diff --git a/.github/workflows/cve-scanning.yml b/.github/workflows/cve-scanning.yml
index 2fe6f8bb..82d9be08 100644
--- a/.github/workflows/cve-scanning.yml
+++ b/.github/workflows/cve-scanning.yml
@@ -7,18 +7,21 @@ on:
         description: 'Set by the CVE Scanning Schedule workflow when dispatching this on a schedule (enables Slack notifications).'
         type: boolean
         default: false
-  push:
-    branches:
-      - master
-    paths:
-      - 'pom.xml'
-      - 'CVE-suppressions.xml'
-      - '.github/workflows/cve-scanning.yml'
-  pull_request:
-    paths:
-      - 'pom.xml'
-      - 'CVE-suppressions.xml'
-      - '.github/workflows/cve-scanning.yml'
+  # Disabled: CVE failures should surface via the scheduled scan
+  # (cve-scanning-schedule.yml), not on every pom.xml bump. Uncomment to
+  # re-enable push/PR triggering.
+  # push:
+  #   branches:
+  #     - master
+  #   paths:
+  #     - 'pom.xml'
+  #     - 'CVE-suppressions.xml'
+  #     - '.github/workflows/cve-scanning.yml'
+  # pull_request:
+  #   paths:
+  #     - 'pom.xml'
+  #     - 'CVE-suppressions.xml'
+  #     - '.github/workflows/cve-scanning.yml'
 
 # Cancel previous jobs
 concurrency: