diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index f43843b..d16b369 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -58,9 +58,9 @@ jobs:
   # don't look for. Advisory at first (not a required check); promote once tuned.
   sast:
     runs-on: ubuntu-latest
+    container: semgrep/semgrep   # official image — the runner's base image lacks pip
     steps:
       - uses: actions/checkout@v4
       - name: Semgrep scan
         run: |
-          pip install --quiet semgrep
           semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet