diff --git a/docs/architecture.md b/docs/architecture.md
index 22d7da1..ffe0b99 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -145,7 +145,7 @@ API, which the supervisor does not do.
 
 ## Build, chart and licence invariants
 
-**The Vector version has one source.** The constant `VECTOR_VERSION` in `src/deployment.rs` is substituted into the Dockerfile's `ARG VECTOR_VERSION`, and both `VectorConfig::default()` and the contract's `default_config` read it for `vector.version`. `version_check: strict` refuses to start a pod when the config's version and the binary's disagree, so a deployment that sets `vector.version` itself has to move it with the image.
+**The Vector version has one source.** The constant `VECTOR_VERSION` in `src/deployment.rs` is substituted into the Dockerfile's `ARG VECTOR_VERSION`, and both `VectorConfig::default()` and the contract's `default_config` read it for `vector.version`. `version_check: strict` refuses to start a pod when the config's version and the binary's disagree, so a deployment that sets `vector.version` itself has to move it with the image. dfe-infra's `versions.yaml` records the same release as `services.vector`, and dfe-fetcher's container Vector extractor runs that image.
 
 **`password` is a `String` on purpose, not a `SensitiveString`.** The config
 goes through a figment serialize-merge-deserialize round trip in
diff --git a/docs/internals.md b/docs/internals.md
index 2588872..d64ada9 100644
--- a/docs/internals.md
+++ b/docs/internals.md
@@ -634,6 +634,9 @@ ENTRYPOINT ["dfe-transform-vector"]
    pin. Do NOT edit the Dockerfile: it is autogenerated, and
    `checked_in_dockerfile_matches_emit_dockerfile` fails if it drifts.
 2. Regenerate: `cargo run -- emit-dockerfile > Dockerfile`
+   Then move `services.vector` in dfe-infra's `versions.yaml` to the same
+   release (its tag is `<version>-alpine`). dfe-fetcher's container Vector
+   extractor runs that image, so the two must name one release.
 3. Rebuild image — only the vector and runtime stages rebuild (layer cache)
 4. CI runs integration tests against the new Vector version
 5. Deploy