diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index e1a5f84b..65e0e834 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -1825,6 +1825,7 @@
 # and repeats it.
 - macro: user_trusted_containers
   condition: (container.image.repository endswith sysdig/agent or
+              container.image.repository endswith sysdig/agent-slim or
               container.image.repository endswith sysdig/node-image-analyzer)
 
 - list: sematext_images