diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index cb77b95b..c3313de8 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -1,7 +1,6 @@
 name: Build and Push Docker Image
 on:
   push:
-    branches: [main]
     tags: ['v*']
 
 jobs:
diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index f0769ce1..9c86afa6 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -18,10 +18,10 @@ jobs:
         include:
           - name: fedi-feed-router-base
             file: docker/build/Dockerfile.base
-            version: php8.3-1
+            version: php8.3-2
           - name: fedi-feed-router-ci
             file: docker/build/Dockerfile.ci
-            version: php8.3-3
+            version: php8.3-4
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
@@ -43,5 +43,4 @@ jobs:
           push: true
           tags: |
             forge.lvl0.xyz/lvl0/${{ matrix.name }}:${{ matrix.version }}
-            forge.lvl0.xyz/lvl0/${{ matrix.name }}:latest
             forge.lvl0.xyz/lvl0/${{ matrix.name }}:${{ github.sha }}
diff --git a/Dockerfile b/Dockerfile
index 9ffd5eef..7281dfe0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Production Dockerfile - uses pre-built base image
-FROM forge.lvl0.xyz/lvl0/fedi-feed-router-base:latest
+FROM forge.lvl0.xyz/lvl0/fedi-feed-router-base:php8.3-2
 
 # Set working directory
 WORKDIR /app
diff --git a/docker/build/Dockerfile.base b/docker/build/Dockerfile.base
index e7280dbc..e4c79f4c 100644
--- a/docker/build/Dockerfile.base
+++ b/docker/build/Dockerfile.base
@@ -1,5 +1,5 @@
 # Base image with FrankenPHP, PHP extensions, Node, and Composer
-FROM dunglas/frankenphp:latest-php8.3-alpine
+FROM dunglas/frankenphp:1.12.7-php8.3.35-alpine
 
 # Install system dependencies
 RUN apk add --no-cache \
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index 50857a02..1c9dbdd1 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -1,6 +1,7 @@
 # Image for CI: PHP and Composer only, no runtime server or frontend toolchain.
-# Tests run against sqlite in memory (see .env.testing), so no database client
-# or cache extension is needed.
+# pdo_mysql is here for the MariaDB test database (#169); pdo_sqlite stays until
+# that switch lands. No CLI database client — PHPUnit reaches the database
+# through PDO and never shells out.
 #
 # Published as fedi-feed-router-ci:php<version>-<revision>, not :latest. Runners
 # cache mutable tags and will not re-pull them, so bump the revision in the tag
@@ -16,6 +17,7 @@ COPY --from=mlocati/php-extension-installer:2 /usr/bin/install-php-extensions /u
 
 RUN install-php-extensions \
     pdo_sqlite \
+    pdo_mysql \
     mbstring \
     dom \
     xml \