diff --git a/go.mod b/go.mod
index 5e2285e..721cb89 100644
--- a/go.mod
+++ b/go.mod
@@ -159,4 +159,4 @@ require (
 
 // Trivy has some issues that we're floating patches for, and will hopefully
 // be upstreamed eventually.
-replace github.com/aquasecurity/trivy => github.com/coder/trivy v0.0.0-20260309164037-c413f5a2f511
+replace github.com/aquasecurity/trivy => github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9
diff --git a/go.sum b/go.sum
index 1b7c977..893f141 100644
--- a/go.sum
+++ b/go.sum
@@ -38,6 +38,10 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
+github.com/PushTheLimit/trivy v0.0.0-20260825211335-fa2a87959259 h1:vba8EkcoWWGRr6nTNFspGAESDHswMwBLAz+y0XqxtfU=
+github.com/PushTheLimit/trivy v0.0.0-20260825211335-fa2a87959259/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
+github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9 h1:9cCoooPV3k63sQdDY0E0eFutFgy+avEMdWaWm6jc7qc=
+github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
diff --git a/preview.go b/preview.go
index 32ac43f..f41e08b 100644
--- a/preview.go
+++ b/preview.go
@@ -243,6 +243,16 @@ func Preview(ctx context.Context, input Input, dir fs.FS) (output *Output, diagn
 		parser.OptionWithEvalHook(ownerHook),
 		parser.OptionWithWorkingDirectoryPath("/"),
 		parser.OptionWithEvalHook(parameterContextsEvalHook(input)),
+		// Only the parameter/preset/tag blocks and what they reference need to be
+		// evaluated to render a workspace form. The resources a workspace would
+		// create cannot feed those blocks, so pruning the ones nothing references
+		// avoids evaluating the entire module graph on every request without
+		// changing any parameter, preset or tag. See OptionWithResourceClosure.
+		parser.OptionWithResourceClosure([]string{
+			"coder_parameter",
+			"coder_workspace_preset",
+			"coder_workspace_tags",
+		}),
 		// 'OptionsWithTfVars' cannot be set with 'OptionWithTFVarsPaths'. So load the
 		// tfvars from the files ourselves and merge with the user-supplied tf vars.
 		parser.OptionsWithTfVars(variableValues),