diff --git a/serving/fleet-manager/DEPLOY.md b/serving/fleet-manager/DEPLOY.md
index 2ae465f..f606336 100644
--- a/serving/fleet-manager/DEPLOY.md
+++ b/serving/fleet-manager/DEPLOY.md
@@ -151,7 +151,8 @@ also keeps the WebAuthn secure-context clean.
 
 > **Self-TLS alternative (no Traefik):** set `FLEET_MGR_ADMIN_BEHIND_PROXY=false`
 > and give the manager a cert at `/pki/admin/{fullchain,privkey}.pem` (e.g. via the
-> `acme/renew-loop.sh` helper under a `goacme/lego` container). The manager then
+> `acme/renew-loop.sh` helper under a `harbor.bitasylum.org/dockerhub/goacme/lego`
+> container). The manager then
 > terminates TLS itself and the origin includes the port it listens on.
 
 <a name="network-paths"></a>
@@ -251,7 +252,7 @@ If you run compose under a non-default project name, pass
   once:
   ```bash
   docker volume ls | grep fleet          # find the name, e.g. fleet-manager_fleet-data
-  docker run --rm -v <vol>:/data alpine chown -R 65532:65532 /data
+  docker run --rm -v <vol>:/data harbor.bitasylum.org/dockerhub/library/alpine:3.20 chown -R 65532:65532 /data
   ```
 - **`authorise plane not configured (no enrol-broker wired)` in the SPA** — the
   manager has the pillar disabled (`s.broker == nil`). Check
diff --git a/serving/fleet-manager/acme/renew-loop.sh b/serving/fleet-manager/acme/renew-loop.sh
index b74843e..453685e 100755
--- a/serving/fleet-manager/acme/renew-loop.sh
+++ b/serving/fleet-manager/acme/renew-loop.sh
@@ -4,7 +4,8 @@
 # NOTE: the default deployment fronts the admin UI with Traefik (docker-compose.yml),
 # which owns ACME itself — this script is NOT used then. It remains as the cert
 # helper for the SELF-TLS admin mode (FLEET_MGR_ADMIN_BEHIND_PROXY=false, no
-# Traefik): run it under a `goacme/lego` container to write ./pki/admin/.
+# Traefik): run it under a harbor.bitasylum.org/dockerhub/goacme/lego container to
+# write ./pki/admin/.
 #
 # Runs inside the goacme/lego image (alpine-based). Obtains the fleet-manager
 # admin-UI cert from Let's Encrypt via DNS-01 over AWS Route 53, and writes it
diff --git a/serving/fleet-manager/backup.sh b/serving/fleet-manager/backup.sh
index f992082..a78363f 100755
--- a/serving/fleet-manager/backup.sh
+++ b/serving/fleet-manager/backup.sh
@@ -14,7 +14,8 @@
 #   COMPOSE_PROJECT_NAME=foo ./backup.sh   # if you run compose under another project
 #
 # Restore (manager stopped):
-#   docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src alpine \
+#   docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src \
+#     harbor.bitasylum.org/dockerhub/library/alpine:3.20 \
 #     sh -c 'rm -rf /dest/* && tar xzf /src/fleet-data-YYYYmmdd-HHMMSS.tar.gz -C /dest'
 set -euo pipefail
 
@@ -22,6 +23,8 @@ DEST=${1:-./backups}
 PROJECT=${COMPOSE_PROJECT_NAME:-fleet-manager}   # compose derives volume names as <project>_<key>
 STAMP=$(date -u +%Y%m%d-%H%M%S)
 VOLUMES=${BACKUP_VOLUMES:-"fleet-data influx-data"}
+# Non-CI images pull through the Harbor mirror; overridable for other registries.
+ALPINE_IMAGE=${ALPINE_IMAGE:-harbor.bitasylum.org/dockerhub/library/alpine:3.20}
 
 mkdir -p "$DEST"
 DEST_ABS=$(cd "$DEST" && pwd)
@@ -37,7 +40,7 @@ for key in $VOLUMES; do
     docker run --rm \
         -v "${vol}:/src:ro" \
         -v "${DEST_ABS}:/backup" \
-        alpine tar czf "/backup/${out}" -C /src .
+        "$ALPINE_IMAGE" tar czf "/backup/${out}" -C /src .
 done
 
 # Retention: keep the newest $KEEP of each volume's tarballs (0 = keep all).