diff --git a/pkg/scanners/trivy/trivy.go b/pkg/scanners/trivy/trivy.go
index 8028ac4742..2ac23fc273 100644
--- a/pkg/scanners/trivy/trivy.go
+++ b/pkg/scanners/trivy/trivy.go
@@ -67,6 +67,15 @@ func main() {
 	log.Info("trivy version", "trivy version", trivyVersion)
 	log.Info("config", "config", *config)
 
+	if _, err := os.Stat(trivyCommandName); err != nil {
+		if os.IsNotExist(err) {
+			fmt.Fprintf(os.Stderr, "trivy binary not found at %s\n", trivyCommandName)
+			os.Exit(generalErr)
+		}
+		log.Error(err, "unable to stat trivy binary")
+		os.Exit(generalErr)
+	}
+
 	userConfig := *DefaultConfig()
 	if *config != "" {
 		var err error
diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go
index 29a262e7e3..ac51b5f234 100644
--- a/pkg/utils/utils.go
+++ b/pkg/utils/utils.go
@@ -51,9 +51,14 @@ func GetConn(ctx context.Context, socketPath string) (conn *grpc.ClientConn, err
 		return nil, err
 	}
 
+	// Use a timeout context so we fail fast instead of hanging indefinitely
+	// when the CRI socket is inaccessible (e.g. permission denied).
+	connCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
 	//nolint:staticcheck // SA1019: grpc.DialContext is deprecated but maintains required blocking behavior
 	return grpc.DialContext(
-		ctx,
+		connCtx,
 		addr,
 		//nolint:staticcheck // SA1019: grpc.WithBlock is deprecated but ensures synchronous CRI connection
 		grpc.WithBlock(),