diff --git a/serving/fleet-manager/.env.example b/serving/fleet-manager/.env.example
index 4aed1ed..f38c08a 100644
--- a/serving/fleet-manager/.env.example
+++ b/serving/fleet-manager/.env.example
@@ -59,6 +59,9 @@ INFLUX_ADMIN_PASSWORD=changeme-influx-admin-password
 INFLUX_RETENTION=90d
 
 # --- misc ----------------------------------------------------------------------
+# CI image tag to run (from .gitea/workflows/fleet-manager-image.yaml): a release
+# semver, main-<sha7>, or a <branch>-<sha7> dev build. Defaults to :latest.
+FLEET_MANAGER_VERSION=latest
 FLEET_MGR_SESSION_TTL_MIN=720
 # Must match the enrol-broker's HOSTNQN_BASE.
 HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
diff --git a/serving/fleet-manager/docker-compose.yml b/serving/fleet-manager/docker-compose.yml
index a33b71a..bcb6b0e 100644
--- a/serving/fleet-manager/docker-compose.yml
+++ b/serving/fleet-manager/docker-compose.yml
@@ -56,9 +56,13 @@ services:
       retries: 5
 
   # --- the control plane + embedded SPA --------------------------------------
+  # CI builds + pushes this image (.gitea/workflows/fleet-manager-image.yaml);
+  # `docker compose pull` fetches it. `build: .` stays so local dev can still
+  # `docker compose build fleet-manager`. Pin FLEET_MANAGER_VERSION in .env to a
+  # CI tag (e.g. main-<sha7>); defaults to :latest.
   fleet-manager:
+    image: "git.bitasylum.org/audiobuzz/fleet-manager:${FLEET_MANAGER_VERSION:-latest}"
     build: .
-    image: fleet-manager:local
     restart: unless-stopped
     # Host networking: reach the broker on 127.0.0.1:9443 + InfluxDB on
     # 127.0.0.1:8086, and bind the agent gRPC listener on a routable mgmt addr.