diff --git a/.golangci.yaml b/.golangci.yaml
index 6b9bf74b0..5aa2a4905 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -7,6 +7,7 @@ linters:
     - asciicheck
     - bodyclose
     - copyloopvar
+    - depguard
     - dogsled
     - dupl
     - errcheck
@@ -29,6 +30,13 @@ linters:
     - unused
     - whitespace
   settings:
+    depguard:
+      rules:
+        yaml:
+          deny:
+            # gopkg.in/yaml.v3 is unmaintained and panics on some malformed input (see #5327)
+            - pkg: gopkg.in/yaml.v3
+              desc: use go.yaml.in/yaml/v3 instead
     funlen:
       lines: 70
       statements: 50
@@ -71,7 +79,6 @@ linters:
 
 # do not enable...
 #    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".
-#    - depguard          # We don't have a configuration for this yet
 #    - goprintffuncname  # does not catch all cases and there are exceptions
 #    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals
diff --git a/go.mod b/go.mod
index eadba32c8..b7573e132 100644
--- a/go.mod
+++ b/go.mod
@@ -97,7 +97,6 @@ require (
 	golang.org/x/net v0.59.0
 	golang.org/x/time v0.16.0
 	golang.org/x/tools v0.50.0
-	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.59.0
 )
 
diff --git a/internal/capabilities/capabilities.go b/internal/capabilities/capabilities.go
index 492cdd2c4..2844f7136 100644
--- a/internal/capabilities/capabilities.go
+++ b/internal/capabilities/capabilities.go
@@ -9,7 +9,7 @@ import (
 	"sort"
 
 	"github.com/scylladb/go-set/strset"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/task"
 )
diff --git a/internal/capabilities/generate/io.go b/internal/capabilities/generate/io.go
index 3d660cf32..2eb839a6e 100644
--- a/internal/capabilities/generate/io.go
+++ b/internal/capabilities/generate/io.go
@@ -1,4 +1,4 @@
-// this file handles YAML file reading and writing with comment preservation, using gopkg.in/yaml.v3's node tree to maintain all existing comments during regeneration.
+// this file handles YAML file reading and writing with comment preservation, using go.yaml.in/yaml/v3's node tree to maintain all existing comments during regeneration.
 package main
 
 import (
@@ -6,7 +6,7 @@ import (
 	"os"
 	"regexp"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/capabilities"
 	"github.com/anchore/syft/internal/capabilities/internal"
diff --git a/internal/capabilities/generate/io_test.go b/internal/capabilities/generate/io_test.go
index 0d6e790b4..65189c75f 100644
--- a/internal/capabilities/generate/io_test.go
+++ b/internal/capabilities/generate/io_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestFindFieldValue(t *testing.T) {
diff --git a/internal/capabilities/internal/load_capabilities.go b/internal/capabilities/internal/load_capabilities.go
index 43c12be27..b07230def 100644
--- a/internal/capabilities/internal/load_capabilities.go
+++ b/internal/capabilities/internal/load_capabilities.go
@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/capabilities"
 )
diff --git a/internal/capabilities/model_test.go b/internal/capabilities/model_test.go
index 12ddb8994..f658e5c27 100644
--- a/internal/capabilities/model_test.go
+++ b/internal/capabilities/model_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestConfigSchemaExtensions(t *testing.T) {
diff --git a/syft/pkg/cataloger/ai/huggingface.go b/syft/pkg/cataloger/ai/huggingface.go
index 6c333835b..dc8333e70 100644
--- a/syft/pkg/cataloger/ai/huggingface.go
+++ b/syft/pkg/cataloger/ai/huggingface.go
@@ -3,7 +3,7 @@ package ai
 import (
 	"bytes"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
diff --git a/syft/pkg/cataloger/ai/parse_safetensors_test.go b/syft/pkg/cataloger/ai/parse_safetensors_test.go
index c210bfbe0..943892c40 100644
--- a/syft/pkg/cataloger/ai/parse_safetensors_test.go
+++ b/syft/pkg/cataloger/ai/parse_safetensors_test.go
@@ -1066,6 +1066,12 @@ func TestParseFrontmatter(t *testing.T) {
 			input:   "---\nlicense: mit\n",
 			wantNil: true,
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:    "malformed frontmatter that panics the yaml decoder",
+			input:   "---\n<<:\r? 0:\n---\nbody",
+			wantNil: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1157,6 +1163,12 @@ limitations:
 			input: "---\nspdx-id: MIT\n(never closes)\n",
 			want:  "",
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:  "malformed frontmatter that panics the yaml decoder",
+			input: "---\n<<:\r? 0:\n---\nbody\n",
+			want:  "",
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/syft/pkg/cataloger/snap/parse_base_dpkg.go b/syft/pkg/cataloger/snap/parse_base_dpkg.go
index b73f82555..72bb20482 100644
--- a/syft/pkg/cataloger/snap/parse_base_dpkg.go
+++ b/syft/pkg/cataloger/snap/parse_base_dpkg.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
diff --git a/syft/pkg/cataloger/snap/parse_snapd_snapcraft.go b/syft/pkg/cataloger/snap/parse_snapd_snapcraft.go
index 8a085f9ab..90dccead7 100644
--- a/syft/pkg/cataloger/snap/parse_snapd_snapcraft.go
+++ b/syft/pkg/cataloger/snap/parse_snapd_snapcraft.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
diff --git a/syft/pkg/cataloger/snap/parse_system_manifest.go b/syft/pkg/cataloger/snap/parse_system_manifest.go
index ee7159c83..8a84e3233 100644
--- a/syft/pkg/cataloger/snap/parse_system_manifest.go
+++ b/syft/pkg/cataloger/snap/parse_system_manifest.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"