diff --git a/docker-compose.yaml b/docker-compose.yaml
index 91f730d..7436bc5 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -35,7 +35,7 @@ services:
   #   - ggml-medium.bin for the CPU server
   #   - ggml-small.bin  for the GPU server (small fits in the limited VRAM left after gemma)
   whisper-init:
-    image: ghcr.io/ggml-org/whisper.cpp:main
+    image: ghcr.io/ggml-org/whisper.cpp@sha256:672650b5e67f9cb86af7ac6e09dea8eac12a024086e1e5c0172fdccf336aba09
     container_name: whisper-init
     profiles: ["voice"]
     restart: "no"
@@ -120,7 +120,7 @@ services:
   # ~14 s per short clip (medium-on-CPU is 90x slower than small-on-GPU above).
   # Start with: docker compose --profile voice up -d whisper-server
   whisper-server:
-    image: ghcr.io/ggml-org/whisper.cpp:main
+    image: ghcr.io/ggml-org/whisper.cpp@sha256:672650b5e67f9cb86af7ac6e09dea8eac12a024086e1e5c0172fdccf336aba09
     container_name: whisper-server
     restart: unless-stopped
     profiles: ["voice"]
diff --git a/swarm-common/docker-compose.yaml b/swarm-common/docker-compose.yaml
index 10f2d9b..aac2741 100644
--- a/swarm-common/docker-compose.yaml
+++ b/swarm-common/docker-compose.yaml
@@ -33,7 +33,7 @@ services:
   # Optional local dependency: whisper.cpp server for audio transcription.
   # Start with: docker compose --profile voice up -d whisper-server
   whisper-server:
-    image: ghcr.io/ggml-org/whisper.cpp:main
+    image: ghcr.io/ggml-org/whisper.cpp@sha256:672650b5e67f9cb86af7ac6e09dea8eac12a024086e1e5c0172fdccf336aba09
     container_name: whisper-server
     restart: unless-stopped
     profiles: ["voice"]