diff --git a/docker/Dockerfile.minio.ci b/docker/Dockerfile.minio.ci
index 622b3bbbf2..32ff1c0a08 100644
--- a/docker/Dockerfile.minio.ci
+++ b/docker/Dockerfile.minio.ci
@@ -1,4 +1,9 @@
-FROM quay.io/minio/minio:latest AS minio
+# MinIO withdrew anonymous public access to its own image from both Docker Hub and quay.io, so
+# this pulls from the Palace mirror of the upstream release instead. The mirror is an unmodified
+# MinIO build, published from the ci-scripts repo:
+# https://github.com/ThePalaceProject/ci-scripts/blob/main/images/minio/Dockerfile
+# The tag is pinned deliberately; the mirror publishes no `latest`.
+FROM ghcr.io/thepalaceproject/palace-ci-minio:RELEASE.2025-09-07T16-13-09Z AS minio
 
 ENV MINIO_ROOT_USER=palace
 ENV MINIO_ROOT_PASSWORD=palace123