diff --git a/.release/ci.hcl b/.release/ci.hcl
index e422a9ce29..ceb11f7595 100644
--- a/.release/ci.hcl
+++ b/.release/ci.hcl
@@ -178,6 +178,15 @@ event "promote-dev-docker" {
   }
 }
 
+event "fossa-scan" {
+  depends = ["promote-dev-docker"]
+  action "fossa-scan" {
+    organization = "hashicorp"
+    repository = "crt-workflows-common"
+    workflow = "fossa-scan"
+  }
+}
+
 ## These are promotion and post-publish events
 ## they should be added to the end of the file after the verify event stanza.