diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b86770de..fbc345f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -175,11 +175,12 @@ jobs:
 
       - name: Start MinIO
         run: |
+          # MinIO deleted its Docker Hub repositories; quay.io is the live source.
           docker run -d --name minio \
             -p 39000:9000 \
             -e MINIO_ROOT_USER=minioadmin \
             -e MINIO_ROOT_PASSWORD=minioadmin \
-            quay.io/minio/minio:latest server /data
+            quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z server /data
           # Wait for MinIO to be ready
           for i in {1..30}; do
             curl -sf http://localhost:39000/minio/health/live && break
@@ -188,12 +189,14 @@ jobs:
 
       - name: Create MinIO bucket
         run: |
-          # Install mc client
-          curl -sL https://dl.min.io/client/mc/release/linux-arm64/mc -o /tmp/mc
-          chmod +x /tmp/mc
-          # Configure and create bucket
-          /tmp/mc alias set minio http://localhost:39000 minioadmin minioadmin
-          /tmp/mc mb minio/ducklake --ignore-existing
+          # dl.min.io returns 410 Gone: MinIO archived the community mc client
+          # alongside the Docker Hub images. Run mc from its quay.io image
+          # instead. `--network container:minio` joins MinIO's own namespace,
+          # so the endpoint is its internal port, not the published one.
+          docker run --rm --network container:minio \
+            -e MC_HOST_minio=http://minioadmin:minioadmin@localhost:9000 \
+            quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z \
+            mb minio/ducklake --ignore-existing
 
       - name: Run integration tests
         run: just test-integration
diff --git a/docker-compose.yaml b/docker-compose.yaml
index f7a3e440..5960d659 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -17,7 +17,9 @@ services:
       retries: 5
 
   minio:
-    image: minio/minio:latest
+    # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a
+    # dated release rather than `latest` so a rebuild cannot silently change it.
+    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
     container_name: ducklake-storage
     command: server /data --console-address ":9001"
     environment:
@@ -36,7 +38,7 @@ services:
 
   # Creates the ducklake bucket on startup
   minio-init:
-    image: minio/mc:latest
+    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
     container_name: ducklake-storage-init
     depends_on:
       minio:
diff --git a/k8s/local-config-store.compose.yaml b/k8s/local-config-store.compose.yaml
index 70f6c738..27326037 100644
--- a/k8s/local-config-store.compose.yaml
+++ b/k8s/local-config-store.compose.yaml
@@ -47,7 +47,9 @@ services:
       - /var/lib/postgresql/data
 
   minio:
-    image: minio/minio:latest
+    # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a
+    # dated release rather than `latest` so a rebuild cannot silently change it.
+    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
     container_name: duckgres-local-minio
     command: server /data --console-address ":9001"
     environment:
diff --git a/tests/integration/docker-compose.yml b/tests/integration/docker-compose.yml
index f69c9fd0..1b4a850d 100644
--- a/tests/integration/docker-compose.yml
+++ b/tests/integration/docker-compose.yml
@@ -42,7 +42,9 @@ services:
 
   # MinIO for DuckLake object storage
   minio:
-    image: minio/minio:latest
+    # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a
+    # dated release rather than `latest` so a rebuild cannot silently change it.
+    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
     container_name: duckgres-test-minio
     command: server /data --console-address ":9001"
     environment:
@@ -61,7 +63,7 @@ services:
 
   # Creates the ducklake bucket on startup
   minio-init:
-    image: minio/mc:latest
+    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
     container_name: duckgres-test-minio-init
     depends_on:
       minio: