diff --git a/.github/workflows/policy.yaml b/.github/workflows/policy.yaml
index 3b1383d4..33c90a41 100644
--- a/.github/workflows/policy.yaml
+++ b/.github/workflows/policy.yaml
@@ -16,4 +16,13 @@ jobs:
     uses: canonical/starflow/.github/workflows/policy.yaml@main
   python-scans:
     name: Security scan
+    permissions:
+      contents: read
     uses: canonical/starflow/.github/workflows/scan-python.yaml@main
+    with:
+      osv-extra-args: "--config=osv-scanner.toml"
+      osv-exclude-paths: |
+        docs
+      uv-export-no-groups: |
+        docs
+        docs-sphinx-stack