diff --git a/.github/workflows/shared-publish-java-to-docker-versioned.yaml b/.github/workflows/shared-publish-java-to-docker-versioned.yaml
index 09936c76..7cfb4c10 100644
--- a/.github/workflows/shared-publish-java-to-docker-versioned.yaml
+++ b/.github/workflows/shared-publish-java-to-docker-versioned.yaml
@@ -61,8 +61,32 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 jobs:
+  # The image scan can't see dependencies without Maven metadata inside the fat jar (e.g. BouncyCastle).
+  # Separate job so its output files don't land in the workspace buildImage commits from.
+  fsScan:
+    name: Vulnerability Scan (fs)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.version_number_input != '' && format('v{0}', inputs.version_number_input) || '' }}
+          persist-credentials: false
+
+      - name: Vulnerability Scan (fs)
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
+        with:
+          scan_severity: HIGH,CRITICAL
+          failure_severity: ${{ inputs.vulnerability_severity }}
+          # build-and-test already publishes fs results from main
+          publish_vulnerabilities: 'false'
+          scan_type: fs
+
   buildImage:
     name: Build Image
+    needs: fsScan
     runs-on: ubuntu-latest
     environment: ${{ inputs.merge_environment }}
     permissions:
diff --git a/.github/workflows/shared-vulnerability-scan-failure-notify.yaml b/.github/workflows/shared-vulnerability-scan-failure-notify.yaml
index 27b33073..549ada2c 100644
--- a/.github/workflows/shared-vulnerability-scan-failure-notify.yaml
+++ b/.github/workflows/shared-vulnerability-scan-failure-notify.yaml
@@ -49,12 +49,18 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Checkout uid2-shared-actions repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      # The image scan can't see dependencies without Maven metadata inside the fat jar (e.g. BouncyCastle).
+      # Runs before the build so target/ doesn't exist yet.
+      - name: Vulnerability Scan (fs)
+        id: vulnerability-scan-fs
+        if: inputs.scan_type == 'image' && inputs.dockerfile == ''
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
         with:
-          ref: v3
-          repository: IABTechLab/uid2-shared-actions
-          path: uid2-shared-actions
+          scan_severity: ${{ inputs.vulnerability_severity }}
+          failure_severity: ${{ inputs.vulnerability_severity }}
+          publish_vulnerabilities: ${{ inputs.publish_vulnerabilities }}
+          scan_type: fs
+        continue-on-error: true
 
       - name: Set up JDK
         if: inputs.scan_type == 'image' && inputs.dockerfile == ''
@@ -134,7 +140,7 @@ jobs:
         continue-on-error: true
 
       - name: Notify Slack on Vulnerability Scan Failure
-        if: ${{ steps.vulnerability-scan.outcome == 'failure' }}
+        if: ${{ steps.vulnerability-scan.outcome == 'failure' || steps.vulnerability-scan-fs.outcome == 'failure' }}
         env:
           SLACK_COLOR: danger
           SLACK_MESSAGE: ':x: Vulnerability scan failed. Please review details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}. Check past alerts before acting and log new actions to avoid duplicate efforts.'
@@ -143,7 +149,7 @@ jobs:
         uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
 
       - name: Fail Workflow if Vulnerability Scan step Fails
-        if: ${{ steps.vulnerability-scan.outcome == 'failure' }}
+        if: ${{ steps.vulnerability-scan.outcome == 'failure' || steps.vulnerability-scan-fs.outcome == 'failure' }}
         shell: bash
         run: |
           echo "Failing the workflow due to vulnerability scan failure"