diff --git a/charts/argocd-apps/Chart.yaml b/charts/argocd-apps/Chart.yaml
index a8df58a..e311359 100644
--- a/charts/argocd-apps/Chart.yaml
+++ b/charts/argocd-apps/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: argocd-apps
 description: Chart to deploy WBaaS apps in an "app-of-apps" pattern via ArgoCD
 type: application
-version: 2.1.0
+version: 2.2.0
 appVersion: "1.0"
 maintainers:
   - name: WBstack
diff --git a/charts/argocd-apps/templates/trivy-operator.yaml b/charts/argocd-apps/templates/trivy-operator.yaml
new file mode 100644
index 0000000..9745839
--- /dev/null
+++ b/charts/argocd-apps/templates/trivy-operator.yaml
@@ -0,0 +1,26 @@
+{{ if eq .Values.environment "staging" -}}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: trivy-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: trivy-system
+    server: {{ .Values.clusterUrl }}
+  project: {{ .Values.environment }}
+  source:
+    repoURL: oci://ghcr.io/aquasecurity/helm-charts/trivy-operator
+    targetRevision: {{ .Values.chartVersions.trivyOperator }}
+    chart: trivy-operator
+    helm:
+      valuesObject:
+        operator:
+          namespace: trivy-system
+          scanJobTimeout: 60m
+  syncPolicy:
+    automated:
+      # disable self-healing for local env so we can use skaffold
+      selfHeal: {{- if eq .Values.environment "local" }} false {{ else }} true {{ end }}
+      prune: false
+{{- end }}
\ No newline at end of file
diff --git a/charts/argocd-apps/values.yaml b/charts/argocd-apps/values.yaml
index 9a763ab..35133e7 100644
--- a/charts/argocd-apps/values.yaml
+++ b/charts/argocd-apps/values.yaml
@@ -7,4 +7,5 @@ environment: production
 chartVersions:
   wbaasUi: 0.4.0
   wbaasApi: 0.32.1
+  trivyOperator: 0.32.1
 # "inherits" values from argocd-config chart
diff --git a/charts/argocd-config/Chart.yaml b/charts/argocd-config/Chart.yaml
index 92a56cb..4a9e356 100644
--- a/charts/argocd-config/Chart.yaml
+++ b/charts/argocd-config/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: argocd-config
 description: Chart to deploy ArgoCD configuration (including the argocd-apps chart)
 type: application
-version: 2.1.2
+version: 2.1.3
 appVersion: "1.0"
 maintainers:
   - name: WBstack
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index c8368d7..c5f60e8 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -17,6 +17,7 @@ spec:
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}
   - {{ .Values.repoUrls.wbstack }}
+  {{- .Values.repoUrls.other | toYaml | nindent 2 }}
   clusterResourceWhitelist:
   - group: rbac.authorization.k8s.io
     kind: ClusterRole
diff --git a/charts/argocd-config/values.yaml b/charts/argocd-config/values.yaml
index c6bd153..1a30586 100644
--- a/charts/argocd-config/values.yaml
+++ b/charts/argocd-config/values.yaml
@@ -5,3 +5,5 @@ appOfAppsVersion: 2.1.0
 repoUrls:
   deploy: https://github.com/wmde/wbaas-deploy
   wbstack: https://wbstack.github.io/charts
+  other:
+  - oci://ghcr.io/aquasecurity/helm-charts/trivy-operator