diff --git a/ci/buildkite-secondary.yml b/ci/buildkite-secondary.yml
index ff5a898e5..7dfa2a701 100644
--- a/ci/buildkite-secondary.yml
+++ b/ci/buildkite-secondary.yml
@@ -2,6 +2,12 @@
 # Build steps that run after the primary pipeline on pushes and tags.
 # Pull requests to not run these steps.
 steps:
+  - name: "cargo audit"
+    command: ". ci/rust-version.sh; ci/docker-run.sh $$rust_stable_docker_image ci/do-audit.sh"
+    agents:
+      queue: "release-build"
+    timeout_in_minutes: 10
+  - wait
   - name: "publish tarball (x86_64-unknown-linux-gnu)"
     command: "ci/publish-tarball.sh"
     agents: