diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 659bee9..c10ab79 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -26,7 +26,7 @@ jobs:
         run: npm ci
       
       - name: Run tests
-        run: npm test || echo "No tests found, would add tests in a real project"
+        run: npm test
 
   lint:
     name: Static Code Analysis
@@ -96,6 +96,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
       
       - name: Login to GitHub Container Registry
+        if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -132,6 +133,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
       
       - name: Push Docker image
+        if: github.event_name == 'push'
         uses: docker/build-push-action@v5
         with:
           context: .
diff --git a/Dockerfile b/Dockerfile
index 64bea95..e4cdca1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,8 @@ RUN npm run build
 
 # Production stage
 FROM nginx:alpine
+# Pull in security fixes newer than the base image (Trivy fails the build on HIGH/CRITICAL)
+RUN apk upgrade --no-cache
 COPY --from=build /app/dist /usr/share/nginx/html
 # Add nginx configuration if needed
 # COPY nginx.conf /etc/nginx/conf.d/default.conf