
+#
+# Two databases are used deliberately. Customer scanners disagree with each other,
+# so one tool is not a baseline.
+#
+# Locally, running them as containers means no install step. Inside an Octopus
+# execution container the step is *already* in a container, so docker-in-docker is
+# not available and the binaries have to be on PATH instead.
+# ---------------------------------------------------------------------------
+
+if [ "$RUNNER" = "auto" ]; then
+  if command -v trivy >/dev/null 2>&1 && command -v grype >/dev/null 2>&1; then
+    RUNNER="native"
+  elif command -v docker >/dev/null 2>&1; then
+    RUNNER="docker"
+  else
+    RUNNER="native"  # nothing present; install below
+  fi
+fi
+
+ensure_scanners() {
+  if [ "$RUNNER" != "native" ]; then return 0; fi
+  if command -v trivy >/dev/null 2>&1 && command -v grype >/dev/null 2>&1; then return 0; fi
+
+  # NOTE: unpinned installs from upstream. Fine for an interactive run, weaker for a
+  # scheduled one, where a scanner upgrade and a genuine new CVE look identical in the
+  # diff. Baking both binaries into a pinned execution container image is the fix;
+  # until then set TRIVY_VERSION / GRYPE_VERSION to pin.
+  local bin="$WORKDIR/bin"; mkdir -p "$bin"; export PATH="$bin:$PATH"
+  say "Installing scanners (no docker available)"
+  command -v trivy >/dev/null 2>&1 || \
+    curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+      | sh -s -- -b "$bin" ${TRIVY_VERSION:+"$TRIVY_VERSION"} >/dev/null 2>&1
+  command -v grype >/dev/null 2>&1 || \
+    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \
+      | sh -s -- -b "$bin" ${GRYPE_VERSION:+"$GRYPE_VERSION"} >/dev/null 2>&1
+  note "trivy $(trivy --version 2>/dev/null | head -1)"
+  note "grype $(grype version 2>/dev/null | grep -i '^version' || echo installed)"
+}
+
+run_trivy() { # <scan dir> <out file>
+  if [ "$RUNNER" = "native" ]; then
+    trivy fs --scanners vuln --format json --quiet "$1" > "$2" 2>/dev/null || true
+  else
+    docker run --rm -v "$1":/scan:ro -v "$WORKDIR/trivy-cache":/root/.cache \
+      --platform linux/amd64 aquasec/trivy:latest fs --scanners vuln --format json --quiet /scan \
+      > "$2" 2>/dev/null || true
+  fi
+}
+
+run_grype() { # <scan dir> <out file>
+  if [ "$RUNNER" = "native" ]; then
+    grype "dir:$1" -o json -q > "$2" 2>/dev/null || true
+  else
+    docker run --rm -v "$1":/scan:ro -v "$WORKDIR/grype-cache":/root/.cache \
+      --platform linux/amd64 anchore/grype:latest dir:/scan -o json -q \
+      > "$2" 2>/dev/null || true
+  fi
+}
+
+latest_published_version() {
+  curl -fsS "$FEED/registration/$PKG/index.json" \
+    | python3 -c "import json,sys,urllib.request
 d=json.load(sys.stdin); last=d['items'][-1]
 items=last.get('items')
 if items is None:
     with urllib.request.urlopen(last['@id']) as r: items=json.loads(r.read()).get('items',[])
 vs=[(i.get('catalogEntry') or {}).get('version','') for i in items]
 vs=[v for v in vs if v and '-' not in v]
-print(vs[-1] if vs else '')")
-    [ -z "$VERSION" ] && { echo "could not determine latest version" >&2; exit 1; }
+print(vs[-1] if vs else '')"
+}
+
+# ---------------------------------------------------------------------------
+# Scan one version into $WORKDIR/<label>/
+# ---------------------------------------------------------------------------
+scan_one() { # <label> <version-or-empty>
+  local label="$1" version="${2:-}" dir="$WORKDIR/$1"
+  mkdir -p "$dir/scan"
+
+  if [ "$MODE" = "local" ]; then
+    say "Publishing from the working tree (self-contained linux-x64, as shipped)"
+    local root; root="$(cd "$(dirname "$0")/../.." && pwd)"
+    dotnet publish "$root/source/Calamari/Calamari.csproj" \
+      -c Release -f net8.0 -r linux-x64 --self-contained true -o "$dir/scan" >/dev/null
+    note "published $(find "$dir/scan" -name '*.dll' | wc -l | tr -d ' ') DLLs"
+    note "NOTE: this uses YOUR SDK's runtime pack, which may differ from CI's."
