diff --git a/.github/workflows/grype-scheduled.yml b/.github/workflows/grype-scheduled.yml
index 672e3749..f25c5bb4 100644
--- a/.github/workflows/grype-scheduled.yml
+++ b/.github/workflows/grype-scheduled.yml
@@ -97,7 +97,12 @@ jobs:
         if: ${{ !cancelled() && hashFiles('grype-results.sarif') != '' }}
         with:
           sarif_file: 'grype-results.sarif'
-          category: 'grype-scheduled'
+          # Share the PR gate's category: a distinct category published only on
+          # main makes GitHub Advanced Security expect that configuration on
+          # every PR and report "1 configuration not found", because this weekly
+          # workflow never runs on PRs. (The legacy 'grype-scheduled' analyses
+          # on main were deleted via the code-scanning API; see docs/TESTING.md.)
+          category: 'grype-sandbox-image'
 
 
   alarm:
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 7cceeeda..cce1e710 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -615,9 +615,20 @@ run it in CI or with the commands above.
 A **non-blocking** weekly scan (Mondays 09:00 UTC; also `workflow_dispatch`)
 rebuilds the image against the latest unpinned `fedora-minimal:latest` base and
 reports **all** findings — including unfixed ones, with no `--fail-on` /
-`--only-fixed` — to the Security tab (category `grype-scheduled`), so a
-newly-disclosed CVE against the existing image surfaces as an informational alert
-rather than blocking `main`. It is never a PR gate.
+`--only-fixed` — so a newly-disclosed CVE against the existing image surfaces as
+an informational alert rather than blocking `main`. It is never a PR gate.
+Findings upload under the same `grype-sandbox-image` category as the per-PR gate:
+a category GitHub has seen on `main` is expected on every PR, and a category
+published only by this cron lane made Advanced Security report a missing
+configuration on each one. GitHub keeps one result set per `(tool, category,
+commit)`, so the weekly upload for the tip of `main` replaces the push-run's
+results for that commit, and a rebuilt image or refreshed advisory data can
+therefore change alert state on `main` without a source change; weekly results
+are no longer retained as a separate configuration. (One-time cleanup: renaming
+the category does not retire the configuration GitHub already recorded, so the
+existing `grype-scheduled` analyses on `main` must be deleted once through the
+code-scanning API — newest first, the last with `confirm_delete=true` — before
+the missing-configuration check disappears from PRs.)
 
 ---