diff --git a/actions/vulnerability_scan/action.yaml b/actions/vulnerability_scan/action.yaml
index 5273695c..50c5e7ae 100644
--- a/actions/vulnerability_scan/action.yaml
+++ b/actions/vulnerability_scan/action.yaml
@@ -95,6 +95,8 @@ runs:
     env:
       TRIVY_SKIP_DB_UPDATE: true
       TRIVY_SKIP_JAVA_DB_UPDATE: true
+      # Rego policy to ignore findings by package; optional, like .trivyignore.
+      TRIVY_IGNORE_POLICY: ${{ hashFiles('.trivyignore.rego') != '' && '.trivyignore.rego' || '' }}
 
   - name: Create SARIF report
     if: inputs.publish_vulnerabilities == 'true'