diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 80a15fe..82c5a82 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -214,10 +214,8 @@ jobs:
         # scripts/self-host-bootstrap.ts, not on the request path, so a missing
         # bucket would surface as a presigned PUT returning NoSuchBucket.
         run: |
-          curl -sSfL -o "$RUNNER_TEMP/mc" https://dl.min.io/client/mc/release/linux-amd64/mc
-          chmod +x "$RUNNER_TEMP/mc"
-          "$RUNNER_TEMP/mc" alias set ciminio "$R2_ENDPOINT" "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY"
-          "$RUNNER_TEMP/mc" mb --ignore-existing "ciminio/$R2_BUCKET_NAME"
+          docker exec minio mc alias set ciminio "$R2_ENDPOINT" "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY"
+          docker exec minio mc mb --ignore-existing "ciminio/$R2_BUCKET_NAME"
       - name: Install the Playwright browser
         # Only chromium: playwright.config.ts runs a desktop Chromium project and
         # a Pixel 7 project, and the mobile one is Chromium too.
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index 5bd760f..d518ce1 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -88,7 +88,7 @@ services:
   # would surface as a presigned PUT returning NoSuchBucket.
   minio-test-init:
     profiles: ['e2e']
-    image: docker.io/minio/mc:latest
+    image: quay.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
     container_name: openframe-minio-test-init
     depends_on:
       minio-test: