diff --git a/ci/cos-bootstrap-contract.sh b/ci/cos-bootstrap-contract.sh
index 1b87b41..adf8219 100755
--- a/ci/cos-bootstrap-contract.sh
+++ b/ci/cos-bootstrap-contract.sh
@@ -17,10 +17,18 @@ mkdir -p "$BIN_DIR" "$CLOUD_HOME" "$DATA_DIR" "$DOCKER_CONFIG_DIR"
 
 # Static trust contract: the build environment is an immutable multi-platform
 # image, and the GNU Make archive is verified before any extraction occurs.
-if ! grep -Eq '^ALPINE_BUILD_IMAGE="alpine:3\.22@sha256:[0-9a-f]{64}"$' "$INSTALLER"; then
+if ! grep -Fqx 'ALPINE_BUILD_IMAGE="alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"' "$INSTALLER"; then
     echo "COS bootstrap Alpine image is not digest pinned" >&2
     exit 1
 fi
+grep -Fq '"${alpine_mirror}/v3.22/main"' "$INSTALLER" || {
+    echo "COS bootstrap Alpine main repository does not match the pinned image release" >&2
+    exit 1
+}
+grep -Fq '"${alpine_mirror}/v3.22/community"' "$INSTALLER" || {
+    echo "COS bootstrap Alpine community repository does not match the pinned image release" >&2
+    exit 1
+}
 # Assert the literal command in the bootstrap script.
 # shellcheck disable=SC2016
 if ! grep -Fq 'echo "${MAKE_SHA256}  /tmp/make.tar.gz" | sha256sum -c -' "$INSTALLER"; then
@@ -154,7 +162,7 @@ PATH="${BIN_DIR}:$PATH" \
 
 grep -Fq "plugin:${DOCKER_CONFIG_DIR}/cli-plugins:${CLOUD_HOME}/install-docker-plugins.sh" "$CALL_LOG"
 grep -Fq "plugin:${CLOUD_HOME}/.docker/cli-plugins:${CLOUD_HOME}/install-docker-plugins.sh" "$CALL_LOG"
-grep -Eq 'docker: .*alpine:3\.22@sha256:[0-9a-f]{64}' "$CALL_LOG"
+grep -Fq 'alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce' "$CALL_LOG"
 [[ -x "${DATA_DIR}/make" ]]
 "${DATA_DIR}/make" --version | grep -Fq 'GNU Make 4.4.1'
 [[ -f "${DATA_DIR}/make.state" ]]
diff --git a/docs/Dockerfile b/docs/Dockerfile
index 5011d6f..f19dc39 100644
--- a/docs/Dockerfile
+++ b/docs/Dockerfile
@@ -3,8 +3,8 @@ FROM python:3.14-alpine3.22@sha256:6b91e66ab2a880ce9ca5a1b91c70f45963ff71ff68268
 WORKDIR /work
 
 RUN apk add --no-cache git && \
-    pip install uv==0.11.28 && \
-    uv pip install --break-system-packages --system zensical==0.0.46
+    pip install uv==0.11.29 && \
+    uv pip install --break-system-packages --system zensical==0.0.50
 
 EXPOSE 8080
 
diff --git a/docs/non-gcp-providers.md b/docs/non-gcp-providers.md
index ce271d3..40622f9 100644
--- a/docs/non-gcp-providers.md
+++ b/docs/non-gcp-providers.md
@@ -22,12 +22,12 @@ root retains its historical `module.gcp[0]` address and now loads only GCP-
 related providers. A GCP caller can move to `providers/gcp` later, but that is a
 separate state refactor and is not required to remove DigitalOcean or Linode.
 
-DigitalOcean and Linode callers must change the module source at 2.0.0 while
+DigitalOcean and Linode callers must change the module source at 1.3.0 while
 keeping the caller's module block name unchanged. For example:
 
 ```hcl
 module "site" {
-  source = "github.com/libops/cloud-compose//providers/do?ref=2.0.0"
+  source = "github.com/libops/cloud-compose//providers/do?ref=1.3.0"
 
   # Keep the existing name, template, digitalocean, and runtime values.
 }
@@ -42,7 +42,7 @@ The Linode equivalent is:
 
 ```hcl
 module "site" {
-  source = "github.com/libops/cloud-compose//providers/linode?ref=2.0.0"
+  source = "github.com/libops/cloud-compose//providers/linode?ref=1.3.0"
 
   # Keep the existing name, template, linode, and runtime values.
 }
diff --git a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
index bf01f6e..21579cc 100644
--- a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
+++ b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
@@ -40,7 +40,7 @@ services:
       - /mnt/disks/data/docker/:/var/lib/docker:ro
       - /dev/disk/:/dev/disk:ro
   cap:
-    image: ghcr.io/libops/cap:main@sha256:13959cc4c78dec2ffff0c4c45d05d85587d08dc50c0cc40cb6088c4ead381ad4
+    image: ghcr.io/libops/cap:main@sha256:c9d6a6c2ded2d0a72ceff382fd71da9cd161c17c071319b45270b07c0f54a5ed
     command: ["/app/binary"]
     networks:
       - internal