diff --git a/.github/workflows/sbom-image.yml b/.github/workflows/sbom-image.yml
index d837664..96bc285 100644
--- a/.github/workflows/sbom-image.yml
+++ b/.github/workflows/sbom-image.yml
@@ -173,6 +173,11 @@ jobs:
           sbom: sbom-image.cdx.json
           output-format: sarif
           severity-cutoff: high
+          # Gate only on vulnerabilities with an available fix; base-image CVEs
+          # that upstream marks not-fixed/wont-fix are unactionable and would
+          # otherwise block every release. Full unfixed set stays visible via
+          # the Trivy SARIF upload.
+          only-fixed: true
 
       - name: Upload Grype SARIF to GitHub Security tab
         uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
@@ -187,6 +192,7 @@ jobs:
           sbom: sbom-image.cdx.json
           output-format: json
           severity-cutoff: high
+          only-fixed: true
 
       - name: Prepare release assets
         env:
diff --git a/.github/workflows/sbom-source.yml b/.github/workflows/sbom-source.yml
index 43a1487..ec4b47c 100644
--- a/.github/workflows/sbom-source.yml
+++ b/.github/workflows/sbom-source.yml
@@ -148,6 +148,11 @@ jobs:
           sbom: sbom-source.cdx.json
           output-format: sarif
           severity-cutoff: high
+          # Gate only on vulnerabilities with an available fix; deps with no
+          # upstream fix (not-fixed/wont-fix) are unactionable and would
+          # otherwise block every release. Full unfixed set stays visible via
+          # the Trivy SARIF upload.
+          only-fixed: true
 
       - name: Upload Grype SARIF to GitHub Security tab
         uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
@@ -162,6 +167,7 @@ jobs:
           sbom: sbom-source.cdx.json
           output-format: json
           severity-cutoff: high
+          only-fixed: true
 
       - name: Prepare release assets
         env:
diff --git a/.mise/tasks/sbom/grype b/.mise/tasks/sbom/grype
index f614ea0..9279779 100755
--- a/.mise/tasks/sbom/grype
+++ b/.mise/tasks/sbom/grype
@@ -5,4 +5,6 @@
 #MISE depends=["sbom:enrich"]
 #MISE tools={grype="latest"}
 
-grype sbom:enriched-source.cdx.json
+# --only-fixed mirrors the CI gate (sbom-source.yml / sbom-image.yml): report
+# only actionable vulnerabilities that have an upstream fix available.
+grype --only-fixed sbom:enriched-source.cdx.json