diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0fde72b..a863c8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,59 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.0.0] - 2026-08-06
+
+Major release: Trivy-backed scanning returns, now built and published through
+Socket's own supply chain.
+
+### Added
+- Container image and Dockerfile scanning (Trivy) restored in the pre-built
+  GitHub Action and Docker images. Trivy now comes from a **Socket-built
+  distribution** — rebuilt from unmodified upstream source (v0.73.0) by
+  Socket's own release pipeline and pinned by digest in the Dockerfiles
+  (`TRIVY_IMAGE` build arg; overridable for builds without registry access).
+- `latest` and `latest-heavy` floating Docker tag aliases. Exact version tags
+  remain immutable registry-side; pin an exact version or digest for
+  reproducible pipelines.
+- End-to-end integration test for the Trivy connector (fixture Dockerfile scan
+  through `--dockerfiles`), plus smoke-test assertions that the bundled trivy
+  matches the pinned version and can execute the connector's scan path.
+
+### Changed
+- **Behavioral (the reason this is a major):** Trivy-backed scanning was
+  intentionally disabled in the 2.x pre-built images following the March 2026
+  upstream Trivy supply-chain incident, and documented as such throughout the
+  project. With this release it is deliberately re-enabled: configurations
+  that set Trivy parameters (`--images`, `--dockerfiles`,
+  `trivy_vuln_enabled`, …) will begin producing container/Dockerfile findings
+  again, so pipelines that gate on findings should expect new results on the
+  first run after upgrading.
+- OSS toolchain refresh: TruffleHog 3.96.0, OpenGrep v1.26.0 (SAST rule
+  updates may shift findings), uv 0.12.1, gosec v2.28.0, Go 1.26.5
+  (app-tests), Socket CLI 2.6.0 (heavy image), and the socketdev Python SDK to
+  3.5.0 (typed fail-closed batch purl parameters; adopted by core-tool-watch in
+  a follow-up). Runtime bases (`python:3.12`,
+  `node:22`) are unchanged.
+- Docker Hub publish credentials are now scoped to the `publish` GitHub
+  environment (deployment restricted to `main` and `v*` tags) instead of
+  repo-level secrets.
+- Manual re-publish (`workflow_dispatch`) is recovery-only: re-pushing an
+  already-published version tag is rejected by the registry's immutable-tag
+  rule.
+- Dependabot no longer tracks the trivy base image; Trivy updates flow through
+  Socket's release process, never independent bumps.
+- CI: GitHub Actions dependency updates (#95, #96).
+
+### Fixed
+- The app-tests image had been unbuildable since the repository layout
+  migration (stale source references, wrong build context, dereferenced npm
+  symlinks, corrupt `uv.lock`) — repaired and building in CI again.
+- Documentation: removed the now-outdated "temporarily ships without Trivy"
+  notices repo-wide (they described the intentional 2.x posture); APT install
+  instructions now use upstream's `generic` distribution (required since
+  Trivy v0.72.0); warnings against Trivy 0.69.4–0.69.6 retained for native
+  installs.
+
 ## [2.2.1] - 2026-07-30
 
 ### Fixed
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index a60f0ed..3e4a7c2 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -3,7 +3,7 @@ ARG PYTHON_VERSION=3.12
 ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_CLI_VERSION=2.5.8
+ARG SOCKET_CLI_VERSION=2.6.0
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 
diff --git a/action.yml b/action.yml
index 7e93f7b..06a1721 100644
--- a/action.yml
+++ b/action.yml
@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:2.2.1"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.0.0"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}
diff --git a/pyproject.toml b/pyproject.toml
index e2d2364..a6c7359 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "socket_basics"
-version = "2.2.1"
+version = "3.0.0"
 description = "Socket Basics with integrated SAST, secret scanning, and container analysis"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -28,7 +28,7 @@ dependencies = [
     "light-s3-client~=0.0.30",
     "PyYAML>=6.0.0",
     "tomli; python_version < '3.11'",
-    "socketdev>=3.3.0",
+    "socketdev>=3.5.0",
     "jsonschema>=4.25.1"
 ]
 
diff --git a/socket_basics/__init__.py b/socket_basics/__init__.py
index 4fff3ee..b9800c0 100644
--- a/socket_basics/__init__.py
+++ b/socket_basics/__init__.py
@@ -12,7 +12,7 @@
 from .socket_basics import SecurityScanner, main
 from .core.config import load_config_from_env, Config
 
-__version__ = "2.2.1"
+__version__ = "3.0.0"
 __author__ = "Socket.dev"
 __email__ = "support@socket.dev"
 
diff --git a/socket_basics/version.py b/socket_basics/version.py
index b19ee4b..528787c 100644
--- a/socket_basics/version.py
+++ b/socket_basics/version.py
@@ -1 +1 @@
-__version__ = "2.2.1"
+__version__ = "3.0.0"
diff --git a/uv.lock b/uv.lock
index 6cade4d..b7458f0 100644
--- a/uv.lock
+++ b/uv.lock
@@ -672,7 +672,7 @@ wheels = [
 
 [[package]]
 name = "socket-basics"
-version = "2.2.1"
+version = "3.0.0"
 source = { editable = "." }
 dependencies = [
     { name = "jsonschema" },
@@ -702,7 +702,7 @@ requires-dist = [
     { name = "pytest-cov", marker = "extra == 'dev'", specifier = ">=7.1.0" },
     { name = "pyyaml", specifier = ">=6.0.0" },
     { name = "requests", specifier = ">=2.33.0" },
-    { name = "socketdev", specifier = ">=3.3.0" },
+    { name = "socketdev", specifier = ">=3.5.0" },
     { name = "tabulate", specifier = "~=0.10.0" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
@@ -713,15 +713,15 @@ dev = []
 
 [[package]]
 name = "socketdev"
-version = "3.3.0"
+version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/25/30/16155f7f27d18274f364b3bd3506ee45d17f53fc8938aaea9a618054449b/socketdev-3.3.0.tar.gz", hash = "sha256:3d60bd4ac3201e9d581b1fe02bf2e6aef1b90c13ae75d15a8664aa9ef966734e", size = 181519, upload-time = "2026-06-10T11:41:17.942Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/64/24/0c11290dc7d59e24b7075035c7e1a3ab87fa17a445cebc88cfa6ee98b22c/socketdev-3.5.0.tar.gz", hash = "sha256:a2b20f9b98f73c25f3d2e97a1ae730504509c91219c0b393f28a9230266b3531", size = 195138, upload-time = "2026-08-06T03:47:14.185Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/33/dd/25622e033182e8c744d2420bb4f056206edc096a1e5ce8e4af4b0a0c0791/socketdev-3.3.0-py3-none-any.whl", hash = "sha256:513c045ce42bdd6cc2bb66a527f5863e0c399e56dbdcb1832cd5d94a5fb1a5e4", size = 67956, upload-time = "2026-06-10T11:41:16.534Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/75/5a8506a473716740e94f2f01b697909333f966c143d8a0a566d278e6118d/socketdev-3.5.0-py3-none-any.whl", hash = "sha256:780f5841770397035ff87de6181d954b6318cd0a07f6fdd304d1376667f33f68", size = 72027, upload-time = "2026-08-06T03:47:12.773Z" },
 ]
 
 [[package]]