diff --git a/pkg/infrastructure/scanner/trivy.go b/pkg/infrastructure/scanner/trivy.go
index 689d9f4..9d5b216 100644
--- a/pkg/infrastructure/scanner/trivy.go
+++ b/pkg/infrastructure/scanner/trivy.go
@@ -49,13 +49,13 @@ type trivyOS struct {
 }
 
 type trivyResult struct {
-	Target          string             `json:"Target"`
-	Class           string             `json:"Class"`
-	Type            string             `json:"Type"`
-	Vulnerabilities []trivyVuln        `json:"Vulnerabilities"`
-	Secrets         []trivySecret      `json:"Secrets"`
-	Misconfigs      []trivyMisconfig   `json:"Misconfigurations"`
-	Licenses        []trivyLicense     `json:"Licenses"`
+	Target          string           `json:"Target"`
+	Class           string           `json:"Class"`
+	Type            string           `json:"Type"`
+	Vulnerabilities []trivyVuln      `json:"Vulnerabilities"`
+	Secrets         []trivySecret    `json:"Secrets"`
+	Misconfigs      []trivyMisconfig `json:"Misconfigurations"`
+	Licenses        []trivyLicense   `json:"Licenses"`
 }
 
 type trivyCVSS struct {
@@ -96,14 +96,16 @@ type trivyLicense struct {
 func RunTrivy(imageName string, comprehensive bool) (*domain.TrivyResult, error) {
 	log.Infof("Running Trivy on: %s (comprehensive=%v)", imageName, comprehensive)
 
-	securityChecks := "vuln"
+	// Prefer --scanners (Trivy renamed --security-checks). Use "misconfig"
+	// rather than the deprecated "config" scanner name.
+	scanners := "vuln"
 	if comprehensive {
-		securityChecks = "vuln,secret,config"
+		scanners = "vuln,secret,misconfig"
 	}
 
 	cmd := exec.Command("trivy", "image",
 		"--format", "json",
-		"--security-checks", securityChecks,
+		"--scanners", scanners,
 		imageName,
 	)