diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 72b8ce1..88cbe3e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -116,6 +116,7 @@ jobs:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
+          pull: true
           push: ${{ github.ref == 'refs/heads/master' && github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
diff --git a/scripts/install-sonar.sh b/scripts/install-sonar.sh
index 8df2ebe..aee3f6a 100644
--- a/scripts/install-sonar.sh
+++ b/scripts/install-sonar.sh
@@ -35,6 +35,9 @@ curl -sL "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-
     && ln -s /opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/bin/sonar-scanner /usr/local/bin/sonar-scanner \
     && sed -i 's/use_embedded_jre=true/use_embedded_jre=false/g' /opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/bin/sonar-scanner
 
+# The scanner uses the inherited JDK; do not retain its unpatched bundled JRE.
+rm -rf "/opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/jre"
+
 # Verify installation
 echo "=== Verifying Sonar Scanner ==="
 sonar-scanner --version