diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b60103b..b193207 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -150,7 +150,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          pip install bandit pip-audit
           pip install -r backend/requirements.txt
 
       - name: Run Bandit security scan
@@ -158,7 +158,7 @@ jobs:
         continue-on-error: true
 
       - name: Check dependencies for known vulnerabilities
-        run: safety scan --json
+        run: pip-audit -r backend/requirements.txt
         continue-on-error: true
 
   # ── Phase 4: Build ─────────────────────────────────────────────────────
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 086b353..7fb1722 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## [Unreleased]
+
+### Fixed
+
+- CI: replaced `safety scan --json` (requires interactive login in Safety CLI v3) with `pip-audit` to fix EOF error in the security scan job
+
 ## v0.4.4 (2026-03-28)
 
 ### Bug Fixes
diff --git a/docs/TODO.md b/docs/TODO.md
index ec030e6..d705201 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -5,6 +5,7 @@ Comprehensive task breakdown for repository improvements and production readines
 ## ✅ Recently Completed
 
 - [x] **IMAP: fix all emails appearing empty** — `aioimaplib` stores RFC822 literal data as `bytearray`, not `bytes`. The extraction loop was checking `isinstance(line, bytes)` which returns `False` for `bytearray`, so every email body was silently skipped. Fixed to accept both types and convert to `bytes`. Affected T-Online, GMX, and all IMAP accounts.
+- [x] **CI: fix safety scan EOF error** — replaced `safety scan --json` (Safety CLI v3 requires interactive login) with `pip-audit` (no auth required, maintained by PyPA).
 - [x] **Security: upgrade fastapi/starlette and fix safety CI command** — Upgraded `fastapi` to `0.135.2` (pulls in `starlette>=1.0.0`) fixing 4 DoS CVEs in `starlette<=0.35.1`; replaced deprecated `safety check` with `safety scan`; added `.safety-policy.yml` to suppress unfixable `ecdsa` side-channel CVEs (maintainers won't fix).
 - [x] **IMAP RFC 3501 flag syntax & aioimaplib UID SEARCH fix**: `_fetch_imap_emails`
   now uses a plain `SEARCH UNSEEN` + `FETCH (UID)` to resolve sequence numbers to