diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 539e9f84..1fdbd6c5 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -77,7 +77,8 @@ services:
   # Runs once per `docker compose up` and exits 0; `--ignore-existing` and
   # the user-add fallback are safe on re-deploy.
   create-buckets:
-    image: minio/mc
+    # Pinned mc client release for reproducibility; Renovate keeps it current.
+    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
     depends_on:
       minio:
         condition: service_healthy