diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 517d7a98..31d85e42 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -134,7 +134,7 @@ services:
   # created before the non-root ocr user was introduced in commit 1aca4c4a)
   # and guarantees /app/cache/.tmp exists for TMPDIR staging. See ADR-021.
   ocr-volume-init:
-    image: alpine:3
+    image: alpine:3.21
     command:
       - sh
       - -c
@@ -142,6 +142,7 @@ services:
     volumes:
       - ocr-models:/app/models
       - ocr-cache:/app/cache
+    networks: []
     restart: "no"
 
   ocr-service:
diff --git a/docker-compose.yml b/docker-compose.yml
index 7ebf907a..842f94e1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -77,7 +77,7 @@ services:
   # created before the non-root ocr user was introduced in commit 1aca4c4a)
   # and guarantees /app/cache/.tmp exists for TMPDIR staging. See ADR-021.
   ocr-volume-init:
-    image: alpine:3
+    image: alpine:3.21
     command:
       - sh
       - -c
@@ -85,6 +85,7 @@ services:
     volumes:
       - ocr_models:/app/models
       - ocr_cache:/app/cache
+    networks: []
     restart: "no"
 
   # --- OCR: Python microservice (Surya + Kraken) ---