diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d23d5844aa..9df8632f46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,6 +50,10 @@ jobs:
   guest:
     needs: toolchain
     if: ${{ !cancelled() }}
+    # Its container's pull.
+    permissions:
+      contents: read
+      packages: read
     uses: ./.github/workflows/guest.yml
     with:
       kvm: true
diff --git a/.github/workflows/guest.yml b/.github/workflows/guest.yml
index 2879f7e9b4..8c81f3b1d0 100644
--- a/.github/workflows/guest.yml
+++ b/.github/workflows/guest.yml
@@ -24,11 +24,15 @@ jobs:
     timeout-minutes: 60
     # The digest is the instrument's one pin: a dated image names the snapshot
     # archive it was built from, and `deps` installs QEMU from that archive.
-    # ECR Public's copy of Docker Hub's image: Docker Hub's anonymous pull limit
-    # refused it there, and the digest holds whichever registry serves it.
-    # The node ships `crw-rw---- root:kvm` and root opens it.
+    # ToyOSOrg's copy of Docker Hub's `sid-20260918`, pulled with the run's
+    # token, which its caller grants `packages: read`: Docker Hub's and ECR
+    # Public's anonymous limits refused it, and the digest holds whichever
+    # registry serves it. The node ships `crw-rw---- root:kvm` and root opens it.
     container:
-      image: public.ecr.aws/docker/library/debian@sha256:a2aa46262453eba3f464d8b1c7a8c31db85eb15af180ae34dd400615d7208547
+      image: ghcr.io/toyosorg/debian@sha256:a2aa46262453eba3f464d8b1c7a8c31db85eb15af180ae34dd400615d7208547
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
       options: ${{ inputs.kvm && '--device=/dev/kvm' || '' }}
     steps:
       # Before the checkout, which wants git. Three attempts, because the
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index bf99891b4a..d4bdf6bba9 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -75,6 +75,10 @@ jobs:
   tcg:
     needs: toolchain
     if: ${{ !cancelled() }}
+    # Its container's pull.
+    permissions:
+      contents: read
+      packages: read
     uses: ./.github/workflows/guest.yml
     with:
       kvm: false
diff --git a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
index ec45e066c5..076ed879e5 100644
--- a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
+++ b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
@@ -24,8 +24,9 @@ arrives and is not one. M4 and M5 are stages of `issues/toyos-builds-itself.md`.
 | the toolchain's own `clang`, `llvm-ar`, `rust-lld` and `llvm-config`, built from `ToyOSOrg/llvm-project` | rustc links every guest binary with `rust-lld`; `clang` compiles the C corpus (`tests/common/compile.rs`) and, with `llvm-ar`, through `cc::Build` the C of every guest crate that has any (`build/clang.rs`, `build/build.rs`'s `GuestEnv`): doomgeneric, and ring's C and assembly in a test crate's `https_get` and `ring_kat`; rustc's bootstrap asks `llvm-config` how to link LLVM | admitted: our fork's C++, which ToyOS can one day build and run; no Rust tool compiles C, `cc::Build` archives with an `ar`, bootstrap reads LLVM through `llvm-config`, and `CLAUDE.md` links everything with `rust-lld` | M5: no host in the loop |
 | `ovmf-generic`, `qemu-efi-aarch64` | the x86-64 and AArch64 UEFI firmware of CI's guest containers (`build/firmware.rs`), packaged by Debian apart from QEMU | admitted: QEMU's own firmware, and no Rust firmware does its job | the instrument's QEMU carries its own firmware |
 | `ca-certificates` | the trust store `git` and `curl` verify against in CI's containers | admitted: data both of them need | goes when neither runs there |
-| Debian's `sid` image, pulled anonymously from ECR Public's copy of Docker Hub's | the container of `guest.yml`'s suite, pinned to digest `a2aa4626…`, whose dated snapshot archive `deps` installs QEMU from; and of `nightly.yml`'s `portability-linux`, `sid` as it stands | admitted: the runner's Ubuntu 24.04 publishes QEMU 8.2.2 (Launchpad, noble, every pocket) and `build/ci/qemu-version` declares 11.1.1, which that snapshot archive carries | the runner's own OS carries the declared QEMU, or the build system builds it |
+| Debian's `sid` image, Docker Hub's `sid-20260918` copied once to `ghcr.io/toyosorg/debian` and pulled with the run's token | the container of `guest.yml`'s suite, pinned to digest `a2aa4626…`, whose dated snapshot archive `deps` installs QEMU from; and, pulled anonymously from ECR Public's copy of Docker Hub's, of `nightly.yml`'s `portability-linux`, `sid` as it stands | admitted: the runner's Ubuntu 24.04 publishes QEMU 8.2.2 (Launchpad, noble, every pocket) and `build/ci/qemu-version` declares 11.1.1, which that snapshot archive carries | the runner's own OS carries the declared QEMU, or the build system builds it |
 | Docker on the runner | Actions pulls and runs every `container:` image with it, those two jobs' | refused: Go, not C or C++ ToyOS can one day build and run, and Actions runs a `container:` with Docker alone | the container goes with the image row |
+| `skopeo` | `skopeo copy --all --preserve-digests` copied Docker Hub's `sid-20260918` index, every manifest by its digest, to `ghcr.io/toyosorg/debian`, once, from a `run:` step of a workflow that ran on a branch and is not in `main`; a new pin is a new copy made the same way, and the copy it replaces is deleted | refused: Go, not C or C++ ToyOS can one day build and run | a Rust tool makes the copy, or the container goes with the image row |
 | the T14's Ubuntu and every tool `tests/metal/src/lib.rs` runs on it over `ssh` | the metal loop, on the T14 and never on a development host | outside the rule: recovery equipment on a test machine, not the build's host | they leave with Ubuntu (`issues/the-machine-updates-itself-without-ubuntu.md`) |
 | `sh` running `rust/x`, and Python running `x.py` and `bootstrap.py` | every toolchain build (`build/toolchain.rs`) | refused: a Rust tool does it, upstream's bootstrap binary, which builds with stable cargo, fetches its own stage0 (`rust/src/bootstrap/src/core/download.rs`) and needs no Python | `build/toolchain.rs` runs the bootstrap binary |
 | `curl` in rustc's bootstrap | fetches the stage0 `rust/src/stage0` pins, for a compiler or LLVM build whose build directory lacks it, whichever bootstrap runs | refused: a Rust tool does it, rustup installs the dated beta the pin names, and bootstrap takes a stage0 through `build.rustc` and `build.cargo`, as `build/sysroot.rs` hands it one | no toolchain build fetches with `curl` |