diff --git a/CHANGELOG.md b/CHANGELOG.md
index c17f726..f854450 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,6 +96,12 @@ get wrong, so it is now told to look things up instead.
 internet is a new kind of input into a system that administers your customers. To enable it:
 
 - **compose** — `COMPOSE_PROFILES=browser docker compose up -d`, and set `BROWSER_URL=http://browser:3000`.
+
+The browser image is on the `dev` channel and pinned by version in the compose file, not on
+`stable` like the other three. That is deliberate and not an oversight: promotion to `stable` means
+"this has run on a canary", and no canary deploys a browser — it is opt-in there too. So it is
+pinned to bytes that exist rather than to a channel that does not.
+
 - **Kubernetes** — uncomment `09-browser.yaml` in `kustomization.yaml` and `BROWSER_URL` in
   `02-config.yaml`.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 3e80ac1..a46b281 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -257,7 +257,12 @@ services:
   # Delete this service and unset BROWSER_URL if you would rather Jarvis had no web access. Nothing
   # else stops working; the two web tools report themselves unavailable.
   browser:
-    image: ${JARVIS_IMAGE_BROWSER:-git.luxit.be/luxit/jarvis-browser:stable}
+    # Pinned to a VERSION rather than to :stable, unlike the other three, and the reason is honest
+    # rather than stylistic: nothing has promoted a browser to stable yet, because promotion means
+    # "this ran on a canary" and the canary does not deploy one — it is opt-in there too. So :stable
+    # does not exist for this image, and defaulting to a tag that 404s would be a worse first
+    # five minutes than a pin. It moves to :stable once a canary has actually run one.
+    image: ${JARVIS_IMAGE_BROWSER:-git.luxit.be/luxit/jarvis-browser:0.1.0}
     # OPT-IN. A profiled service does not start unless you ask for it:
     #     COMPOSE_PROFILES=browser docker compose up -d
     # Web access is a decision, not a default — an assistant that can read the internet is a new
diff --git a/kubernetes/09-browser.yaml b/kubernetes/09-browser.yaml
index 100c933..3b3310e 100644
--- a/kubernetes/09-browser.yaml
+++ b/kubernetes/09-browser.yaml
@@ -42,7 +42,10 @@ spec:
       automountServiceAccountToken: false
       containers:
         - name: browser
-          image: git.luxit.be/luxit/jarvis-browser:stable
+          # A version, not a channel: nothing has promoted a browser to stable, because promotion
+          # means "it ran on a canary" and no canary deploys one — this manifest is commented out of
+          # kustomization.yaml by default. Pin a digest here as you do for the other images.
+          image: git.luxit.be/luxit/jarvis-browser:0.1.0
           ports:
             - containerPort: 3000
               name: http