diff --git a/couchdb/docker-compose.yml b/couchdb/docker-compose.yml
index 1bcbd82..18d084a 100644
--- a/couchdb/docker-compose.yml
+++ b/couchdb/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   couchserver:
-    image: couchdb
+    image: couchdb:3.5
     container_name: couchdb
     restart: always
     labels:
diff --git a/filebrowser-colleen-hd/docker-compose.yml b/filebrowser-colleen-hd/docker-compose.yml
index e96bd90..475c4a4 100644
--- a/filebrowser-colleen-hd/docker-compose.yml
+++ b/filebrowser-colleen-hd/docker-compose.yml
@@ -1,7 +1,10 @@
 services:
   filebrowser:
     container_name: filebrowser-colleen-hd
-    image: gtstef/filebrowser:beta
+    # No stable channel exists upstream for this project (only beta/preview
+    # tags are published) — pinned to the exact version in use instead of the
+    # floating :beta tag so watchtower can't silently jump versions.
+    image: gtstef/filebrowser:1.5.4-beta
     environment:
       FILEBROWSER_CONFIG: "data/config.yaml"
       TZ: "America/New_York"
diff --git a/statping/docker-compose.yml b/statping/docker-compose.yml
index f06b623..c3028a2 100644
--- a/statping/docker-compose.yml
+++ b/statping/docker-compose.yml
@@ -1,7 +1,11 @@
 services:
   statping:
     container_name: statping
-    image: statping/statping:dev
+    # statping upstream is abandoned (no pushes in 5+ years); pinned to the
+    # last tagged stable release instead of the floating :dev tag. Not
+    # currently deployed (no running container) — worth reconsidering
+    # whether this service is needed at all before ever starting it.
+    image: statping/statping:v0.90.74
     restart: always
     volumes:
       - /srv/statping-data:/app