diff --git a/.github/workflows/semgrep-self-test.yml b/.github/workflows/semgrep-self-test.yml
new file mode 100644
index 0000000..b964764
--- /dev/null
+++ b/.github/workflows/semgrep-self-test.yml
@@ -0,0 +1,13 @@
+name: Semgrep Self-Test
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/semgrep.yml'
+      - '.github/workflows/semgrep-self-test.yml'
+  workflow_dispatch:
+
+jobs:
+  scan:
+    uses: ./.github/workflows/semgrep.yml
+    secrets: inherit
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index d83ae14..3ce93b6 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -19,14 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     container:
-      image: semgrep/semgrep
-      # Anonymous Docker Hub pulls share the caller's runner IP rate limit and
-      # have been failing this job at Initialize containers in multiple repos.
-      # In a reusable workflow these resolve from the caller's repo (with
-      # secrets: inherit); when unset the runner falls back to an anonymous pull.
-      credentials:
-        username: ${{ vars.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # Pull through Google's unauthenticated Docker Hub mirror. Anonymous
+      # Docker Hub pulls share the caller's runner IP rate limit and fail at
+      # Initialize containers. Do not add a credentials block: callers that
+      # don't define the referenced vars/secrets resolve to an empty value,
+      # which makes the runner reject the whole template ("Unexpected value
+      # ''", actions/runner#4204) for every consumer of this workflow.
+      image: mirror.gcr.io/semgrep/semgrep
     outputs:
       findings_count: ${{ steps.count.outputs.findings_count }}
     steps: