diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
index 2eec122a4915..fde6978cf31a 100644
--- a/.release/security-scan.hcl
+++ b/.release/security-scan.hcl
@@ -68,4 +68,15 @@ binary {
 			]
 		}
 	}
+
+	# Triage items that are _safe_ to ignore here. Note that this list should be
+	# periodically cleaned up to remove items that are no longer found by the scanner.
+	triage {
+		suppress {
+			# N.b. `vulnerabilites` is the correct spelling for this tool.
+			vulnerabilites = [
+				"GO-2024-2631", # go-jose/v3@v3.0.3 (false positive)
+			]
+		}
+	}
 }
diff --git a/scan.hcl b/scan.hcl
index a5f8ae15c67e..87abe7b96434 100644
--- a/scan.hcl
+++ b/scan.hcl
@@ -22,4 +22,15 @@ repository {
   secrets {
     all = true
   }
+
+  # Triage items that are _safe_ to ignore here. Note that this list should be
+  # periodically cleaned up to remove items that are no longer found by the scanner.
+  triage {
+    suppress {
+      # N.b. `vulnerabilites` is the correct spelling for this tool.
+      vulnerabilites = [
+        "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive)
+      ]
+    }
+  }
 }