diff --git a/README.md b/README.md
index 4197929..284fc44 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ an optional AI layer explains them and provably cannot invent them.
 Built with .NET 10, React and TypeScript, a read-only GitHub App, and the OpenAI
 API.
 
-![Connected dashboard](docs/assets/screenshots/01-connected-dashboard.png)
+![The deployed workspace, open to anyone](docs/assets/screenshots/01-connected-dashboard.png)
 
 ---
 
diff --git a/docs/assets/screenshots/01-connected-dashboard.png b/docs/assets/screenshots/01-connected-dashboard.png
index 3d1256e..3b0695a 100644
Binary files a/docs/assets/screenshots/01-connected-dashboard.png and b/docs/assets/screenshots/01-connected-dashboard.png differ
diff --git a/docs/assets/screenshots/04-public-repo-self-scan.png b/docs/assets/screenshots/04-public-repo-self-scan.png
index a9dfac8..1f9b840 100644
Binary files a/docs/assets/screenshots/04-public-repo-self-scan.png and b/docs/assets/screenshots/04-public-repo-self-scan.png differ
diff --git a/src/devsecops-sentinel-web/scripts/capture-screenshots.mjs b/src/devsecops-sentinel-web/scripts/capture-screenshots.mjs
index 757c610..38aac3a 100644
--- a/src/devsecops-sentinel-web/scripts/capture-screenshots.mjs
+++ b/src/devsecops-sentinel-web/scripts/capture-screenshots.mjs
@@ -97,6 +97,17 @@ async function main() {
     await page.getByRole('button', { name: 'AI advisor' }).click();
     await page.getByText('Advisory only').waitFor();
     await capture(page, '03-live-ai-safe-workflow.png');
+
+    // 4 — the scanner scanning its own repository through the public tab. The
+    // three findings that come back are the documented, test-enforced
+    // exceptions from RepositoryWorkflowsTests, which is the point of the
+    // image: the tool does not hide its own findings. Needs no key and spends
+    // nothing — the fetch is anonymous.
+    await page.getByRole('tab', { name: /Public repo/ }).click();
+    await page.getByLabel('Public repository').fill('bgard68/DevSecOpsSentinel');
+    await page.getByRole('button', { name: 'Scan public repository' }).click();
+    await page.getByText('ci.yml', { exact: true }).waitFor({ timeout: 60_000 });
+    await capture(page, '04-public-repo-self-scan.png');
   } finally {
     await browser.close();
   }