diff --git a/roles/docker/README.md b/roles/docker/README.md
index 6abdfd3..e797e54 100644
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@@ -45,7 +45,7 @@ Tags: each category file has a category tag, each service its own tag.
 ### Productivity (`productivity`)
 | Tag | Service | Notes |
 |---|---|---|
-| `paperlessngx` | Paperless-ngx | Redis, Gotenberg, Tika. Pocket ID through django-allauth (`paperlessngx.env.j2`). Daily S3 backup of the data volume. |
+| `paperlessngx` | Paperless-ngx | Version pinned by `paperless_version` in `group_vars/docker/services.yml`; read the release notes before bumping. Redis, Gotenberg, Tika (pinned to the versions Paperless ships with). Pocket ID through django-allauth (`paperlessngx.env.j2`). Rejects duplicate documents. Daily S3 backup of the data and media volumes. |
 | `baikal` | Baikal | CalDAV/CardDAV. Caddy redirects the `.well-known` paths. |
 | `syncthing` | Syncthing | Ports on the Tailscale IP only. |
 | `heyform` | HeyForm | MongoDB (Percona) and KeyDB. On `forms.nerder.land`. |
diff --git a/roles/docker/templates/paperlessngx-compose.yml.j2 b/roles/docker/templates/paperlessngx-compose.yml.j2
index ab65dc2..52957f9 100644
--- a/roles/docker/templates/paperlessngx-compose.yml.j2
+++ b/roles/docker/templates/paperlessngx-compose.yml.j2
@@ -48,7 +48,7 @@ services:
       - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
-    image: docker.io/apache/tika:latest
+    image: docker.io/apache/tika:3.3.1.0  # the version Paperless ships with
     restart: unless-stopped
 
   backup: