diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index c54f624..67af970 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -84,17 +84,22 @@ jobs:
           cache: pip
           cache-dependency-path: requirements.txt
 
-      - name: Install
+      # A fresh venv, not the runner's site-packages: the report must list the
+      # project's runtime deps, not whatever the runner image or a previous
+      # workflow happened to leave installed (semgrep once showed up here).
+      - name: Install into a clean venv
         run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
+          python -m venv .lic && . .lic/bin/activate
+          pip install --upgrade pip --root-user-action=ignore
           pip install --root-user-action=ignore -r requirements.txt pip-licenses
 
       - name: Report
         run: |
+          . .lic/bin/activate
           pip-licenses --format=markdown --with-urls --output-file=licenses.md
           pip-licenses --format=json --output-file=licenses.json
-          echo "Copyleft licenses among runtime deps (informational):"
-          pip-licenses --format=plain | grep -iE 'GPL|AGPL|LGPL' || echo "  none"
+          echo "Copyleft licenses among runtime deps (informational; LGPL is fine to link from MIT):"
+          pip-licenses --format=plain --ignore-packages pip-licenses | grep -iE 'GPL|AGPL|LGPL' || echo "  none"
 
       - uses: actions/upload-artifact@v3
         with: