diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 6f9704d..45c2ce2 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -393,12 +393,26 @@ jobs:
         # on, and failing on it only teaches people to add ignore entries. Rebuilding on a
         # new base image picks the fix up the day it exists.
         #
-        # The mounted cache dir keeps the vuln DB (~50MB) across the three matrix legs on
-        # this runner instead of re-downloading it for each.
+        # The vuln DB cache is a NAMED VOLUME, not `-v "$PWD/.trivycache:..."`.
+        #
+        # The bind form was the same bug that made gitleaks scan nothing: `$PWD` is a path
+        # in the job container, but the -v is resolved by the daemon in the dind sidecar,
+        # which has no such directory and silently creates an empty one. Every run then
+        # logged `[vulndb] Need to update DB` and spent ~35s re-downloading it, and the
+        # cache it wrote went into a throwaway directory inside dind.
+        #
+        # A named volume lives in the dind daemon's own storage, which is the one thing on
+        # this runner both sides agree on. It survives across matrix legs and across runs.
+        #
+        # Measured, not assumed: cold pass logs the three download lines and leaves 1.1G
+        # in the volume; warm pass logs nothing. 1.1G is far more than the 50MB an older
+        # comment here claimed, so the retention story matters. Trivy replaces the DB in
+        # place rather than accumulating versions, so the volume stays at roughly one DB,
+        # and the weekly prune CronJob reclaims it at the cost of one re-download.
         run: |
           docker run --rm \
             -v /var/run/docker.sock:/var/run/docker.sock \
-            -v "$PWD/.trivycache:/root/.cache/trivy" \
+            -v svcforge-trivy-db:/root/.cache/trivy \
             aquasec/trivy:0.72.0@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f \
             image \
               --severity HIGH,CRITICAL \