diff --git a/serving/dot1x-bench/docker-compose.yml b/serving/dot1x-bench/docker-compose.yml
index 75a8a59..35710ed 100644
--- a/serving/dot1x-bench/docker-compose.yml
+++ b/serving/dot1x-bench/docker-compose.yml
@@ -15,7 +15,7 @@
 services:
   # --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
   step-ca:
-    image: smallstep/step-ca:latest
+    image: harbor.bitasylum.org/dockerhub/smallstep/step-ca:latest
     network_mode: host
     restart: unless-stopped
     environment:
@@ -38,7 +38,7 @@ services:
 
   # --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
   freeradius:
-    image: freeradius/freeradius-server:latest
+    image: harbor.bitasylum.org/dockerhub/freeradius/freeradius-server:latest
     network_mode: host                    # RADIUS 1812/1813 from the authenticator
     restart: unless-stopped
     depends_on:
diff --git a/serving/enrol-broker/Dockerfile b/serving/enrol-broker/Dockerfile
index 3fa19dd..10fc591 100644
--- a/serving/enrol-broker/Dockerfile
+++ b/serving/enrol-broker/Dockerfile
@@ -7,14 +7,14 @@
 #
 # Pin + mirror these base tags through your registry (like the rest of the stack)
 # if the build/serving host has no egress.
-FROM golang:1.23-alpine AS build
+FROM harbor.bitasylum.org/dockerhub/library/golang:1.23-alpine AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go wordlist.txt ./
 ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local
 RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker .
 
-FROM smallstep/step-cli:latest
+FROM harbor.bitasylum.org/dockerhub/smallstep/step-cli:latest
 COPY --from=build /enrol-broker /usr/local/bin/enrol-broker
 # Non-root by default (the step-cli image runs as uid 1000 "step"); the broker
 # binds loopback ports >1024 and only READS the mounted CA root + provisioner