diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index fca34aa..1bb7731 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -7,13 +7,19 @@ on:
   push:
     branches:
       - main
+  schedule:
+    - cron: '23 3 * * *'  # daily at 03:23 UTC
 
 permissions:
   contents: read
 
 jobs:
   check:
-    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5a0ca6e79ffd9f8db2b517beb176039628d22095 # github-actions under test (seantronsen/feat/release-attestation)
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@1ad5a2b3f96de5f175ac7c3ab4182aad203e0941 # github-actions under test (seantronsen/feat/sarif-govulncheck)
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # SARIF upload to GHAS
+      issues: write           # vulnerabilities issue on the default branch
 
   govulncheck:
     if: ${{ always() }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 930537f..35bceb4 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,6 +10,8 @@ on:
   push:
     branches:
       - main
+  schedule:
+    - cron: '23 3 * * *'  # daily at 03:23 UTC
 
 permissions:
   contents: read
@@ -38,7 +40,7 @@ jobs:
       go-version-file: go.mod
 
   lint-docs:
-    uses: OpenCHAMI/github-actions/.github/workflows/lint-docs.yml@04614d708f9f16283e4234412348b7814689c6e9 # github-actions under test (seantronsen/feat/lint-docs)
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-docs.yml@1ad5a2b3f96de5f175ac7c3ab4182aad203e0941 # github-actions under test (seantronsen/feat/sarif-govulncheck)
     permissions:
       contents: read          # baseline for checkout
       pull-requests: read     # list the PR's changed files
diff --git a/README.md b/README.md
index b5710f1..9a3ac79 100644
--- a/README.md
+++ b/README.md
@@ -68,5 +68,8 @@ the result; `make generate-check` is what CI runs.
 - **Release mode**: push a `v*` tag (e.g. `v0.0.1`). Tag freely.
 - **Docs links**: a PR that changes docs runs `lint-docs`; broken links show
   up as code scanning comments on the PR. On `main`, they go to an issue.
+- **Go vulnerabilities**: `govulncheck` fails when a vulnerable symbol is
+  called; the call site shows up as a code scanning comment on the PR. On
+  `main`, they go to an issue.
 - **Another github-actions ref**: update the pinned SHA in
   `.github/workflows/*.yml`.