diff --git a/specs/0005-container-cve-risk-acceptance.md b/specs/0005-container-cve-risk-acceptance.md
new file mode 100644
index 0000000..785bd26
--- /dev/null
+++ b/specs/0005-container-cve-risk-acceptance.md
@@ -0,0 +1,89 @@
+---
+id: 0005
+title: Container CVE risk acceptance (mc-image-helper dependencies)
+project: minecraft
+status: accepted
+owner: tbgorrie
+created: 2026-08-14
+review: 2026-11-14
+---
+
+# 0005 - Container CVE risk acceptance: mc-image-helper dependencies
+
+## What is being accepted
+
+Six open Trivy findings, all inside `usr/share/mc-image-helper-1.66.0/lib/` in the
+`itzg/minecraft-server` base image. **None are dependencies this repository chooses,
+installs or can upgrade.**
+
+| CVE | Severity | Library |
+|---|---|---|
+| CVE-2022-36944 | **CRITICAL** | scala-library 2.13.1 |
+| CVE-2026-54513 | HIGH | jackson-databind 3.1.3 |
+| CVE-2026-54512 | HIGH | jackson-databind 3.1.3 |
+| CVE-2026-40984 | HIGH | micrometer-core 1.16.5 |
+| CVE-2026-40983 | HIGH | micrometer-core 1.16.5 |
+| GHSA-r7wm-3cxj-wff9 | error | jackson-core 3.1.3 |
+
+## Why upgrading is not available to us
+
+The base image is digest-pinned. It was bumped on 2026-08-12 from a 2026-08-01 build to a
+2026-08-08 build (PR #16), specifically to try to clear the micrometer pair. **It did not
+work**, and the PR said in advance that the Trivy scan would be the verdict and that the
+next step would be upstream rather than re-pinning blindly.
+
+Checked again 2026-08-14:
+
+- A newer `java21` build exists, but `MC_HELPER_VERSION` on itzg's master is **still
+  1.66.0**, the version we already run. The vulnerable jars are unchanged.
+- Therefore a further digest bump is churn, not a fix. It would change the image without
+  changing a single affected library.
+
+The fix has to come from upstream updating mc-image-helper's dependencies.
+
+## Exposure assessment
+
+`mc-image-helper` is a **command-line tool that runs at container start** to resolve and
+download mods, then exits. It is not a service, it does not listen on a port, and nothing
+routes to it.
+
+- **micrometer (CVE-2026-40983/40984)**: both require an attacker to reach a
+  Micrometer-instrumented **gRPC or HTTP endpoint**. mc-image-helper serves neither. The
+  `AV:N` vector these CVEs need does not exist here. **Not exploitable.**
+- **scala-library (CVE-2022-36944)**: requires deserializing attacker-controlled Java
+  serialized data. mc-image-helper does not accept serialized input from anywhere.
+  **Not exploitable in this configuration**, though it carries the highest score, which is
+  why it must be reviewed rather than dismissed.
+- **jackson-databind / jackson-core**: this is the one with a real, if narrow, path.
+  mc-image-helper **does** parse JSON fetched over the network (Modrinth API responses) at
+  container start. That is remote data hitting a vulnerable parser. It is mitigated by
+  HTTPS, by every mod being pinned to an immutable version URL, and by the parse happening
+  once at boot rather than continuously, but it is **not** a zero-exposure case and should
+  not be described as one.
+
+Container hardening bounds the blast radius regardless: read-only rootfs, `USER 1000:1000`,
+all capabilities dropped, `no-new-privileges`, pids capped, no Docker socket.
+
+## Decision
+
+**Accept, with an upstream report and a review date.**
+
+1. Do **not** bump the base image again purely for these. It changes nothing.
+2. Report upstream to `itzg/mc-image-helper` so the dependencies get updated at the source,
+   which fixes it for every user of the image, not just us.
+3. Re-evaluate when `MC_HELPER_VERSION` moves past 1.66.0. That is the trigger, not a date.
+4. Review by **2026-11-14** regardless.
+
+## What would change this decision
+
+- Any of these libraries moving into the **game server** process, where it would be
+  reachable from a player connection.
+- A published exploit against jackson that works through API-response parsing.
+- mc-image-helper gaining a network listener.
+
+## Explicitly NOT doing
+
+**Not adding a Trivy ignore file.** Suppressing these would hide the critical, and the whole
+point of the scan is that the next finding might be a real one in our own code. Six known,
+assessed, documented findings are better than zero findings and a suppression list nobody
+re-reads. The noise is the cost of keeping the signal.