diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 4ff4e02..389e81a 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -42,8 +42,8 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-config"
-          reports="${{ runner.temp }}/trivy-ci-reports-config"
+          scan="${{ github.workspace }}/.ci-trivy-scan-config"
+          reports="${{ github.workspace }}/.ci-trivy-reports-config"
           mkdir -p "$scan" "$reports"
           printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
           echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
@@ -72,8 +72,8 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-fs"
-          reports="${{ runner.temp }}/trivy-ci-reports-fs"
+          scan="${{ github.workspace }}/.ci-trivy-scan-fs"
+          reports="${{ github.workspace }}/.ci-trivy-reports-fs"
           mkdir -p "$scan" "$reports"
           printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
           echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
@@ -102,7 +102,7 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          reports="${{ runner.temp }}/trivy-ci-reports-image"
+          reports="${{ github.workspace }}/.ci-trivy-reports-image"
           mkdir -p "$reports"
           echo "reports=$reports" >> "$GITHUB_OUTPUT"
       - name: Run scan-image
diff --git a/scan-config/README.md b/scan-config/README.md
index a644475..d4bf8bf 100644
--- a/scan-config/README.md
+++ b/scan-config/README.md
@@ -24,7 +24,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: misconfig.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +38,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
@@ -53,5 +53,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 ## Notes
 
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Use **`cache-dir`** and **`output-dir`** under **`${{ github.workspace }}`** (or another path the Docker daemon can bind-mount) when the job runs in a container.
+- Paths should exist or be creatable: **`output-dir`** and **`cache-dir`** are created with `mkdir -p` if missing; **`scan-path`** must already exist as a directory.
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
diff --git a/scan-config/action.yaml b/scan-config/action.yaml
index 7b3d9e2..caf7889 100644
--- a/scan-config/action.yaml
+++ b/scan-config/action.yaml
@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
@@ -44,6 +44,7 @@ runs:
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
         scan_path=$(realpath "$SCAN_PATH_IN")
+        mkdir -p "$CACHE_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
diff --git a/scan-fs/README.md b/scan-fs/README.md
index cd8f644..d8cff06 100644
--- a/scan-fs/README.md
+++ b/scan-fs/README.md
@@ -24,7 +24,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: fs.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +38,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
@@ -53,6 +53,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 ## Notes
 
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Use **`cache-dir`** and **`output-dir`** under **`${{ github.workspace }}`** (or another path the Docker daemon can bind-mount) when the job runs in a container.
+- Paths should exist or be creatable: **`output-dir`** and **`cache-dir`** are created with `mkdir -p` if missing; **`scan-path`** must already exist as a directory.
 - Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
diff --git a/scan-fs/action.yaml b/scan-fs/action.yaml
index 9c2edeb..9716077 100644
--- a/scan-fs/action.yaml
+++ b/scan-fs/action.yaml
@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
@@ -44,6 +44,7 @@ runs:
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
         scan_path=$(realpath "$SCAN_PATH_IN")
+        mkdir -p "$CACHE_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
diff --git a/scan-image/README.md b/scan-image/README.md
index 43627de..15c2dab 100644
--- a/scan-image/README.md
+++ b/scan-image/README.md
@@ -23,7 +23,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
   with:
     image: alpine:3.20
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: image.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -37,7 +37,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
@@ -52,6 +52,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 
 ## Notes
 
-- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
+- Use **`cache-dir`** and **`output-dir`** under **`${{ github.workspace }}`** (or another path the Docker daemon can bind-mount) when the job runs in a container.
+- **`output-dir`** and **`cache-dir`** are created with `mkdir -p` if missing.
 - Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
diff --git a/scan-image/action.yaml b/scan-image/action.yaml
index bfaf70a..7aa416d 100644
--- a/scan-image/action.yaml
+++ b/scan-image/action.yaml
@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
@@ -43,6 +43,7 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
diff --git a/setup-db/README.md b/setup-db/README.md
index d6028ba..7b5518b 100644
--- a/setup-db/README.md
+++ b/setup-db/README.md
@@ -4,6 +4,8 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring
 
 The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
 
+The default **`cache-dir`** is under **`${{ github.workspace }}`** so the path is visible to the Docker daemon when jobs run inside a container (bind-mounting e.g. `/tmp/...` often fails because that path does not exist on the Docker host).
+
 **Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
 
 ## Usage
@@ -38,9 +40,9 @@ jobs:
 
 ## Inputs
 
-| Input            | Description                                                                 | Required | Default |
-| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `cache-dir`      | Path to the Trivy cache directory                                           | No       | `${{ runner.temp }}/trivy` |
-| `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
+| Input           | Description                                               | Required | Default                                                    |
+| --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
+| `cache-dir`     | Path to the Trivy cache directory                         | No       | `${{ github.workspace }}/.trivy-cache`                     |
+| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
 
 **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
diff --git a/setup-db/action.yaml b/setup-db/action.yaml
index 8f4ac21..0d6db88 100644
--- a/setup-db/action.yaml
+++ b/setup-db/action.yaml
@@ -7,9 +7,9 @@ branding:
 
 inputs:
   cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path to the Trivy cache directory (default: under the workspace so Docker bind mounts work on containerized runners)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   trivy-version:
     description: "Trivy docker image version to use (full image reference including digest is recommended)"
     required: false
@@ -23,6 +23,9 @@ outputs:
 runs:
   using: "composite"
   steps:
+    - name: Ensure cache directory exists
+      shell: bash
+      run: mkdir -p "${{ inputs.cache-dir }}"
     - id: current-date
       shell: bash
       run: |