diff --git a/install.sh b/install.sh
index ad2118e..48213a7 100755
--- a/install.sh
+++ b/install.sh
@@ -253,6 +253,18 @@ info "Secrets ok; Proxy/URL aus APP_DOMAIN abgeleitet; Zeitzone ${HOST_TZ}"
 # ── [4/9] image ──────────────────────────────────────────────────────
 phase 4/9 "Image bauen"
 set_stage build
+# Public installs pull the exact promoted image named in release-images.lock; the dev/source tree
+# builds; staging respects the env-provided pin. The helper only reads + exports — persist the pin
+# to .env with force_kv so later `$COMPOSE up/migrate` and any manual compose call use it too.
+# shellcheck source=scripts/release-images.sh disable=SC1091
+. ./scripts/release-images.sh
+clusev_resolve_release_images "release-images.lock" "$ENV_FILE"
+case "${CLUSEV_RELEASE_MODE:-build}" in
+  env)  info "Image aus Umgebung vorgegeben (Pull)" ;;
+  pull) force_kv CLUSEV_IMAGE "$CLUSEV_IMAGE"; force_kv CLUSEV_TERMINAL_IMAGE "$CLUSEV_TERMINAL_IMAGE"
+        info "Release-Images aus release-images.lock (Pull statt Build)" ;;
+  *)    : ;;
+esac
 if [ "${CLUSEV_PULL:-0}" = "1" ]; then $COMPOSE pull; else $COMPOSE build; fi
 info "Image bereit"