diff --git a/docker-compose.yml b/docker-compose.yml
index 738318b6..a3ed5477 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,11 +3,11 @@
 #   Up:   pnpm e2e:minio:up        Down: pnpm e2e:minio:down
 # Env is injected from local-dev/.env.minio by the pnpm scripts (dotenv-cli).
 # Images are pinned by digest for reproducibility — the exact versions the
-# upload-validation gate was verified against. To bump: pull :latest, then
-# `docker image inspect minio/minio:latest --format '{{index .RepoDigests 0}}'`.
+# upload-validation gate was verified against. To bump: pull the newest tag from
+# quay.io, then `docker image inspect quay.io/minio/minio:<tag> --format '{{index .RepoDigests 0}}'`.
 services:
     minio:
-        image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+        image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
         command: server /data --console-address ":9001"
         ports:
             # Host ports default to 9100/9101 (the upup-reserved pair — validate-env.mjs
@@ -26,7 +26,7 @@ services:
             - upup-minio-data:/data
 
     minio-setup:
-        image: minio/mc@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
+        image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
         depends_on:
             - minio
         environment: