diff --git a/docker/Dockerfile.back b/docker/Dockerfile.back
index c4a05d5..76c7498 100644
--- a/docker/Dockerfile.back
+++ b/docker/Dockerfile.back
@@ -1,4 +1,8 @@
-FROM python:3.11-slim
+# Docker Official Image, served from AWS's public mirror rather than Docker Hub.
+# Identical content, but it keeps the build off Docker Hub entirely: no account,
+# and none of Docker Hub's anonymous pull limits, which CI runners share an
+# egress address for and can therefore hit without warning.
+FROM public.ecr.aws/docker/library/python:3.11-slim
 
 WORKDIR /app
 
diff --git a/docker/Dockerfile.ngrok b/docker/Dockerfile.ngrok
index fdbb669..bc20150 100644
--- a/docker/Dockerfile.ngrok
+++ b/docker/Dockerfile.ngrok
@@ -1,4 +1,6 @@
-FROM alpine:latest
+# Docker Official Image, served from AWS's public mirror rather than Docker Hub.
+# See docker/Dockerfile.back for why.
+FROM public.ecr.aws/docker/library/alpine:latest
 RUN apk add --no-cache wget unzip && \
     wget -O ngrok.zip https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip && \
     unzip ngrok.zip && \