diff --git a/docker-compose.yaml b/docker-compose.yaml
index cd5c1ed..c5783d9 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -33,7 +33,7 @@ services:
   # Optional local dependency: whisper.cpp server for audio transcription.
   # Start with: docker compose --profile voice up -d whisper-server
   whisper-server:
-    image: ghcr.io/ggml-org/whisper.cpp:main
+    image: ghcr.io/ggml-org/whisper.cpp@sha256:3a39e86d5a0e911086b5cbebc9029cac71b02fbd08e217b775857de1490f55bf
     container_name: whisper-server
     restart: unless-stopped
     profiles: ["voice"]
@@ -72,7 +72,7 @@ services:
 
   # kokoro TTS
   kokoro-tts:
-    image: ghcr.io/remsky/kokoro-fastapi-cpu:latest
+    image: ghcr.io/remsky/kokoro-fastapi-cpu@sha256:c8812546d358cbfd6a5c4087a28795b2b001d8e32d7a322eedd246e6bc13cb55
     container_name: kokoro-tts
     profiles: ["voice"]
     ports:
@@ -96,7 +96,7 @@ services:
   # Optional local dependency: Brave Search MCP server (HTTP mode).
   # Start with: docker compose --profile search up -d brave-search
   brave-search:
-    image: mcp/brave-search:latest
+    image: mcp/brave-search@sha256:aea0b091da7029c35f0ed0964367328af0f2824477d79d2e85e43e7cd5a757d4
     container_name: brave-search
     restart: unless-stopped
     profiles: ["search"]
@@ -115,7 +115,7 @@ services:
   # Optional local dependency: SearXNG metasearch instance.
   # Start with: docker compose --profile search up -d searxng
   searxng:
-    image: searxng/searxng:latest
+    image: searxng/searxng@sha256:c5e5aedb70ec4b7ff5b1e8f8ea69253dceb85a98b8757360c1b65fe8652d6066
     container_name: searxng
     restart: unless-stopped
     profiles: ["search"]
@@ -134,7 +134,7 @@ services:
   # Optional local dependency: liteLLM proxy for unified LLM API.
   # Start with: docker compose --profile api up -d litellm
   litellm:
-    image: litellm/litellm:latest
+    image: litellm/litellm:v1.77.7
     container_name: litellm
     restart: unless-stopped
     profiles: ["api"]
@@ -178,7 +178,7 @@ services:
       agentmon.port: "18804"
 
   litellm-init:
-    image: curlimages/curl:latest
+    image: curlimages/curl@sha256:d94d07ba9e7d6de898b6d96c1a072f6f8266c687af78a74f380087a0addf5d17
     container_name: litellm-init
     profiles: ["api"]
     restart: "no"
@@ -221,7 +221,7 @@ services:
   # Dedicated local n8n instance for agent-oriented workflows.
   # Start with: docker compose --profile automation up -d n8n-agent
   n8n-agent:
-    image: docker.n8n.io/n8nio/n8n:latest
+    image: docker.n8n.io/n8nio/n8n:2.11.3
     container_name: n8n-agent
     restart: unless-stopped
     profiles: ["automation"]