diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index 57e5a40..3e6bfc4 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -1,36 +1,25 @@
 name: Image scan
 
-# Alpine package fixes only reach users with a new release. A weekly scan
-# of a fresh build fails (and notifies) when a fixable high or critical
-# vulnerability is waiting for one.
+# Scans the image people actually run: the one published on Docker Hub, not
+# a fresh build. A vulnerability can appear without any commit here, and a
+# fix only reaches users with a new release, so this fails (and notifies)
+# when a fixable high or critical vulnerability is waiting for one.
 on:
   schedule:
     - cron: "17 6 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   scan:
-    name: Scan the image for fixable vulnerabilities
+    name: Scan the published image for fixable vulnerabilities
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - name: Build image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          load: true
-          pull: true
-          tags: filesync:scan
       - name: Scan
         uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
-          image: filesync:scan
+          image: poliuscorp/filesync:latest
           fail-build: true
           severity-cutoff: high
           only-fixed: true