How do you handle SAST security scanning in your CI/CD pipeline without it killing speed?

Our security team mandated SAST scans on every PR six months ago. On paper it was the right call. In practice it added twenty minutes to every PR, the false positive rate is brutal, and engineers have started merging around it because waiting is worse than the risk.

I don’t want to fight security, I want the scanning to actually catch real issues and stop being the reason we miss sprint commitments.

Any recs on how other teams are running scans without engineers spending more time around them?