diff --git a/Dockerfile b/Dockerfile
index 33ec04b..3dea556 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -50,6 +50,11 @@ RUN useradd -u 1000 -m -s /bin/bash zap && \
 # Switch to non-root for runtime
 USER zap
 
+# Ensure the workspace directory exists and is owned by our zap user
+RUN mkdir -p /zap/wrk \
+    && chown -R zap:zap /zap/wrk
+# Declare it as a volume so runtimes can mount it
+VOLUME ["/zap/wrk"]
 # Configure environment for ZAP
 ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64 \
     PATH=${JAVA_HOME}/bin:/zap:${PATH} \
diff --git a/ci/tasks/zap-scan.yml b/ci/tasks/zap-scan.yml
index 5a51563..fb4a197 100644
--- a/ci/tasks/zap-scan.yml
+++ b/ci/tasks/zap-scan.yml
@@ -14,6 +14,7 @@ inputs:
 
 outputs:
   - name: zap-report
+    dir-path: /zap/wrk
 
 params:
   TARGET_CONTEXT: # one of internal, external, pages, unauthenticated
@@ -46,13 +47,11 @@ run:
       CLIENT_SECRET=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].client_secret // empty' <<<"$CREDS_JSON")
       TOKEN_URI=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].token_uri // empty' <<<"$CREDS_JSON")
 
-      mkdir -p zap-report
-
       for url in "${URLS[@]}"; do
         host=$(echo "$url" | sed -E 's#https?://##;s#/.*##')
-        HTML_OUT="zap-report/${TARGET_CONTEXT}-${host}.html"
-        JSON_OUT="zap-report/${TARGET_CONTEXT}-${host}.json"
-        XML_OUT="zap-report/${TARGET_CONTEXT}-${host}.xml"
+        HTML_OUT="/zap/wrk/${TARGET_CONTEXT}-${host}.html"
+        JSON_OUT="/zap/wrk/${TARGET_CONTEXT}-${host}.json"
+        XML_OUT="/zap/wrk/${TARGET_CONTEXT}-${host}.xml"
 
         echo "→ Scanning $url"
 
diff --git a/ci/zap-config/zap.yaml b/ci/zap-config/zap.yaml
index 8fc25fb..cf9af48 100644
--- a/ci/zap-config/zap.yaml
+++ b/ci/zap-config/zap.yaml
@@ -30,7 +30,7 @@ jobs:
   - type: report
     parameters:
       template: "traditional-html"
-      reportDir: "zap-report"
+      reportDir: "/zap/wrk"
       reportFile: "{{yyyy-MM-dd}}-[[site]]-html.html"
       displayReport: false
     risks:
@@ -47,7 +47,7 @@ jobs:
   - type: report
     parameters:
       template: "traditional-json"
-      reportDir: "zap-report"
+      reportDir: "/zap/wrk"
       reportFile: "{{yyyy-MM-dd}}-[[site]]-json.json"
       displayReport: false
       risks:
@@ -64,7 +64,7 @@ jobs:
   - type: report
     parameters:
       template: "traditional-xml"
-      reportDir: "zap-report"
+      reportDir: "/zap/wrk"
       reportFile: "{{yyyy-MM-dd}}-[[site]]-xml.xml"
       displayReport: false
       risks:
@@ -77,11 +77,11 @@ jobs:
         - medium
   #      - low
   #      - falsepositive
-  
+
   - type: report
     parameters:
       template: "sarif-json"
-      reportDir: "zap-report"
+      reportDir: "/zap/wrk"
       reportFile: "{{yyyy-MM-dd}}-[[site]]-sarif.sarif.json"
       displayReport: false
       risks: