Pin the official image digest, preserve the upstream data directory, and document the accepted CVE-2026-42533 High-risk exposure.