diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 321de24..131aac0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -18,6 +18,21 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Scan for secrets
+        run: |
+          # docker cp, not a build COPY: a repo's own .dockerignore (e.g. one that
+          # excludes .git for prod builds) would otherwise silently give an empty,
+          # falsely-clean scan.
+          CID=$(docker create zricethezav/gitleaks:v8.30.1 detect --source=/repo --no-banner -v)
+          docker cp . "$CID:/repo"
+          docker start -a "$CID"
+          STATUS=$?
+          docker rm "$CID" > /dev/null
+          exit $STATUS
+
+      - name: Lint Dockerfile with hadolint
+        run: docker run --rm -i hadolint/hadolint:v2.15.1-alpine hadolint --failure-threshold error - < Dockerfile
+
       - name: Build Docker image
         run: docker build -t socat-proxy:ci .
 
@@ -33,12 +48,53 @@ jobs:
         run: docker build --target lint -t socat-proxy:lint .
 
       - name: Scan with Trivy (critical - blocking)
+        id: trivy_critical
+        continue-on-error: true
         run: |
           docker run --rm \
             -e DOCKER_HOST=tcp://dockerhost:2375 \
             --add-host=dockerhost:host-gateway \
             aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:ci
 
+      - name: Handle CRITICAL findings
+        if: steps.trivy_critical.outcome == 'failure'
+        run: |
+          if [ "${{ github.event_name }}" != "schedule" ]; then
+            echo "::error::CRITICAL vulnerabilities found, failing the build."
+            exit 1
+          fi
+
+          echo "Scheduled scan found CRITICAL vulnerabilities — attempting an automatic apk upgrade + rescan."
+
+          sed -i '/^FROM .* AS base$/a RUN apk upgrade --no-cache' Dockerfile
+          docker build -t socat-proxy:remediated .
+
+          if docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:remediated; then
+            echo "apk upgrade clears the CRITICAL finding(s) — opening a PR for review."
+
+            BRANCH="auto/cve-fix-$(date +%Y%m%d)-$(echo "${{ github.sha }}" | cut -c1-7)"
+            git config user.name "socat-proxy-ci"
+            git config user.email "ci@git.djeex.fr"
+            git checkout -b "$BRANCH"
+            git add Dockerfile
+            git commit -m "Auto-remediate CRITICAL CVE via apk upgrade"
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/socat-proxy.git" "HEAD:$BRANCH"
+
+            PR_JSON=$(curl -s -X POST \
+              -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n --arg head "$BRANCH" '{title: "🔒 Auto: remediate CRITICAL CVE via apk upgrade", head: $head, base: "main", body: "Opened automatically by the scheduled CVE scan. An `apk upgrade --no-cache` cleared the CRITICAL Trivy finding(s) in a rebuild — review the diff and merge to publish the fix."}')" \
+              "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/pulls")
+            echo "PR API response: $(echo "$PR_JSON" | jq -r '.html_url // .message // "unknown"')"
+          else
+            echo "::error::apk upgrade does not clear the CRITICAL finding(s) — no automatic fix available, needs manual review."
+            exit 1
+          fi
+
       - name: Scan with Trivy (high - informative)
         run: |
           docker run --rm \