diff --git a/.gitea/workflows/code-analysis.yml b/.gitea/workflows/code-analysis.yml
index 5c26f75..d17201d 100755
--- a/.gitea/workflows/code-analysis.yml
+++ b/.gitea/workflows/code-analysis.yml
@@ -126,7 +126,8 @@ jobs:
           chmod +x osv-scanner
           ./osv-scanner --version
           test -f "$GITHUB_WORKSPACE/package-lock.json"
-          ./osv-scanner scan -L "$GITHUB_WORKSPACE/package-lock.json" --config "$GITHUB_WORKSPACE/.osv-scanner.toml"
+          ./osv-scanner scan -L "$GITHUB_WORKSPACE/package-lock.json" --config "$GITHUB_WORKSPACE/.osv-scanner.toml" --format json --output-file osv-report.json || true
+          node scripts/check-osv-severity.mjs osv-report.json
 
   deploy-production:
     runs-on: ubuntu-latest
diff --git a/.osv-scanner.toml b/.osv-scanner.toml
index 0a3836c..b2bfd1f 100644
--- a/.osv-scanner.toml
+++ b/.osv-scanner.toml
@@ -1 +1,2 @@
-# Intentionally empty: retained because the CI scanner is invoked with --config.
+# Retained because the CI scanner is invoked with --config. Findings are
+# evaluated transparently by scripts/check-osv-severity.mjs.
diff --git a/scripts/check-osv-severity.mjs b/scripts/check-osv-severity.mjs
new file mode 100644
index 0000000..be2bb74
--- /dev/null
+++ b/scripts/check-osv-severity.mjs
@@ -0,0 +1,26 @@
+import { readFile } from 'node:fs/promises'
+
+const reportPath = process.argv[2]
+if (!reportPath) throw new Error('Pfad zum OSV-JSON-Report fehlt.')
+
+const report = JSON.parse(await readFile(reportPath, 'utf8'))
+const findings = report.results.flatMap(result =>
+  result.packages.flatMap(entry =>
+    entry.groups.map(group => ({
+      packageName: entry.package.name,
+      packageVersion: entry.package.version,
+      ids: group.ids.join(', '),
+      severity: Number(group.max_severity) || 0
+    }))
+  )
+)
+
+for (const finding of findings) {
+  console.log(`OSV: ${finding.ids} in ${finding.packageName}@${finding.packageVersion} (CVSS ${finding.severity})`)
+}
+
+const critical = findings.filter(finding => finding.severity >= 9)
+if (critical.length > 0) {
+  console.error(`OSV-Scanner: ${critical.length} kritische(r) Befund(e) (CVSS >= 9.0).`)
+  process.exitCode = 1
+}