+    note "      Compare against a feed scan before drawing conclusions."
+  else
+    say "Downloading the shipped package for $version (this is what customers receive)"
+    curl -fsS --max-time 600 -o "$dir/cal.nupkg" \
+      "$FEED/packages/$PKG/$version/$PKG.$version.nupkg"
+    note "$(du -h "$dir/cal.nupkg" | awk '{print $1}')"
+
+    mkdir -p "$dir/pkg"
+    ( cd "$dir/pkg" && unzip -qq ../cal.nupkg )
+    local inner; inner=$(find "$dir/pkg/contentFiles" -name '*.zip' | head -1)
+    if [ -z "$inner" ]; then echo "no inner payload found for $version" >&2; return 1; fi
+    unzip -qq "$inner" -d "$dir/scan"
+    note "$(find "$dir/scan" -type f | wc -l | tr -d ' ') files"
   fi
-  note "version: $VERSION"
-
-  say "Downloading the shipped package (this is what customers receive)"
-  curl -fsS --max-time 600 -o "$WORKDIR/cal.nupkg" \
-    "$FEED/packages/$PKG/$VERSION/$PKG.$VERSION.nupkg"
-  note "$(du -h "$WORKDIR/cal.nupkg" | awk '{print $1}')"
-
-  say "Extracting"
-  mkdir -p "$WORKDIR/pkg"
-  ( cd "$WORKDIR/pkg" && unzip -qq ../cal.nupkg )
-  INNER=$(find "$WORKDIR/pkg/contentFiles" -name '*.zip' | head -1)
-  [ -z "$INNER" ] && { echo "no inner payload found" >&2; exit 1; }
-  unzip -qq "$INNER" -d "$WORKDIR/scan"
-  note "$(find "$WORKDIR/scan" -type f | wc -l | tr -d ' ') files"
+
+  say "Bundled .NET runtime for $label (self-contained, so this ships to every target)"
+  # -I skips binaries; the deps.json files carry the authoritative version and the
+  # self-contained helper binaries would otherwise emit "Binary file ... matches" noise.
+  grep -rhoIE 'runtimepack\.Microsoft\.NETCore\.App\.Runtime\.[a-z0-9-]+/[0-9.]+' "$dir/scan" 2>/dev/null \
+    | sort -u > "$dir/runtimes.txt" || true
+  if [ -s "$dir/runtimes.txt" ]; then sed 's/^/  /' "$dir/runtimes.txt"; else note "none found"; fi
+
+  note "scanning with trivy..."
+  run_trivy "$dir/scan" "$dir/trivy.json"
+  note "scanning with grype (second opinion, different vulnerability database)..."
+  run_grype "$dir/scan" "$dir/grype.json"
+
+  python3 "$(dirname "$0")/summarise.py" "$label" "$dir"
+}
+
+# ---------------------------------------------------------------------------
+
+ensure_scanners
+note "scanner runner: $RUNNER"
+
+if [ "$MODE" = "local" ]; then
+  scan_one "local" ""
+  LABELS=("local")
+else
+  if [ ${#VERSIONS[@]} -eq 0 ]; then
+    say "Finding the latest published Calamari"
+    v="$(latest_published_version)"
+    if [ -z "$v" ]; then echo "could not determine latest version" >&2; exit 1; fi
+    VERSIONS=("$v")
+  fi
+  note "versions: ${VERSIONS[*]}"
+  LABELS=()
+  for v in "${VERSIONS[@]}"; do scan_one "$v" "$v"; LABELS+=("$v"); done
 fi
 
-say "Bundled .NET runtime (self-contained, so this ships to every target)"
-# -I skips binaries; the deps.json files carry the authoritative version and the
-# self-contained helper binaries would otherwise emit "Binary file ... matches" noise.
