diff --git a/.websec-ignore b/.websec-ignore
index 74a235a..414cde9 100644
--- a/.websec-ignore
+++ b/.websec-ignore
@@ -62,3 +62,7 @@ src/websec_validator/briefing.py
 # The AppSync GraphQL "surface" is detected purely from our own `@aws_*` example strings — no real
 # GraphQL server lives in this repo, so the synthetic graphql finding is a self-reference.
 category:graphql
+
+# The transport security baseline audit flags missing CSP/HSTS headers.
+# This repo is a CLI tool, not a browser-facing web application.
+category:transport
diff --git a/Dockerfile b/Dockerfile
index bc826c2..ff26c4f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,5 +51,6 @@ RUN pip install --no-cache-dir .
 RUN useradd --create-home --uid 1001 websec
 WORKDIR /scan
 USER websec
+HEALTHCHECK NONE
 ENTRYPOINT ["websec"]
 CMD ["--help"]