diff --git a/stack/dedupe/Dockerfile b/stack/dedupe/Dockerfile
index 14e56e7..b844130 100644
--- a/stack/dedupe/Dockerfile
+++ b/stack/dedupe/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12-alpine
+FROM docker.io/library/python:3.12-alpine
 
 # Needed to verify the CA chain when measuring each node's egress address
 # through its own CONNECT proxy.
diff --git a/stack/docker-compose.yml b/stack/docker-compose.yml
index 16d8a24..a4d7ff6 100644
--- a/stack/docker-compose.yml
+++ b/stack/docker-compose.yml
@@ -37,7 +37,7 @@ services:
   # Seeds the engine's config into its named volume (bind-mounting that
   # path breaks startup, so it is copied instead).
   config-init:
-    image: busybox:1.36
+    image: docker.io/library/busybox:1.36
     command: ["sh", "-c", "install -o 1000 -g 1000 -m 0644 /seed.json /vol/config.json"]
     volumes:
       - ./config.json:/seed.json:ro
diff --git a/stack/generate-compose.py b/stack/generate-compose.py
index c4178c4..f9fd491 100755
--- a/stack/generate-compose.py
+++ b/stack/generate-compose.py
@@ -79,7 +79,7 @@ def compose(n_nodes: int, base_port: int, node_rotation: int) -> str:
     w("  # Seeds the engine's config into its named volume (bind-mounting that")
     w("  # path breaks startup, so it is copied instead).")
     w("  config-init:")
-    w("    image: busybox:1.36")
+    w("    image: docker.io/library/busybox:1.36")
     w("    command: [\"sh\", \"-c\", \"install -o 1000 -g 1000 -m 0644 /seed.json /vol/config.json\"]")
     w("    volumes:")
     w("      - ./config.json:/seed.json:ro")
diff --git a/stack/tinyproxy/Dockerfile b/stack/tinyproxy/Dockerfile
index b211297..aa98b9f 100644
--- a/stack/tinyproxy/Dockerfile
+++ b/stack/tinyproxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.20
+FROM docker.io/library/alpine:3.20
 
 RUN apk add --no-cache tinyproxy
 
diff --git a/stack/warp/Dockerfile b/stack/warp/Dockerfile
index 73248cc..d3b0237 100644
--- a/stack/warp/Dockerfile
+++ b/stack/warp/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM docker.io/library/ubuntu:22.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV WARP_LOG_LEVEL=info