diff --git a/scripts/docker/frank-primary-freetoken.Dockerfile b/scripts/docker/frank-primary-freetoken.Dockerfile
index d10da93..941af92 100644
--- a/scripts/docker/frank-primary-freetoken.Dockerfile
+++ b/scripts/docker/frank-primary-freetoken.Dockerfile
@@ -29,10 +29,19 @@
 #     / sgl_kernel / nvidia-cutlass-dsl have no ROCm builds and are
 #     intentionally absent — FreeToken gates them off and falls back to its
 #     Triton kernels on ROCm.
-FROM rocm/pytorch:rocm7.14_ubuntu24.04_py3.12_pytorch_release_2.11.0
+#
+# Base is digest-pinned (2026-10-05): sha256:a223aee1… is the manifest this
+# build was qualified against; a re-pushed tag cannot change the stack.
+FROM rocm/pytorch@sha256:a223aee17aef5d21c3b9f63436dd19d27d1c665ec8b2f40011c9546cabae2a80
 
 # Pin the PR head, not the branch: a future push to rocm714_torch214 would
 # otherwise silently change the deployed engine.
+# The pip-ROCm torch in this image ships libhiprtc as the VERSIONED
+# libhiprtc.so.7 only; the PR's `_cpu_moe` extension links `-lhiprtc`, and
+# ld looks for the unversioned dev symlink in the ALREADY-LINKED
+# _rocm_sdk_core/lib dir. Create it there (first build failure 2026-10-05:
+# `ld: cannot find -lhiprtc`).
+RUN ln -s libhiprtc.so.7 /opt/venv/lib/python3.12/site-packages/_rocm_sdk_core/lib/libhiprtc.so
 RUN git clone https://github.com/FlashML-org/FreeToken.git /opt/FreeToken \
  && cd /opt/FreeToken \
  && git fetch origin pull/587/head \