diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 25c7856b..539e9f84 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -100,7 +100,8 @@ services:
   # Dev-only mail catcher; gated behind the staging profile so production
   # never starts it. Staging workflow runs with `--profile staging`.
   mailpit:
-    image: axllent/mailpit:latest
+    # Pinned for reproducibility; Renovate bumps the tag.
+    image: axllent/mailpit:v1.29.7
     restart: unless-stopped
     profiles: ["staging"]
     networks: