diff --git a/.github/workflows/reusable-scorecards.yml b/.github/workflows/reusable-scorecards.yml
index ce63a97..9fcdc31 100644
--- a/.github/workflows/reusable-scorecards.yml
+++ b/.github/workflows/reusable-scorecards.yml
@@ -55,6 +55,7 @@ jobs:
             api.securityscorecards.dev:443
             bestpractices.coreinfrastructure.org:443
             sigstore-tuf-root.storage.googleapis.com:443
+            ghcr.io:443
 
       - name: Check out code base
         if: github.event_name == 'push' || github.event_name == 'schedule'