diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index e8614a70a..b46d614fa 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -41,6 +41,13 @@ vulnerabilities:
       - pkg:golang/stdlib@v1.26.5
     expired_at: 2026-11-20
     statement: The official rclone binary has no patched release for this embedded Go runtime yet.
+  - id: CVE-2026-56854
+    paths:
+      - usr/bin/rclone
+    purls:
+      - pkg:golang/golang.org/x/crypto@v0.54.0
+    expired_at: 2026-11-20
+    statement: The pinned stable rclone image has no release with the upstream x/crypto v0.55.0 fix yet; its SFTP callbacks do not set source-address permissions, so the affected path is not reachable. Reassess when this exception expires.
   - id: CVE-2026-56858
     paths:
       - usr/bin/rclone
diff --git a/docs/development-setup.md b/docs/development-setup.md
index 8c15abd59..de635ce8d 100644
--- a/docs/development-setup.md
+++ b/docs/development-setup.md
@@ -182,6 +182,9 @@ uvx --from pip-audit pip-audit \
 
 导出文件由 `uv.lock` 生成且保留哈希，不作为项目依赖清单提交。
 
+Docker 镜像发布前还会使用 Trivy 扫描 OS 与语言包；根目录 `.trivyignore.yaml` 只允许记录按路径或 PURL
+限定、写明原因并设置到期时间的临时例外，修复或重新评估后应移除。
+
 ### 6. 提交代码前的检查
 
 在提交代码之前，请确保完成以下步骤：