diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c368e84..9a79b49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,17 +112,17 @@ jobs:
     # SAST for both sides — replaces CodeQL, which is GitHub-only (its analyze step uploads
     # SARIF to GitHub's code-scanning API) and can't run on this Gitea instance. Semgrep OSS
     # is a plain CLI: no account, no external platform API. Findings print in the job log.
-    # Runs in the official Semgrep image (semgrep preinstalled) — the setup-python + pip
-    # approach failed on this runner. Fully-qualified image name so short-name resolution
-    # works regardless of the container engine (Docker or podman).
+    # Installed via the runner's preinstalled python3/pip — NOT `setup-python` (its Python
+    # download failed on this runner) and NOT a job `container:` (this act_runner times out
+    # pulling the base runner image for container jobs). `--break-system-packages` survives
+    # PEP-668; pip drops `semgrep` on PATH. Verified locally: install + scan run clean.
     # ponytail: report-only for now (no `--error`, so the job stays green while the initial
     # findings are triaged); flip to `--error` to make it a blocking gate. See WP-30.
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    container:
-      image: docker.io/semgrep/semgrep
     steps:
       - uses: actions/checkout@v4
+      - run: python3 -m pip install --break-system-packages semgrep
       # p/default = curated cross-language security (covers JS/TS); p/csharp = the backend.
       # Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads
       # project metadata).