diff --git a/stacklets/infra/Dockerfile b/stacklets/infra/Dockerfile
index e6efaf39..afd7d517 100644
--- a/stacklets/infra/Dockerfile
+++ b/stacklets/infra/Dockerfile
@@ -8,13 +8,17 @@
 # The hetzner module is v2, which talks to the Hetzner Cloud API. v1 used
 # the DNS Console API, which Hetzner has deprecated.
 #
-# Pinned to the Caddy 2.10 line. Every subdomain reusing the wildcard
-# certificate needs 2.10 or later.
+# Pinned to the Caddy 2.11 line. Every subdomain reusing the wildcard
+# certificate needs 2.10 or later, and hetzner v2 requires 2.11.2.
+#
+# The plugins are pinned too. Unpinned, xcaddy takes each plugin's newest
+# release, and one that requires a newer Caddy breaks the build for every
+# install: hetzner v2.0.0 did that to the 2.10 image.
 
-FROM caddy:2.10-builder AS builder
+FROM caddy:2.11-builder AS builder
 RUN xcaddy build \
-    --with github.com/caddy-dns/hetzner/v2 \
-    --with github.com/caddy-dns/cloudflare
+    --with github.com/caddy-dns/hetzner/v2@v2.0.1 \
+    --with github.com/caddy-dns/cloudflare@v0.2.4
 
-FROM caddy:2.10
+FROM caddy:2.11
 COPY --from=builder /usr/bin/caddy /usr/bin/caddy