-grep -rhoIE 'runtimepack\.Microsoft\.NETCore\.App\.Runtime\.[a-z0-9-]+/[0-9.]+' "$WORKDIR/scan" 2>/dev/null \
-  | sort -u | sed 's/^/  /' || note "none found"
-
-say "Trivy"
-docker run --rm -v "$WORKDIR/scan":/scan:ro -v "$WORKDIR/trivy-cache":/root/.cache \
-  --platform linux/amd64 aquasec/trivy:latest fs --scanners vuln --format json --quiet /scan \
-  > "$WORKDIR/trivy.json" 2>/dev/null || true
-python3 - "$WORKDIR/trivy.json" <<'PY'
-import json,sys
-try: d=json.load(open(sys.argv[1]))
-except Exception: print("  (no output)"); raise SystemExit
-seen=set(); total=0
-for r in d.get('Results') or []:
-    for v in (r.get('Vulnerabilities') or []):
-        total+=1
-        seen.add((v.get('Severity'),v.get('VulnerabilityID'),v.get('PkgName'),v.get('InstalledVersion'),v.get('FixedVersion')))
-print(f"  {total} matches across all flavours -> {len(seen)} DISTINCT")
-for s,c,p,i,f in sorted(seen):
-    print(f"  {s:9s} {c:22s} {p:38s} {i:14s} fixed: {f}")
-PY
-
-say "Grype (second opinion, different vulnerability database)"
-docker run --rm -v "$WORKDIR/scan":/scan:ro -v "$WORKDIR/grype-cache":/root/.cache \
-  --platform linux/amd64 anchore/grype:latest dir:/scan -o json -q \
-  > "$WORKDIR/grype.json" 2>/dev/null || true
-python3 - "$WORKDIR/grype.json" <<'PY'
-import json,sys
-try: d=json.load(open(sys.argv[1]))
-except Exception: print("  (no output)"); raise SystemExit
-seen=set()
-for m in d.get('matches') or []:
-    v=m.get('vulnerability') or {}; a=m.get('artifact') or {}
-    seen.add((str(v.get('severity')),str(v.get('id')),str(a.get('name')),str(a.get('version'))))
-print(f"  {len(d.get('matches') or [])} matches -> {len(seen)} DISTINCT")
-for s,c,p,ver in sorted(seen):
-    print(f"  {s:9s} {c:22s} {p:38s} {ver}")
-PY
+# ---------------------------------------------------------------------------
+# Aggregate, compare against previous state, report
+# ---------------------------------------------------------------------------
+PREV_JSON="{}"
+if [ -n "$PREV_STATE_FILE" ] && [ -f "$PREV_STATE_FILE" ]; then
+  PREV_JSON="$(cat "$PREV_STATE_FILE")"
+elif [ "$OCTOPUS" = 1 ]; then
+  PREV_JSON="$(get_octopusvariable "Calamari.CveScan.State" 2>/dev/null || echo '{}')"
+  [ -z "$PREV_JSON" ] && PREV_JSON="{}"
+fi
+printf '%s' "$PREV_JSON" > "$WORKDIR/previous.json"
+
+CHANGED=0
+python3 "$(dirname "$0")/compare.py" "$WORKDIR" "${LABELS[@]}" || CHANGED=$?
+if [ "$CHANGED" -ne 0 ] && [ "$CHANGED" -ne 3 ]; then exit "$CHANGED"; fi
+
+if [ "$OCTOPUS" = 1 ]; then
+  set_octopusvariable "Calamari.CveScan.State" "$(cat "$WORKDIR/summary.json")"
+  set_octopusvariable "HasNewFindings" "$([ "$CHANGED" -eq 3 ] && echo true || echo false)"
+  set_octopusvariable "SlackSummary" "$(cat "$WORKDIR/slack.txt")"
+  new_octopusartifact "$WORKDIR/summary.json" "summary.json"
+  for l in "${LABELS[@]}"; do
+    if [ -s "$WORKDIR/$l/trivy.json" ]; then new_octopusartifact "$WORKDIR/$l/trivy.json" "trivy-$l.json"; fi
+    if [ -s "$WORKDIR/$l/grype.json" ]; then new_octopusartifact "$WORKDIR/$l/grype.json" "grype-$l.json"; fi
+  done
+fi
 
 say "Done"
 note "artifacts kept in $WORKDIR (trivy.json / grype.json for raw detail)"
-note "If the two scanners disagree, prefer investigating over dismissing —"
+note "If the two scanners disagree, prefer investigating over dismissing -"
 note "they use different databases and different matching rules."
+
+# Octopus fails a step on any non-zero exit. "The set changed" is the normal, expected
+# outcome and the one that most needs the notify and save-state steps to run, so under
+# --octopus it is signalled by the HasNewFindings output variable and the script exits 0.
