diff --git a/docker-compose.yml b/docker-compose.yml
index afa96d8..55fff02 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -43,7 +43,7 @@ services:
       context: .
       dockerfile: Dockerfile
       target: nginx
-    image: ${STACK_NAME:-clupilot}/nginx:latest
+    image: ${STACK_NAME:-clupilot}/nginx:${APP_VERSION:-dev}
     container_name: ${STACK_NAME:-clupilot}-nginx
     restart: unless-stopped
     ports:
@@ -62,7 +62,7 @@ services:
 
   app:
     build: *php-build
-    image: ${STACK_NAME:-clupilot}/php:latest
+    image: ${STACK_NAME:-clupilot}/php:${APP_VERSION:-dev}
     container_name: ${STACK_NAME:-clupilot}-app
     restart: unless-stopped
     environment: *php-env
@@ -77,7 +77,7 @@ services:
 
   queue:
     build: *php-build
-    image: ${STACK_NAME:-clupilot}/php:latest
+    image: ${STACK_NAME:-clupilot}/php:${APP_VERSION:-dev}
     container_name: ${STACK_NAME:-clupilot}-queue
     restart: unless-stopped
     command: php artisan queue:work --tries=3 --timeout=120
@@ -95,7 +95,7 @@ services:
 
   scheduler:
     build: *php-build
-    image: ${STACK_NAME:-clupilot}/php:latest
+    image: ${STACK_NAME:-clupilot}/php:${APP_VERSION:-dev}
     container_name: ${STACK_NAME:-clupilot}-scheduler
     restart: unless-stopped
     command: php artisan schedule:work
@@ -111,7 +111,7 @@ services:
 
   reverb:
     build: *php-build
-    image: ${STACK_NAME:-clupilot}/php:latest
+    image: ${STACK_NAME:-clupilot}/php:${APP_VERSION:-dev}
     container_name: ${STACK_NAME:-clupilot}-reverb
     restart: unless-stopped
     command: php artisan reverb:start --host=0.0.0.0 --port=8080
@@ -126,7 +126,7 @@ services:
     networks: [clu]
 
   mysql:
-    image: mariadb:11
+    image: mariadb:${MARIADB_VERSION:-11.4}
     container_name: ${STACK_NAME:-clupilot}-mysql
     restart: unless-stopped
     environment:
@@ -145,7 +145,7 @@ services:
       start_period: 30s
 
   redis:
-    image: redis:7-alpine
+    image: redis:${REDIS_VERSION:-7.4-alpine}
     container_name: ${STACK_NAME:-clupilot}-redis
     restart: unless-stopped
     volumes:
diff --git a/stack.env.example b/stack.env.example
index efe73a6..68de1da 100644
--- a/stack.env.example
+++ b/stack.env.example
@@ -7,6 +7,14 @@ STACK_NAME=clupilot
 HTTP_PORT=80
 MAILPIT_UI_PORT=8025
 
+# ---- Version pins ----
+# Your own images: set per-deploy. Use Git tag (v1.2.3) or commit SHA for prod;
+# 'dev' is fine for dev stack (rebuilt on every push).
+APP_VERSION=dev
+# Service images: bump in lockstep across all stacks.
+MARIADB_VERSION=11.4
+REDIS_VERSION=7.4-alpine
+
 # ---- Laravel app ----
 APP_NAME=CluPilot
 APP_ENV=production