diff --git a/.github/dependency-review-config.yml b/.github/dependency-review-config.yml
new file mode 100644
index 0000000000..6c8f51e130
--- /dev/null
+++ b/.github/dependency-review-config.yml
@@ -0,0 +1,4 @@
+show-openssf-scorecard: false
+fail-on-severity: 'high'
+allow-ghsas:
+  - GHSA-qwww-vcr4-c8h2 # we don't use vulnerable functionality
\ No newline at end of file
diff --git a/.github/workflows/ci-dependency-review.yaml b/.github/workflows/ci-dependency-review.yaml
index 8a05160424..6583ab0c67 100644
--- a/.github/workflows/ci-dependency-review.yaml
+++ b/.github/workflows/ci-dependency-review.yaml
@@ -16,6 +16,5 @@ jobs:
       - name: Dependency Review
         uses: actions/dependency-review-action@v5.0.0
         with:
-          show-openssf-scorecard: false
-          allow-ghsas:
-            - GHSA-qwww-vcr4-c8h2 # we don't use vulnerable functionality
+          config-file: './.github/dependency-review-config.yml'
+