diff --git a/license/license.go b/license/license.go
index 6ba27ce..bffb278 100644
--- a/license/license.go
+++ b/license/license.go
@@ -31,6 +31,10 @@ const (
 
 	FeatureConsole = "console" // browser SSH/RDP/VNC
 	FeatureOIDC    = "oidc"    // per-instance single sign-on
+	// FeatureVulnScanning gates package inventory collection as well as the
+	// findings themselves. The gate is at collection, not display: an ungated
+	// instance stores no inventory, and storage is the expensive half.
+	FeatureVulnScanning = "vuln_scanning"
 )
 
 // Support levels. Carried for display and enforced by nothing — there is no code