diff --git a/.grype.yaml b/.grype.yaml
new file mode 100644
index 0000000..001d21a
--- /dev/null
+++ b/.grype.yaml
@@ -0,0 +1,4 @@
+ignore:
+  # Python 3.12 CVEs — only fixed in 3.13+, cannot upgrade major version safely
+  - vulnerability: CVE-2025-13836
+  - vulnerability: CVE-2026-4519
\ No newline at end of file