diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ff7a9a4..9cb5425e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,3 +41,21 @@ updates:
       default-days: 10
     commit-message:
       prefix: "ci"
+
+  # Container base images (digest pins in Dockerfile)
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 10
+    groups:
+      docker:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 10
+    commit-message:
+      prefix: "build"
diff --git a/Dockerfile b/Dockerfile
index fbe50716..6a6ee411 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,9 @@
 # Development Dockerfile for basecamp
 #
-# NOTE: This Dockerfile requires vendored dependencies or BuildKit secrets
-# for the private basecamp-sdk. For local builds, either:
-#   1. Run `go mod vendor` first, then build with: docker build .
-#   2. Use GoReleaser for release builds (handles auth automatically)
-#
-# For CI/release builds, use Dockerfile.goreleaser instead.
+# Local builds only: `docker build .` (vendor first with `go mod vendor` when
+# offline). Release binaries come from GoReleaser, not this image.
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
 
 RUN apk add --no-cache git ca-certificates
 
@@ -20,7 +16,7 @@ ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILD_DATE=unknown
 
-# Build with vendored deps if available, otherwise try to download (may fail without auth for private SDK)
+# Build with vendored deps if available, otherwise download
 RUN if [ -d vendor ]; then \
         CGO_ENABLED=0 GOOS=linux go build -mod=vendor \
             -trimpath \
@@ -35,7 +31,7 @@ RUN if [ -d vendor ]; then \
     fi
 
 # Runtime stage using distroless for minimal attack surface
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 COPY --from=builder /basecamp /basecamp
 
diff --git a/Dockerfile.test b/Dockerfile.test
deleted file mode 100644
index 2421fdad..00000000
--- a/Dockerfile.test
+++ /dev/null
@@ -1,12 +0,0 @@
-FROM golang:1.26-alpine
-
-RUN apk add --no-cache bash git jq
-RUN git clone https://github.com/bats-core/bats-core.git /tmp/bats && \
-    /tmp/bats/install.sh /usr/local
-
-WORKDIR /app
-COPY . .
-
-ENV BCQ_NO_KEYRING=1
-
-CMD ["sh", "-c", "go test ./... && go build -o bin/bcq ./cmd/bcq && BCQ_BIN=./bin/bcq bats e2e/"]
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
deleted file mode 100644
index b115d74d..00000000
--- a/docker-compose.test.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-version: '3.8'
-services:
-  test:
-    build:
-      context: .
-      dockerfile: Dockerfile.test
-    volumes:
-      - .:/app
-    environment:
-      - BASECAMP_NO_KEYRING=1