diff --git a/_pipeline/ingest.py b/_pipeline/ingest.py
index 56cb0b4..852ac3a 100644
--- a/_pipeline/ingest.py
+++ b/_pipeline/ingest.py
@@ -105,7 +105,10 @@ def ocr_if_needed(cfg, book_dir, book):
     out_dir = os.path.join(settings.resolve(cfg, "work_dir"), os.path.basename(book_dir))
     os.makedirs(out_dir, exist_ok=True)
     out = os.path.join(out_dir, "ocr.pdf")
-    src = os.path.join(book_dir, book["source_pdf"])
+    # OCR a copy kept in the scratch folder: Ghostscript 10 (-dSAFER, used inside ocrmypdf) cannot open a PDF that sits
+    # behind a symlink outside its permitted paths, e.g. in a CI workspace. Measured in a job container (2026-10-18).
+    src = os.path.join(out_dir, "in.pdf")
+    shutil.copyfile(os.path.join(book_dir, book["source_pdf"]), src)
     r = subprocess.run(["ocrmypdf", "--skip-text", "-l", cfg["ocr"]["language"], src, out], capture_output=True, text=True)
     if r.returncode != 0:
         print("ocrmypdf failed, exit %d. stdout: %r stderr: %r" % (r.returncode, r.stdout[-1500:], r.stderr[-3000:]))