diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
index c6d28da2..b203cfd9 100644
--- a/.release/security-scan.hcl
+++ b/.release/security-scan.hcl
@@ -11,4 +11,18 @@ binary {
   osv          = true
   oss_index    = false
   nvd          = false
+
+    triage {
+    suppress {
+      vulnerabilities = [
+        // golang.org/x/crypto/openpgp is deprecated/unmaintained with no fixed
+        // version. The provider does not use this package (confirmed via
+        // `go mod why golang.org/x/crypto/openpgp`); it imports the maintained
+        // fork github.com/ProtonMail/go-crypto/openpgp instead. x/crypto is
+        // only pulled in for the unaffected golang.org/x/crypto/cryptobyte
+        // package. Not reachable in the built binary.
+        "GO-2026-5932",
+      ]
+    }
+  }
 }