diff --git a/documentation/docs/development/registry-server-images.md b/documentation/docs/development/registry-server-images.md
index c7ddf28..675eada 100644
--- a/documentation/docs/development/registry-server-images.md
+++ b/documentation/docs/development/registry-server-images.md
@@ -11,6 +11,14 @@ The `Publish Server Image` workflow builds the Python wheel, builds `python/Dock
 
 Both tags are produced from the same wheel artifact that the Dockerfile installs.
 
+## Base Image Pin
+
+Both Python Dockerfiles keep the readable `thehale/python-poetry` tag paired
+with an immutable digest. When upgrading that base, review the upstream image,
+resolve the new tag's digest, and update the tag and digest in
+`python/Dockerfile` and `python/Dockerfile-prod` together in the same reviewed
+change. Do not refresh the digest without an intentional base-image review.
+
 ## Release Compose Usage
 
 Release packaging uses `npm run prepare:production-server` to write
diff --git a/python/Dockerfile b/python/Dockerfile
index 48306ce..9075a41 100644
--- a/python/Dockerfile
+++ b/python/Dockerfile
@@ -1,4 +1,4 @@
-FROM thehale/python-poetry:2.1.3-py3.11-slim AS builder
+FROM thehale/python-poetry:2.1.3-py3.11-slim@sha256:4e091da0d71700b404a2844ac3bbd4aaa3450a6421c469935ae165d41252a964 AS builder
 
 ENV POETRY_NO_INTERACTION=1 \
     POETRY_VIRTUALENVS_IN_PROJECT=1 \
@@ -26,4 +26,4 @@ ENV VIRTUAL_ENV=/app/.venv \
 
 COPY ./ouroboros ./ouroboros
 
-ENTRYPOINT ["python", "-m", "ouroboros.docker_server"]
\ No newline at end of file
+ENTRYPOINT ["python", "-m", "ouroboros.docker_server"]
diff --git a/python/Dockerfile-prod b/python/Dockerfile-prod
index 04dceb6..8f26e9a 100644
--- a/python/Dockerfile-prod
+++ b/python/Dockerfile-prod
@@ -2,7 +2,7 @@
 
 # Assumes that dist/*.whl has been built
 
-FROM thehale/python-poetry:2.1.3-py3.11-slim AS python-base
+FROM thehale/python-poetry:2.1.3-py3.11-slim@sha256:4e091da0d71700b404a2844ac3bbd4aaa3450a6421c469935ae165d41252a964 AS python-base
 
 ENV DCONF_DISABLE_ASYNC=1
 
@@ -18,4 +18,4 @@ COPY ./dist/*.whl ./
 
 RUN pip install *.whl
 
-CMD ["ouroboros-docker-server"]
\ No newline at end of file
+CMD ["ouroboros-docker-server"]