diff --git a/crates/cm-files/tests/s3_store.rs b/crates/cm-files/tests/s3_store.rs
index 20b83ac..d0df8cb 100644
--- a/crates/cm-files/tests/s3_store.rs
+++ b/crates/cm-files/tests/s3_store.rs
@@ -11,7 +11,11 @@ async fn minio_store() -> (
     S3BlobStore,
     testcontainers_modules::testcontainers::ContainerAsync<GenericImage>,
 ) {
-    let container = GenericImage::new("minio/minio", "latest")
+    // quay.io, not Docker Hub: hub.docker.com/r/minio/minio returned 404 for
+    // the whole repository on 2026-09-19. CI kept passing only because gw-04
+    // had a year-old copy cached and testcontainers pulls only on a local
+    // miss; every fresh machine failed here with "pull access denied".
+    let container = GenericImage::new("quay.io/minio/minio", "latest")
         .with_exposed_port(9000.tcp())
         .with_wait_for(WaitFor::message_on_either_std("API:"))
         .with_env_var("MINIO_ROOT_USER", "tc-access")