diff --git a/.env.example b/.env.example
index b48e43d..10d03be 100644
--- a/.env.example
+++ b/.env.example
@@ -51,7 +51,7 @@ LOCAL_BOOTSTRAP_TIMEOUT=86400
 
 # Official upstream build of gpf-geocodeur (used if GHCR images are unavailable)
 GEOCODER_GIT_URL=https://github.com/Geoplateforme/gpf-geocodeur.git
-GEOCODER_GIT_REF=main
+GEOCODER_GIT_REF=da0f365d4a0bcac5371b4962769abc17bfcd8cef
 
 # Advanced compatibility mode only.
 # Leave empty for the standard GeoDock V2 experience.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66bd945..4b83081 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.0.5] - 2026-07-09
+
+### Fixed
+
+- Pin local and fallback runtime builds to the same immutable `gpf-geocodeur` commit as the GHCR image.
+
 ## [1.0.4] - 2026-07-09
 
 ### Changed
@@ -9,4 +15,5 @@
 - Pin the upstream `gpf-geocodeur` runtime source to an immutable commit for reproducible GHCR builds.
 - Generate release notes without repeating the first-release announcement.
 
+[1.0.5]: https://github.com/jbjardine/GeoDock/compare/v1.0.4...v1.0.5
 [1.0.4]: https://github.com/jbjardine/GeoDock/compare/v1.0.3...v1.0.4
diff --git a/docker-compose.git.yml b/docker-compose.git.yml
index 9048a36..cc5a684 100644
--- a/docker-compose.git.yml
+++ b/docker-compose.git.yml
@@ -5,7 +5,7 @@ services:
       dockerfile: runtime/Dockerfile.gpf-geocodeur
       args:
         GEOCODER_GIT_URL: ${GEOCODER_GIT_URL:-https://github.com/Geoplateforme/gpf-geocodeur.git}
-        GEOCODER_GIT_REF: ${GEOCODER_GIT_REF:-main}
+        GEOCODER_GIT_REF: ${GEOCODER_GIT_REF:-da0f365d4a0bcac5371b4962769abc17bfcd8cef}
     image: ${GEODOCK_RUNTIME_IMAGE:-ghcr.io/jbjardine/geodock-runtime:latest}
 
   geocoder-address:
diff --git a/tests/test_public_release_regressions.py b/tests/test_public_release_regressions.py
index 891b5fc..eb2ecd2 100644
--- a/tests/test_public_release_regressions.py
+++ b/tests/test_public_release_regressions.py
@@ -56,9 +56,18 @@ def test_manifest_error_blocks_rebuild() -> None:
 
 def test_runtime_upstream_ref_is_immutable() -> None:
     dockerfile = (ROOT / "runtime" / "Dockerfile.gpf-geocodeur").read_text()
-    match = re.search(r"^ARG GEOCODER_GIT_REF=([0-9a-f]{40})$", dockerfile, re.MULTILINE)
+    compose = (ROOT / "docker-compose.git.yml").read_text()
+    environment = (ROOT / ".env.example").read_text()
+    dockerfile_match = re.search(r"^ARG GEOCODER_GIT_REF=([0-9a-f]{40})$", dockerfile, re.MULTILINE)
+    compose_match = re.search(r"GEOCODER_GIT_REF:-([0-9a-f]{40})", compose)
+    environment_match = re.search(r"^GEOCODER_GIT_REF=([0-9a-f]{40})$", environment, re.MULTILINE)
 
-    assert_true(match is not None, "release images must pin the upstream geocoder to an immutable commit")
+    assert_true(
+        all((dockerfile_match, compose_match, environment_match)),
+        "GHCR and fallback runtime builds must pin the upstream geocoder to immutable commits",
+    )
+    refs = {match.group(1) for match in (dockerfile_match, compose_match, environment_match) if match}
+    assert_true(len(refs) == 1, "GHCR and fallback runtime builds must use the same upstream commit")
     assert_true(
         'fetch --depth 1 origin "${GEOCODER_GIT_REF}"' in dockerfile,
         "the runtime checkout must support the pinned upstream commit",