diff --git a/group_vars/docker/services.yml b/group_vars/docker/services.yml
index f0b002c..f858c2a 100644
--- a/group_vars/docker/services.yml
+++ b/group_vars/docker/services.yml
@@ -19,6 +19,10 @@ services:
   dawarich:
     db_name: "dawarich"
     db_user: "dawarich"
+
+# StarPunk image tag, built by CI in the StarPunk repo (bump to deploy a release)
+starpunk_version: "v2.0.2"
+
 # StarPunk admin: Pocket ID user ID (sub) of phil
 starpunk_admin_sub: "5754855f-0a30-4755-9609-7294209e40f4"
 
diff --git a/roles/docker/README.md b/roles/docker/README.md
index 66f98bd..6abdfd3 100644
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@@ -58,7 +58,7 @@ Tags: each category file has a category tag, each service its own tag.
 |---|---|---|
 | `gotosocial` | GoToSocial | Pocket ID through env vars. Account domain is the apex; Caddy serves WebFinger there. Daily S3 backup of its volume. |
 | `listmonk` | Listmonk | Postgres 17. On `listmonk.nerder.land`. |
-| `starpunk` | StarPunk | Micropub server for the main site (own image from Gitea). Admin login via Pocket ID; issues its own Micropub tokens. |
+| `starpunk` | StarPunk | Micropub server for the main site. Image built by the StarPunk repo's Gitea Actions on `vX.Y.Z` tags; deploy a release by bumping `starpunk_version`. Admin login via Pocket ID; issues its own Micropub tokens. |
 
 ### Monitoring (`monitoring`)
 | Tag | Service | Notes |
diff --git a/roles/docker/tasks/communication/starpunk.yml b/roles/docker/tasks/communication/starpunk.yml
index bc62241..79e5260 100644
--- a/roles/docker/tasks/communication/starpunk.yml
+++ b/roles/docker/tasks/communication/starpunk.yml
@@ -17,5 +17,8 @@
 - name: deploy starpunk stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/starpunk
+    # Always fetch the tag from the registry so a locally built image with
+    # the same name can't be deployed by mistake
+    pull: always
     files:
     - compose.yml
diff --git a/roles/docker/templates/starpunk-compose.yml.j2 b/roles/docker/templates/starpunk-compose.yml.j2
index e8f204d..16cb51e 100644
--- a/roles/docker/templates/starpunk-compose.yml.j2
+++ b/roles/docker/templates/starpunk-compose.yml.j2
@@ -1,6 +1,7 @@
 services:
   starpunk:
-    image: git.thesatelliteoflove.com/phil/starpunk:v2.0.1
+    # Built and pushed by StarPunk's Gitea Actions workflow on vX.Y.Z tags
+    image: {{ subdomains.git }}/phil/starpunk:{{ starpunk_version }}
     container_name: starpunk
     restart: unless-stopped
     extra_hosts: