diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index aaf07bf..10d9b99 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -52,7 +52,7 @@ jobs:
           - version: 11.0.0
             tarball: https://github.com/owncloud/core/releases/download/v11.0.0/owncloud-complete-20260730.tar.bz2
             base: v24.04
-            trivy-ignore: v24.04/11.0.0/.trivyignore
+            trivy-ignore: v24.04/11.0.0/.trivyignore.yaml
             smoke-version-jq: ".versionstring"
 
   update-docker-hub-description:
diff --git a/v22.04/Dockerfile.multiarch b/v22.04/Dockerfile.multiarch
index 6332c3b..caa51e1 100644
--- a/v22.04/Dockerfile.multiarch
+++ b/v22.04/Dockerfile.multiarch
@@ -19,6 +19,15 @@ WORKDIR /var/www/owncloud
 RUN find /var/www/owncloud \( \! -user www-data -o \! -group root \) -print0 | xargs -r -0 chown www-data:root && \
   chmod g+w /var/www/owncloud /var/www/owncloud/.htaccess
 
+# Apps ship binaries in their own bin/ directory (e.g.
+# migrate_to_ocis/bin/rclone_linux_amd64). Tarballs built before
+# owncloud/server-release#52 normalized every file to 0644, so those binaries
+# arrive non-executable: the app cannot run them, and the image scan cannot see
+# them either - Trivy's gobinary analyzer only inspects files that have an exec
+# bit. -mindepth/-maxdepth 3 keeps this to apps/<app>/bin/<file>, leaving
+# vendored scripts alone.
+RUN find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -type f -path '*/bin/*' -exec chmod 755 {} \;
+
 VOLUME ["/mnt/data"]
 EXPOSE 8080
 
diff --git a/v24.04/11.0.0/.trivyignore b/v24.04/11.0.0/.trivyignore
deleted file mode 100644
index 7f414f6..0000000
--- a/v24.04/11.0.0/.trivyignore
+++ /dev/null
@@ -1,6 +0,0 @@
-# vulnerability is affecting windows only
-CVE-2024-51736
-
-# fix requires ownCloud to update bundled guzzlehttp/guzzle (7.15.1 -> 7.15.2) in
-# files_external_dropbox; core lib already ships the fixed 7.15.2
-CVE-2026-69246
diff --git a/v24.04/11.0.0/.trivyignore.yaml b/v24.04/11.0.0/.trivyignore.yaml
new file mode 100644
index 0000000..e310cbf
--- /dev/null
+++ b/v24.04/11.0.0/.trivyignore.yaml
@@ -0,0 +1,61 @@
+# Accepted vulnerabilities for the 11.0.0 image scan.
+#
+# YAML rather than the plain format because it carries expired_at: an entry with
+# a date stops suppressing once the date passes, so a temporary acceptance turns
+# the scan red again instead of being buried. The plain and YAML formats cannot
+# be mixed in one scan, hence the single file.
+vulnerabilities:
+  - id: CVE-2024-51736
+    statement: Affects Windows only; this image is Linux.
+
+  # No expiry, matching how this was accepted in the plain ignorefile: it stays
+  # until ownCloud updates a bundled dependency, which no date here can predict.
+  - id: CVE-2026-69246
+    statement: >-
+      Fix requires ownCloud to update bundled guzzlehttp/guzzle (7.15.1 ->
+      7.15.2) in files_external_dropbox; core lib already ships the fixed
+      7.15.2.
+
+  # apps/migrate_to_ocis ships a prebuilt upstream rclone binary. Until the
+  # exec-bit fix in this image (and in owncloud/server-release) these findings
+  # were invisible: Trivy's gobinary analyzer only inspects files that have an
+  # exec bit, and the tarball shipped the binary 0644.
+  #
+  # The eight entries below are the go1.26.5 stdlib findings against upstream
+  # rclone v1.75.0, the newest release (2026-07-31). They are fixed in
+  # go 1.25.13 / 1.26.6, which no rclone release has been built with yet, so no
+  # available binary is free of them. All are denial of service / XSS class,
+  # none CRITICAL. Mirrors owncloud/migrate_to_ocis .trivyignore.yaml - drop
+  # both once rclone publishes a release built with go >= 1.26.6.
+  - id: CVE-2026-33818 # encoding/asn1: DoS via excessive recursion in Unmarshal
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-39821 # golang.org/x/net/idna: privilege escalation via Punycode label processing
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-46600 # golang.org/x/net/dns/dnsmessage: DoS via invalid DNS record parsing
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-56853 # net/http: DoS on unencrypted HTTP/2 connections
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-56858 # html/template: XSS via pathological input
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-56859 # encoding/xml: DoS via decoding recursion depth
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-56860 # net/url: DoS from quadratic complexity in path handling
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
+  - id: CVE-2026-56862 # crypto/tls: DoS via indefinite KeyUpdate messages
+    paths: ["var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64"]
+    statement: rclone v1.75.0 is built with go1.26.5; fixed in go 1.25.13/1.26.6, no rclone release ships it yet.
+    expired_at: 2026-11-01
diff --git a/v24.04/Dockerfile.multiarch b/v24.04/Dockerfile.multiarch
index fbb1d00..eb17e7c 100644
--- a/v24.04/Dockerfile.multiarch
+++ b/v24.04/Dockerfile.multiarch
@@ -20,6 +20,15 @@ WORKDIR /var/www/owncloud
 RUN find /var/www/owncloud \( \! -user www-data -o \! -group root \) -print0 | xargs -r -0 chown www-data:root && \
   chmod g+w /var/www/owncloud /var/www/owncloud/.htaccess
 
+# Apps ship binaries in their own bin/ directory (e.g.
+# migrate_to_ocis/bin/rclone_linux_amd64). Tarballs built before
+# owncloud/server-release#52 normalized every file to 0644, so those binaries
+# arrive non-executable: the app cannot run them, and the image scan cannot see
+# them either - Trivy's gobinary analyzer only inspects files that have an exec
+# bit. -mindepth/-maxdepth 3 keeps this to apps/<app>/bin/<file>, leaving
+# vendored scripts alone.
+RUN find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -type f -path '*/bin/*' -exec chmod 755 {} \;
+
 VOLUME ["/mnt/data"]
 EXPOSE 8080