diff --git a/scripts/scan_container_image.sh b/scripts/scan_container_image.sh
index 87b5406a..36ab025f 100644
--- a/scripts/scan_container_image.sh
+++ b/scripts/scan_container_image.sh
@@ -5,11 +5,19 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
 TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
-CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
+CACHE_VOLUME="${GEOINTEL_TRIVY_CACHE_VOLUME:-geointel-trivy-cache}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
 IGNORE_FILE="$(mktemp)"
 CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
-trap 'rm -f "$IGNORE_FILE"' EXIT
+POLICY_CONTAINER=""
+
+cleanup() {
+  rm -f "$IGNORE_FILE"
+  if [ -n "$POLICY_CONTAINER" ]; then
+    docker rm -f "$POLICY_CONTAINER" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup EXIT
 
 case "$OUTPUT" in
   /*|*..*)
@@ -19,33 +27,34 @@ case "$OUTPUT" in
 esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
-mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
+mkdir -p "$ROOT/$(dirname "$OUTPUT")"
 "$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
 "$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
   --print-container-ids > "$IGNORE_FILE"
 
+docker volume create "$CACHE_VOLUME" >/dev/null
+
 # Keep the complete report, including vulnerabilities without an available fix.
+# Stream JSON over stdout so no checkout path has to be mounted through the
+# nested Gitea/act container boundary.
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$ROOT:/workspace" \
-  -v "$CACHE_DIR:/root/.cache/trivy" \
+  -v "$CACHE_VOLUME:/root/.cache/trivy" \
   "$TRIVY_IMAGE" \
   image \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --format json \
-  --output "/workspace/$OUTPUT" \
-  "$TARGET_IMAGE"
+  "$TARGET_IMAGE" > "$ROOT/$OUTPUT"
 
 # Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
-# remain visible in the full report and must be reviewed before release. The
-# postgres base image's Go gosu binary remains discoverable in a lower layer,
-# but the final filesystem replaces it with the audited setpriv shell wrapper.
-docker run --rm \
+# remain visible in the full report and must be reviewed before release. Copy
+# the verified exception IDs into a stopped scanner container before starting
+# it; `docker cp` works when the job checkout itself lives in another container.
+POLICY_CONTAINER="$(docker create \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$CACHE_DIR:/root/.cache/trivy" \
-  -v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro" \
+  -v "$CACHE_VOLUME:/root/.cache/trivy" \
   "$TRIVY_IMAGE" \
   image \
   --scanners vuln \
@@ -56,7 +65,11 @@ docker run --rm \
   --skip-files /usr/local/bin/gosu \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
-  "$TARGET_IMAGE"
+  "$TARGET_IMAGE")"
+docker cp "$IGNORE_FILE" "$POLICY_CONTAINER:$CONTAINER_IGNORE_FILE"
+docker start -a "$POLICY_CONTAINER"
+docker rm "$POLICY_CONTAINER" >/dev/null
+POLICY_CONTAINER=""
 
 test -s "$ROOT/$OUTPUT"
 echo "Container vulnerability report written to $OUTPUT"