diff --git a/ci/trivy/trivyignore.yaml b/ci/trivy/trivyignore.yaml
index 4d61c72..15dd3a7 100644
--- a/ci/trivy/trivyignore.yaml
+++ b/ci/trivy/trivyignore.yaml
@@ -108,3 +108,8 @@ misconfigurations:
   - id: AVD-KSV-0119
     paths: ["**/homeassistant.yaml"]
     statement: "NET_RAW is the capability in question and is added on purpose for device discovery; see AVD-KSV-0022."
+
+  # --- rss-bridge: port 80 is fixed by the image ----------------------------
+  - id: AVD-KSV-0117
+    paths: ["**/rss-bridge.yaml"]
+    statement: "nginx inside the image listens on 80, and the only way the entrypoint offers to change it (HTTP_PORT) is a sed against /etc/nginx/sites-enabled/default, which a read-only root filesystem rejects - so the alternative to port 80 would be giving up readOnlyRootFilesystem. The premise of the check does not apply here either: the container binds 80 as uid 33 with ALL capabilities dropped and no NET_BIND_SERVICE, verified in k3d. Renaming is also not free - the Service selects the port by name (rss-bridge-port), which is what keeps the takeover of the existing installation a no-op."
diff --git a/rss-bridge/templates/rss-bridge.deployment.yaml b/rss-bridge/templates/rss-bridge.deployment.yaml
index 6fabb53..7a6fdd9 100644
--- a/rss-bridge/templates/rss-bridge.deployment.yaml
+++ b/rss-bridge/templates/rss-bridge.deployment.yaml
@@ -27,7 +27,11 @@ spec:
         {{- include "rss-bridge.podSecurityContext" .Values.rssBridge.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
-          image: "rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
+          # Registry written out in full on purpose: an unqualified Docker Hub
+          # reference puts "rssbridge" in the registry position, which says
+          # nothing about where the image comes from and is reported as an
+          # untrusted registry (AVD-KSV-0125). See ci/trivy/data/ksv0125.yaml.
+          image: "docker.io/rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           env:
             {{- range $value := .Values.rssBridge.env }}