diff --git a/sonarscan-dotnet/README.md b/sonarscan-dotnet/README.md
index d5412b8..a73ea3c 100644
--- a/sonarscan-dotnet/README.md
+++ b/sonarscan-dotnet/README.md
@@ -26,7 +26,8 @@ It:
 - `dotnet-version`: .NET SDK version used when not using global.json
 - `dotnet-tool-restore`: Runs `dotnet tool restore` when true
 - `java-distribution`: Java distribution used by SonarScanner (e.g. zulu, temurin, microsoft) (Default: zulu)
-- `java-version`: Java version used by SonarScanner
+- `java-version`: Java version installed for SonarScanner (Default: 21)
+- `skip-jre-provisioning`: Stops SonarScanner downloading its own JRE (Default: false)
 - `sonarcloud-project-key`: SonarCloud project key
 - `sonarcloud-organisation`: SonarCloud organisation (Default: dfe-digital)
 - `sonarcloud-token`: SonarCloud authentication token
@@ -89,6 +90,38 @@ with:
   build-command: dotnet build YourSolution.sln --no-restore --no-incremental
 ```
 
+---
+
+## Java and JRE provisioning
+
+SonarScanner for .NET runs the analysis itself in a Java "scanner engine" during the
+`end` step. By default this action lets the scanner download the JRE that SonarQube Cloud
+currently requires, so the Java version tracks the server automatically.
+
+SonarQube Cloud raises its minimum Java version from time to time. When it does, a pinned
+local JDK below the new minimum causes the engine to fail on startup, which surfaces as an
+unhelpful error rather than a version message:
+
+```
+Unhandled exception. System.IO.IOException: Pipe is broken.
+   at SonarScanner.MSBuild.Shim.SonarEngineWrapper.Execute(...)
+##[error]Process completed with exit code 134
+```
+
+Set `skip-jre-provisioning: true` only on runners that cannot reach the JRE download. If
+you do, you own the Java version, and `java-version` must be at or above Sonar's current
+minimum:
+
+```yaml
+- name: SonarCloud scan
+  uses: DFE-Digital/github-actions/sonarscan-dotnet@master
+  with:
+    sonarcloud-project-key: your_project_key
+    sonarcloud-token: ${{ secrets.SONAR_TOKEN }}
+    skip-jre-provisioning: true
+    java-version: 21
+```
+
 ## Dependabot and SONAR_TOKEN
 
 SonarCloud analysis requires a valid `SONAR_TOKEN` to publish results.
diff --git a/sonarscan-dotnet/action.yaml b/sonarscan-dotnet/action.yaml
index 15cfcba..be503a8 100644
--- a/sonarscan-dotnet/action.yaml
+++ b/sonarscan-dotnet/action.yaml
@@ -32,9 +32,11 @@ inputs:
     default: "zulu"
 
   java-version:
-    description: "Java version used by SonarScanner."
+    description: >
+      Java version installed for SonarScanner. The scanner engine runs on it when
+      skip-jre-provisioning is true; otherwise the scanner provisions its own JRE.
     required: false
-    default: "17"
+    default: "21"
 
   sonarcloud-project-key:
     description: "SonarCloud project key."
@@ -54,6 +56,15 @@ inputs:
     required: false
     default: "https://sonarcloud.io"
 
+  skip-jre-provisioning:
+    description: >
+      If true, SonarScanner will not download its own JRE and will run on the JDK installed
+      by this action (see java-version). Set this only on runners that cannot reach the
+      SonarQube Cloud JRE download, and keep java-version at or above the version Sonar
+      currently requires.
+    required: false
+    default: "false"
+
   sonarscan-args:
     description: "Additional SonarScanner arguments."
     required: false
@@ -124,6 +135,12 @@ runs:
           COVERAGE_ARG=""
         fi
 
+        if [ "${{ inputs.skip-jre-provisioning }}" = "true" ]; then
+          JRE_ARG="/d:sonar.scanner.skipJreProvisioning=true"
+        else
+          JRE_ARG=""
+        fi
+
         dotnet tool run dotnet-sonarscanner begin \
           /o:"${{ inputs.sonarcloud-organisation }}" \
           /k:"${{ inputs.sonarcloud-project-key }}" \
@@ -131,7 +148,7 @@ runs:
           /d:sonar.token="$TOKEN" \
           ${COVERAGE_ARG} \
           /d:sonar.coverage.exclusions="${{ inputs.coverage-exclusions }}" \
-          /d:sonar.scanner.skipJreProvisioning=true \
+          ${JRE_ARG} \
           ${{ inputs.sonarscan-args }}
 
     - name: Build