diff --git a/Dockerfile b/Dockerfile
index b6fc41b..98a5cf3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:1.28-alpine
+FROM git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64
 
 ARG COMMIT_ID=unknown
 
diff --git a/README.md b/README.md
index 16eb8aa..1c022de 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Git commit used to build the published container.
 ## Run it
 
 ```sh
-docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.1
+docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.2
 ```
 
 Open <http://localhost:8080>. The health endpoint is available at
@@ -32,6 +32,10 @@ The Gitea Actions workflow publishes the following tags for `v1.2.3`:
 The workflow publishes `linux/amd64` images to
 `git.mancheff.com/hiyv-demo/hiyv-nginx`.
 
+The pinned upstream nginx base is mirrored at
+`git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64` so the self-hosted
+runner does not depend on Docker Hub connectivity during releases.
+
 The repository must define two Actions secrets: `REGISTRY_USERNAME` with the
 Gitea username and `REGISTRY_TOKEN` with a personal access token that has
 package write access. Gitea's automatic job token cannot currently publish OCI