diff --git a/.build.yml b/.build.yml
index 6a1cecb..847b596 100644
--- a/.build.yml
+++ b/.build.yml
@@ -4,7 +4,7 @@ secrets:
   - f523ee29-5ef8-490f-8903-43ad7c49060b
   - 130adee5-3a8f-4035-8cad-e3d044be2961
 sources:
-  - https://git.sr.ht/~jswank/alpine-cli
+  - https://git.sr.ht/~jswank/alpine-cli#3
 packages:
   - podman
   - go-task
diff --git a/Dockerfile b/Dockerfile
index 96aeddd..60cd211 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/library/alpine:latest
+FROM docker.io/library/alpine:3
 
 LABEL org.opencontainers.image.title=jswank/alpine-cli \
       org.opencontainers.image.description="A minimal image for running Linux CLI utilities" \
diff --git a/README.md b/README.md
index 3ba82e0..e2312ca 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ exit
 
 Bonus - the same script could be used to start other containers:
 ```console
-$ bin/cli image=alpine:latest
+$ bin/cli image=alpine:3
 / # ^D
 ```
 
diff --git a/bin/cli b/bin/cli
index f2bdf3f..8192930 100755
--- a/bin/cli
+++ b/bin/cli
@@ -1,6 +1,6 @@
 #!/usr/bin/env -S just --working-directory . --justfile
 
-image := "ghcr.io/jswank/alpine-cli:latest"
+image := "ghcr.io/jswank/alpine-cli:3"
 n := "alpine-cli"
 
 # Invoke the 'run' recipe