diff --git a/.github/workflows/docker-sync.yml b/.github/workflows/docker-sync.yml
index 4d9033e5..863e2aa5 100644
--- a/.github/workflows/docker-sync.yml
+++ b/.github/workflows/docker-sync.yml
@@ -40,7 +40,7 @@ jobs:
   # reaches users.
   #
   # Ubuntu only, and separate from the Rust and Node matrices, because it needs
-  # Docker for MinIO and a POSIX env-var prefix in the package script.
+  # Docker for the S3 test server.
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -62,7 +62,7 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Publishes MinIO on 8987, which is the port test/test-env.ts pins.
+      # Publishes the S3 test server on 8987, the port test/test-env.ts pins.
       - name: Start test storage
         run: docker compose -f donut-sync/docker-compose.yml up -d --wait
 
diff --git a/AGENTS.md b/AGENTS.md
index 27e196a9..8d39ba31 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -136,7 +136,7 @@ suite passes:
 | REST API/OpenAPI, MCP, cloud/update contracts, team locks, real-time synchronizer | `pnpm e2e:integrations` |
 | Sync client/server, manifests, timestamps, deletion, encryption, password rollover | `pnpm e2e:sync` |
 | Wayfern download/terms/fingerprint, browser runner, CDP, automation endpoints, process cleanup | `pnpm e2e:browser` |
-| `donut-sync/` server code (controllers, services, auth, S3 endpoints) | `pnpm --filter donut-sync test:e2e` against a local MinIO |
+| `donut-sync/` server code (controllers, services, auth, S3 endpoints) | `pnpm --filter donut-sync test:e2e` against the compose S3 server |
 | E2E harness, WebDriver plugin/driver, app isolation hooks, or changes spanning multiple rows | Run every affected row; use `pnpm e2e` for cross-cutting changes |
 
 `e2e:browser` requires `WAYFERN_TEST_TOKEN` in the environment or local `.env`. `e2e:network`
@@ -147,17 +147,14 @@ Keep failed artifacts and inspect the per-session app/driver logs and screenshot
 assertions.
 
 The `donut-sync` row is the one suite the root `pnpm test` does not cover (`test:sync-e2e` runs
-the Rust sync harness only). It needs a MinIO on port 8987:
+the Rust sync harness only). It needs the S3 server in `donut-sync/docker-compose.yml`
+(`rclone serve s3` on port 8987; MinIO no longer publishes community images or binaries).
+`test/test-env.ts` supplies the matching keys:
 
 ```bash
-docker run -d --rm --name minio -p 8987:9000 \
-  -e MINIO_ROOT_USER=minioadmin -e MINIO_ROOT_PASSWORD=minioadmin \
-  quay.io/minio/minio:latest server /data
-SYNC_TOKEN=test-sync-token S3_ENDPOINT=http://127.0.0.1:8987 \
-  S3_ACCESS_KEY_ID=minioadmin S3_SECRET_ACCESS_KEY=minioadmin \
-  S3_BUCKET=donut-sync-test S3_FORCE_PATH_STYLE=true \
-  pnpm --filter donut-sync test:e2e
-docker rm -f minio
+docker compose -f donut-sync/docker-compose.yml up -d --wait
+pnpm --filter donut-sync test:e2e
+docker compose -f donut-sync/docker-compose.yml down -v
 ```
 
 When adding a Tauri command, assign it exactly once in `e2e/coverage-map.mjs` and add executable
diff --git a/donut-sync/docker-compose.yml b/donut-sync/docker-compose.yml
index 71c67865..3b8c7763 100644
--- a/donut-sync/docker-compose.yml
+++ b/donut-sync/docker-compose.yml
@@ -1,7 +1,7 @@
-# Storage for developing and testing donut-sync itself. It runs MinIO only, and
-# the sync server is expected to run on the host beside it (`pnpm start:dev`),
-# which is why MinIO is published and why the port matches the one pinned in
-# test/test-env.ts.
+# Storage for developing and testing donut-sync itself. It runs an S3 server
+# only, and the sync server is expected to run on the host beside it
+# (`pnpm start:dev`), which is why the port is published and matches the one
+# pinned in test/test-env.ts.
 #
 # This is NOT the self-hosting compose file. That one runs donut-sync in a
 # container too, and it must set S3_PUBLIC_ENDPOINT, because a server that signs
@@ -10,24 +10,31 @@
 # Take the self-hosting compose from https://donutbrowser.com/docs/self-hosting
 # rather than from here.
 services:
-  minio:
-    # quay.io, not Docker Hub: the `minio/minio` Hub repository no longer serves
-    # anonymous pulls, so a Hub reference fails CI with "pull access denied".
-    image: quay.io/minio/minio:latest
+  s3:
+    # rclone, not MinIO: MinIO withdrew its community images (quay.io now
+    # answers 401 and Docker Hub denies the pull) as well as its binaries.
+    # `rclone serve s3` is what scripts/sync-test-harness.mjs uses too.
+    image: rclone/rclone:latest
     ports:
       - "8987:9000"
-      - "8988:9001"
-    environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
-    command: server /data --console-address ":9001"
+    command:
+      - serve
+      - s3
+      - /data
+      - --addr
+      - :9000
+      - --auth-key
+      - minioadmin,minioadmin
+      - --force-path-style
+      - --vfs-cache-mode
+      - writes
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
-      interval: 5s
+      test: ["CMD", "nc", "-z", "127.0.0.1", "9000"]
+      interval: 2s
       timeout: 5s
-      retries: 5
+      retries: 15
     volumes:
-      - minio_data:/data
+      - s3_data:/data
 
 volumes:
-  minio_data:
+  s3_data: