diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 99e9fd0..8b1db41 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -11,8 +11,12 @@
 #     Traefik labels automatically; don't add them here.
 #   - All env values live in Coolify's Environment Variables panel.
 #     Compose only references them with ${VAR_NAME}.
-#   - Coolify will clone this repo, build the image once, and re-use it
-#     across all three services (saves disk + build time).
+#   - All three services PULL the same CI-built image from the Forgejo
+#     registry (repo.rahamafresh.com/fleet-platform). Coolify no longer builds
+#     from source here. REQUIRES: (1) a registry credential for
+#     repo.rahamafresh.com configured in Coolify so it can pull, and (2) the
+#     Forgejo build-push CI to have finished pushing :latest for this commit
+#     BEFORE you Redeploy — otherwise Coolify pulls the previous :latest.
 #   - `coolify` network is created by Coolify; we attach so containers can
 #     reach the TimescaleDB by service name.
 
@@ -37,8 +41,11 @@ networks:
 
 services:
   gateway:
-    build: .
-    image: fleet-platform:${COOLIFY_RESOURCE_UUID:-latest}
+    # Pull the CI-built image (Forgejo build-push bakes APP_GIT_SHA=github.sha)
+    # instead of building from source, so /health reports the real commit.
+    # Override FLEET_IMAGE in Coolify to pin/rollback to a specific :<sha>.
+    image: ${FLEET_IMAGE:-repo.rahamafresh.com/fleet-platform:latest}
+    pull_policy: always
     restart: unless-stopped
     networks:
       - default
@@ -48,7 +55,6 @@ services:
       APP_ROLE: gateway
       APP_MODE: prod
       APP_LOG_LEVEL: INFO
-      APP_GIT_SHA: ${SOURCE_COMMIT:-unknown}
       DATABASE_URL: ${DATABASE_URL}
       JWT_SECRET: ${JWT_SECRET}
       JWT_ACCESS_TTL_MIN: ${JWT_ACCESS_TTL_MIN:-15}
@@ -67,7 +73,8 @@ services:
       start_period: 10s
 
   worker:
-    image: fleet-platform:${COOLIFY_RESOURCE_UUID:-latest}
+    image: ${FLEET_IMAGE:-repo.rahamafresh.com/fleet-platform:latest}
+    pull_policy: always
     restart: unless-stopped
     depends_on:
       gateway:
@@ -79,7 +86,6 @@ services:
       APP_ROLE: worker
       APP_MODE: prod
       APP_LOG_LEVEL: INFO
-      APP_GIT_SHA: ${SOURCE_COMMIT:-unknown}
       DATABASE_URL: ${DATABASE_URL}
       JWT_SECRET: ${JWT_SECRET}
       TRACKSOLID_API_BASE_URL: ${TRACKSOLID_API_BASE_URL}
@@ -93,7 +99,8 @@ services:
       start_period: 10s
 
   cron:
-    image: fleet-platform:${COOLIFY_RESOURCE_UUID:-latest}
+    image: ${FLEET_IMAGE:-repo.rahamafresh.com/fleet-platform:latest}
+    pull_policy: always
     restart: unless-stopped
     depends_on:
       gateway:
@@ -105,7 +112,6 @@ services:
       APP_ROLE: cron
       APP_MODE: prod
       APP_LOG_LEVEL: INFO
-      APP_GIT_SHA: ${SOURCE_COMMIT:-unknown}
       DATABASE_URL: ${DATABASE_URL}
       JWT_SECRET: ${JWT_SECRET}
       TRACKSOLID_API_BASE_URL: ${TRACKSOLID_API_BASE_URL}