diff --git a/.trivyignore b/.trivyignore
index 166f6389ad..c0207c8374 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -24,6 +24,17 @@ CVE-2026-8376 pkg:perl-base exp:2026-08-15
 CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-08-15
 CVE-2026-8376 pkg:libperl5.36 exp:2026-08-15
 
+# CVE-2026-13221 - Perl regex trie overflow.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: upstream confirms Perl 5.36.0 is not affected; the regression
+# was introduced after this version. Debian currently marks bookworm as
+# vulnerable, which causes Trivy to report a false positive.
+# Ref: https://github.com/Perl/perl5/issues/23388
+CVE-2026-13221 pkg:perl exp:2026-08-15
+CVE-2026-13221 pkg:perl-base exp:2026-08-15
+CVE-2026-13221 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-13221 pkg:libperl5.36 exp:2026-08-15
+
 # CVE-2025-7458 — SQLite integer overflow.
 # Package: libsqlite3-0.
 # Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
diff --git a/api/Dockerfile b/api/Dockerfile
index 0b5b0d7a27..8d6923bbfc 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -113,6 +113,7 @@ RUN apt-get purge -y --auto-remove \
     make \
     libxml2-dev \
     libxmlsec1-dev \
+    libxmlsec1-openssl \
     pkg-config \
     libtool \
     libxslt1-dev \
diff --git a/api/changelog.d/trivy-critical-cves.security.md b/api/changelog.d/trivy-critical-cves.security.md
new file mode 100644
index 0000000000..f078e69a04
--- /dev/null
+++ b/api/changelog.d/trivy-critical-cves.security.md
@@ -0,0 +1 @@
+`api` container image removes the unused Debian `libxml2` runtime package and scopes the `CVE-2026-13221` Trivy exception to unaffected Perl 5.36 packages