diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index dabdabd7..032efb49 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -18,6 +18,8 @@ jobs:
           - linux/amd64
           - linux/arm/v7
           - linux/arm64
+    outputs:
+      version: ${{ steps.details.outputs.version }}
 
     steps:
       - name: Checkout
@@ -96,17 +98,22 @@ jobs:
             org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }}
             org.opencontainers.image.documentation=https://dexidp.io/docs/
 
+  container-scan:
+    name: Container scan
+    runs-on: ubuntu-latest
+    needs: container-images
+    if: github.event_name == 'push'
+
+    steps:
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.2.3
         with:
-          image-ref: "ghcr.io/dexidp/dex:${{ steps.details.outputs.version }}"
+          image-ref: "ghcr.io/dexidp/dex:${{ needs.container-images.outputs.version }}"
           format: "template"
           template: "@/contrib/sarif.tpl"
           output: "trivy-results.sarif"
-        if: github.event_name == 'push'
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v1
         with:
           sarif_file: "trivy-results.sarif"
-        if: github.event_name == 'push'