diff --git a/.github/workflows/mcp-publish.yml b/.github/workflows/mcp-publish.yml
index 32f38d5..2355150 100644
--- a/.github/workflows/mcp-publish.yml
+++ b/.github/workflows/mcp-publish.yml
@@ -94,7 +94,7 @@ jobs:
             PACKAGE=${{ matrix.package }}
           tags: |
             ghcr.io/ferrlabs/${{ matrix.image }}:${{ steps.ver.outputs.version }}
-            ghcr.io/ferrlabs/${{ matrix.image }}:latest
+            ${{ github.event_name == 'release' && format('ghcr.io/ferrlabs/{0}:latest', matrix.image) || '' }}
           labels: |
             org.opencontainers.image.source=https://github.com/FerrLabs/FerrLens
             org.opencontainers.image.version=${{ steps.ver.outputs.version }}
diff --git a/mcp/Dockerfile b/mcp/Dockerfile
index 9dbff20..1e2f99c 100644
--- a/mcp/Dockerfile
+++ b/mcp/Dockerfile
@@ -1,6 +1,6 @@
 ARG PACKAGE=@ferrlens/mcp
 
-FROM node:24-alpine AS build
+FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
 ARG PACKAGE
 WORKDIR /app
 ENV HUSKY=0 \
@@ -13,7 +13,7 @@ RUN pnpm install --frozen-lockfile --offline
 RUN pnpm run build
 RUN pnpm --filter "${PACKAGE}" deploy --prod --legacy /out
 
-FROM node:24-alpine
+FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 WORKDIR /app
 ENV NODE_ENV=production \
     FERRLABS_MCP_MODE=http \