diff --git a/.drone.yml b/.drone.yml
index f9b3d93..b22af17 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -51,6 +51,7 @@ steps:
         sh -s -- -b /usr/local/bin"
       - "grype $REGISTRY/baseimage-autossl:$DRONE_COMMIT_SHA \
          --scope all-layers \
+         --fail-on=critical \
          --verbose"
     when:
       event: pull_request