+# Outside Octopus, exit 3 still lets a shell or CI treat "changed" as actionable.
+if [ "$OCTOPUS" = 1 ]; then
+  note "HasNewFindings=$([ "$CHANGED" -eq 3 ] && echo true || echo false) (exit 0; Octopus signals change by variable, not exit code)"
+  exit 0
+fi
+
+exit "$CHANGED"
diff --git a/scripts/scan-calamari-cves/summarise.py b/scripts/scan-calamari-cves/summarise.py
new file mode 100755
index 000000000..64eef8c81
--- /dev/null
+++ b/scripts/scan-calamari-cves/summarise.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Turn one version's raw Trivy and Grype output into a summary.
+
+Called by scan.sh once per scanned version. Prints the human-readable table and
+writes <dir>/summary.json for compare.py to aggregate.
+
+Total matches and *distinct* CVEs differ a lot: the same finding repeats across
+~43 deps.json files, one per flavour and RID. A customer reporting 42
+vulnerabilities is routinely reporting one.
+"""
+import json
+import re
+import sys
+from pathlib import Path
+
+
+def load(path):
+    try:
+        return json.loads(Path(path).read_text())
+    except Exception:
+        return None
+
+
+def trivy_findings(doc):
+    """-> (total matches, {(severity, id, pkg, installed, fixed)})"""
+    if not doc:
+        return 0, set()
+    total, seen = 0, set()
+    for result in doc.get("Results") or []:
+        for v in result.get("Vulnerabilities") or []:
+            total += 1
+            seen.add((
+                v.get("Severity"), v.get("VulnerabilityID"), v.get("PkgName"),
+                v.get("InstalledVersion"), v.get("FixedVersion"),
+            ))
+    return total, seen
+
+
+def grype_findings(doc):
+    if not doc:
+        return 0, set()
+    matches = doc.get("matches") or []
+    seen = set()
+    for m in matches:
+        v = m.get("vulnerability") or {}
+        a = m.get("artifact") or {}
+        seen.add((str(v.get("severity")), str(v.get("id")),
+                  str(a.get("name")), str(a.get("version"))))
+    return len(matches), seen
+
+
+def main():
+    label, directory = sys.argv[1], Path(sys.argv[2])
+
+    runtimes = []
+    runtimes_file = directory / "runtimes.txt"
+    if runtimes_file.exists():
+        for line in runtimes_file.read_text().splitlines():
+            m = re.search(r"/([0-9][0-9.]*)$", line.strip())
+            if m:
+                runtimes.append(m.group(1))
+    runtimes = sorted(set(runtimes))
+
+    t_total, t_seen = trivy_findings(load(directory / "trivy.json"))
+    g_total, g_seen = grype_findings(load(directory / "grype.json"))
+
+    print(f"\nTrivy ({label})")
+    if not t_seen and t_total == 0:
+        print("  (no output)")
+    else:
+        print(f"  {t_total} matches across all flavours -> {len(t_seen)} DISTINCT")
+        for sev, cve, pkg, installed, fixed in sorted(t_seen, key=lambda r: tuple(str(x) for x in r)):
+            print(f"  {str(sev):9s} {str(cve):22s} {str(pkg):38s} {str(installed):14s} fixed: {fixed}")
+
+    print(f"\nGrype ({label})")
+    if not g_seen and g_total == 0:
+        print("  (no output)")
+    else:
+        print(f"  {g_total} matches -> {len(g_seen)} DISTINCT")
+        for sev, cve, pkg, ver in sorted(g_seen, key=lambda r: tuple(str(x) for x in r)):
+            print(f"  {sev:9s} {cve:22s} {pkg:38s} {ver}")
+
+    # The union is what gets compared run to run. Either scanner flagging something is
+    # enough to be worth a look - they use different databases and different matching
+    # rules, so treating one as authoritative would quietly drop real findings.
+    cves = sorted({c for _, c, *_ in t_seen} | {c for _, c, *_ in g_seen})
+
+    summary = {
+        "label": label,
+        "runtime": runtimes,
+        "cves": cves,
+        "trivy": {"matches": t_total, "distinct": len(t_seen)},
+        "grype": {"matches": g_total, "distinct": len(g_seen)},
+    }
+    (directory / "summary.json").write_text(json.dumps(summary, indent=2))
+
+
+if __name__ == "__main__":
+    main()