diff --git a/pkgs/by-name/tr/trivy/package.nix b/pkgs/by-name/tr/trivy/package.nix
index c93a71bf04fa..38423c3c63a6 100644
--- a/pkgs/by-name/tr/trivy/package.nix
+++ b/pkgs/by-name/tr/trivy/package.nix
@@ -10,7 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "trivy";
-  version = "0.69.3";
+  # As of March 2026, trivy has made compromised releases twice.
+  # At a minimum, before updating, check the diff of this package, and of all
+  # dependencies/GitHub Actions changes, carefully.
+  # Also read about how the previous compromises occurred, and ensure
+  # that the signs present then are not present now.
+  # Finally, weigh the risk of a compromised release against the expected
+  # benefit of the update, and consider the possibility of not updating.
+  version = "0.69.3"; # Did you read the comment?
 
   src = fetchFromGitHub {
     owner = "aquasecurity";