From ffe2595f638510c64c72181ff49c39b32ebdb255 Mon Sep 17 00:00:00 2001
From: Jon Ayers <jon@coder.com>
Date: Thu, 7 May 2026 13:15:26 -0500
Subject: [PATCH] fix: scan coder-preview:main instead of coder:latest (#25056)

---
 .github/workflows/security.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index d53ec1b58e..72eee31d2d 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -68,7 +68,7 @@ jobs:
       security-events: write
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
     env:
-      IMAGE_REF: ghcr.io/coder/coder:latest
+      IMAGE_REF: ghcr.io/coder/coder-preview:main
       OSV_SCANNER_VERSION: v2.3.5
     steps:
       - name: Harden Runner
@@ -82,7 +82,7 @@ jobs:
             "https://github.com/google/osv-scanner/releases/download/${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
           chmod +x /usr/local/bin/osv-scanner
 
-      - name: Pull released Coder image
+      - name: Pull latest Coder preview image
         run: docker pull "$IMAGE_REF"
 
       - name: Run OSV-Scanner vulnerability scanner