diff --git a/.trivyignore b/.trivyignore
index 95aa9b7d..4daa0a60 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -5,3 +5,7 @@
 # jackson-core async parser DoS - not exploitable, services only use synchronous ObjectMapper API
 # See: UID2-6670
 GHSA-72hv-8253-57qq exp:2026-09-01
+
+# CVE-2026-40984 — micrometer-core (HIGH). Not vulnerable.
+# See: UID2-8215
+CVE-2026-40984 exp:2027-04-28