diff --git a/.trivy.yaml b/.trivy.yaml
index f4adefd..276588d 100644
--- a/.trivy.yaml
+++ b/.trivy.yaml
@@ -24,9 +24,10 @@ scan:
   disable-telemetry: true
   offline: true
   scanners:
-    - vuln
+    # - vuln # keep disabled so not checked on PRs but explicitly via scheduled .github/workflows/pre-commit-cache.yaml
     - secret
     - misconfig
+    - license # while enabled but run via the separate 'trivy-license' action
   skip-dirs: ["**/.terraform/**", "**/.terragrunt-cache/**", "**/node_modules/**", "**/.local-scratch/**"]
   show-suppressed: true