diff --git a/ipabusedb-docker-reporter/Dockerfile b/ipabusedb-docker-reporter/Dockerfile
index 55e46d7..9dd6384 100644
--- a/ipabusedb-docker-reporter/Dockerfile
+++ b/ipabusedb-docker-reporter/Dockerfile
@@ -12,14 +12,16 @@
 #     -e DOCKER_CONTAINER_NAME=sshd \
 #     -e IPABUSEDB_API_KEY=... \
 #     -e INTERVAL=1200 \
-#     ipabusedb-docker-reporter
+#     git.eeqj.de/sneak/ipabusedb-docker-reporter:latest
 
 FROM git.eeqj.de/sneak/baseimage:2026-11-05
 
 # The reporter shells out to "docker logs", so it needs the docker CLI.
 # The static binary from the official CLI image avoids pulling the whole
-# docker.io package (and daemon) in via apt.
-COPY --from=docker:cli /usr/local/bin/docker /usr/local/bin/docker
+# docker.io package (and daemon) in via apt. Pinned to a release tag plus
+# the multi-arch manifest list digest.
+COPY --from=docker:29.9.3-cli@sha256:2357639ad1ea7d0194134bf3292622fd4e562483966ed674e5d7c945b5f3b28d \
+    /usr/local/bin/docker /usr/local/bin/docker
 
 WORKDIR /src
 COPY go.mod go.sum ./
diff --git a/ipabusedb-docker-reporter/Makefile b/ipabusedb-docker-reporter/Makefile
index ce97888..5a5a1c8 100644
--- a/ipabusedb-docker-reporter/Makefile
+++ b/ipabusedb-docker-reporter/Makefile
@@ -1,12 +1,18 @@
 BIN := ipabusedb-docker-reporter
+IMAGE := git.eeqj.de/sneak/$(BIN)
+TAG := $(shell date -u +%Y-%m-%d)
 
-.PHONY: build test lint fmt fmt-check check clean image
+.PHONY: build test lint fmt fmt-check check clean image push
 
 build:
 	go build -o $(BIN) .
 
 image:
-	docker build -t $(BIN) .
+	docker build -t $(BIN) -t $(IMAGE):$(TAG) -t $(IMAGE):latest .
+
+push: image
+	docker push $(IMAGE):$(TAG)
+	docker push $(IMAGE):latest
 
 test:
 	go test ./...
diff --git a/ipabusedb-docker-reporter/README.md b/ipabusedb-docker-reporter/README.md
index 470cacf..66c4ae4 100644
--- a/ipabusedb-docker-reporter/README.md
+++ b/ipabusedb-docker-reporter/README.md
@@ -1,4 +1,4 @@
-# ipabusedb-docker-ssh
+# ipabusedb-docker-reporter
 
 Reads the logs of a dockerised sshd with `docker logs -t`, extracts
 brute-force / invalid-user login attempts, and emits a CSV in the format
@@ -52,14 +52,14 @@ Flags:
 ```
 $ make build
 $ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
-$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
-$ ./ipabusedb-docker-ssh --since 24h --submit
+$ ./ipabusedb-docker-reporter --since 24h -o reports.csv
+$ ./ipabusedb-docker-reporter --since 24h --submit
 ```
 
 Submitting manually with curl instead of `--submit`:
 
 ```
-$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
+$ ./ipabusedb-docker-reporter --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
 ```
 
 ## Running as a container
@@ -68,8 +68,9 @@ The `Dockerfile` builds on `git.eeqj.de/sneak/baseimage` and installs the
 program as a runit service (`sv/ipabusedb-docker-reporter/run`) that
 sleeps `INTERVAL` seconds, then runs the reporter with
 `--since ${INTERVAL}s --submit`, and repeats. The docker CLI is copied in
-from the `docker:cli` image so the program can read logs through the
-host's docker socket.
+from the official `docker` CLI image (pinned by tag and digest in the
+`Dockerfile`) so the program can read logs through the host's docker
+socket.
 
 | Variable                | Purpose                                            |
 | ----------------------- | -------------------------------------------------- |
@@ -77,14 +78,20 @@ host's docker socket.
 | `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required)                       |
 | `INTERVAL`              | seconds between runs, and the report window (1200) |
 
+`make image` builds the image, tagged locally as
+`ipabusedb-docker-reporter` and as
+`git.eeqj.de/sneak/ipabusedb-docker-reporter` with today's date and
+`latest`. `make push` builds and pushes both registry tags (log in once
+with `docker login git.eeqj.de`).
+
 ```
-$ make image
+$ make push
 $ docker run -d --restart unless-stopped \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -e DOCKER_CONTAINER_NAME=sshd \
     -e IPABUSEDB_API_KEY=... \
     -e INTERVAL=1200 \
-    ipabusedb-docker-reporter
+    git.eeqj.de/sneak/ipabusedb-docker-reporter:latest
 ```
 
 Each run's CSV and the AbuseIPDB response go to the container log. If a
diff --git a/ipabusedb-docker-reporter/main.go b/ipabusedb-docker-reporter/main.go
index 923b2f9..b485b33 100644
--- a/ipabusedb-docker-reporter/main.go
+++ b/ipabusedb-docker-reporter/main.go
@@ -1,4 +1,4 @@
-// ipabusedb-docker-ssh reads the logs of a dockerised sshd via
+// ipabusedb-docker-reporter reads the logs of a dockerised sshd via
 // "docker logs -t", extracts brute-force / invalid-user attempts, and
 // emits a CSV suitable for the AbuseIPDB bulk-report endpoint.
 //