diff --git a/.github/workflows/cpp.yml b/.github/workflows/cpp.yml
index 8874415..26cc35f 100644
--- a/.github/workflows/cpp.yml
+++ b/.github/workflows/cpp.yml
@@ -69,9 +69,11 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: ${{ inputs.timeout }}
     # The CI image, pinned by digest; a new version is a new pin of this
-    # workflow. zizmor reads the null of the macOS and Windows branch as an
+    # workflow. --init gives the container a PID 1 that reaps orphans, so a
+    # daemon a test stops is gone rather than a zombie that still looks
+    # alive. zizmor reads the null of the macOS and Windows branch as an
     # unpinned image.
-    container: ${{ startsWith(inputs.runner, 'ubuntu') && 'ghcr.io/rawframe-project/ci-cpp:2026.10.6@sha256:50c383f608f992c272196139d749f15978e35143a2876362b1e0aef6993480bd' || null }} # zizmor: ignore[unpinned-images]
+    container: ${{ startsWith(inputs.runner, 'ubuntu') && fromJSON('{"image":"ghcr.io/rawframe-project/ci-cpp:2026.10.6@sha256:50c383f608f992c272196139d749f15978e35143a2876362b1e0aef6993480bd","options":"--init"}') || null }} # zizmor: ignore[unpinned-images]
     permissions:
       contents: read
     steps: