diff --git a/compose/local/minio/init.sh b/compose/local/minio/init.sh
index 746627f0d..1cc007eaa 100755
--- a/compose/local/minio/init.sh
+++ b/compose/local/minio/init.sh
@@ -1,13 +1,12 @@
 #!/bin/sh
+# Stop on the first error so a failed bucket setup fails this container instead of passing silently.
+set -e
 
-# Create a default bucket
-# /usr/bin/mc set alias minio "${MINIO_ENDPOINT}" "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
-/usr/bin/mc config host add local "${MINIO_ENDPOINT}" "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
+# Create the default buckets. Current mc releases dropped `mc config host add`, so use `mc alias set`.
+/usr/bin/mc alias set local "${MINIO_ENDPOINT}" "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
 /usr/bin/mc mb local/"${MINIO_DEFAULT_BUCKET}" --ignore-existing
 /usr/bin/mc mb local/"${MINIO_TEST_BUCKET}" --ignore-existing
 
 # Give it public read access
 /usr/bin/mc anonymous set public local/"${MINIO_DEFAULT_BUCKET}"
 /usr/bin/mc anonymous set public local/"${MINIO_TEST_BUCKET}"
-
-exit 0
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
index 0bde678d3..fa9d13be0 100644
--- a/docker-compose.ci.yml
+++ b/docker-compose.ci.yml
@@ -17,12 +17,19 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
     depends_on:
-      - postgres
-      - redis
-      - minio-init
-      - ml_backend
-      - rabbitmq
-      - nats
+      postgres:
+        condition: service_started
+      redis:
+        condition: service_started
+      # Wait for bucket setup to succeed so a failure stops the job here, not in later tests.
+      minio-init:
+        condition: service_completed_successfully
+      ml_backend:
+        condition: service_started
+      rabbitmq:
+        condition: service_started
+      nats:
+        condition: service_started
     env_file:
       - ./.envs/.ci/.django
       - ./.envs/.ci/.postgres
@@ -63,8 +70,11 @@ services:
       - ./.envs/.ci/.django
 
   minio:
-    image: quay.io/minio/minio:RELEASE.2024-11-07T00-52-20Z
-    command: minio server --console-address ":9001" /data
+    # MinIO no longer publishes pullable images (Docker Hub and quay.io both require a login).
+    # This image bundles the server, mc and a shell, so minio-init reuses it. Pinned by digest;
+    # to bump: docker pull cgr.dev/chainguard/minio:latest, then copy RepoDigests from docker image inspect.
+    image: cgr.dev/chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
+    command: server --console-address ":9001" /data
     volumes:
       - "minio_ci_data:/data"
     env_file:
@@ -76,7 +86,7 @@ services:
       retries: 5
 
   minio-init:
-    image: quay.io/minio/mc:RELEASE.2025-03-12T17-29-24Z
+    image: cgr.dev/chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
     env_file:
       - ./.envs/.ci/.django
     depends_on:
@@ -84,7 +94,7 @@ services:
         condition: service_healthy
     volumes:
       - ./compose/local/minio/init.sh:/etc/minio/init.sh
-    entrypoint: /etc/minio/init.sh
+    entrypoint: ["/bin/sh", "/etc/minio/init.sh"]
 
   ml_backend:
     build:
diff --git a/docker-compose.yml b/docker-compose.yml
index 152d9ae42..be3e9b2a7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,12 +19,19 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
     depends_on:
-      - postgres
-      - redis
-      - nats
-      - minio-init
-      - ml_backend
-      - rabbitmq
+      postgres:
+        condition: service_started
+      redis:
+        condition: service_started
+      nats:
+        condition: service_started
+      # Wait for bucket setup to succeed, so Django never starts against missing buckets.
+      minio-init:
+        condition: service_completed_successfully
+      ml_backend:
+        condition: service_started
+      rabbitmq:
+        condition: service_started
     volumes:
       - .:/app:z
     env_file:
@@ -139,8 +146,13 @@ services:
       - antenna_network
 
   minio:
-    image: quay.io/minio/minio:RELEASE.2024-11-07T00-52-20Z
-    command: minio server --console-address ":9001" /data
+    # MinIO no longer publishes pullable images (Docker Hub and quay.io both require a login).
+    # This image bundles the server, mc and a shell, so minio-init reuses it. Pinned by digest;
+    # to bump: docker pull cgr.dev/chainguard/minio:latest, then copy RepoDigests from docker image inspect.
+    image: cgr.dev/chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
+    command: server --console-address ":9001" /data
+    # Existing dev volumes were written by the old image as root; the new one defaults to a non-root user.
+    user: root
     volumes:
       - "minio_data:/data"
     env_file:
@@ -165,15 +177,17 @@ services:
       - minio
 
   minio-init:
-    image: quay.io/minio/mc:RELEASE.2025-03-12T17-29-24Z
+    image: cgr.dev/chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
     env_file:
       - ./.envs/.local/.django
     depends_on:
-      - minio
-      - minio-proxy
+      minio:
+        condition: service_healthy
+      minio-proxy:
+        condition: service_started
     volumes:
       - ./compose/local/minio/init.sh:/etc/minio/init.sh
-    entrypoint: /etc/minio/init.sh
+    entrypoint: ["/bin/sh", "/etc/minio/init.sh"]
 
   ml_backend:
     build: