diff --git a/dankclaw/anubis/quadlet/anubis.container b/dankclaw/anubis/quadlet/anubis.container
index c5afd9d..a105edb 100644
--- a/dankclaw/anubis/quadlet/anubis.container
+++ b/dankclaw/anubis/quadlet/anubis.container
@@ -11,11 +11,16 @@
 # per-vhost routing — including Authentik forward_auth — resumes. Host headers
 # survive both hops, so vhost matching on the internal listener still works.
 #
-# Version pin: ghcr.io/techaroq/anubis:v1.13.0 was source-verified before
-# pinning (policy parser is JSON-only at this tag, flags are the config
-# surface via flagenv: an env var named TARGET sets --target, POLICY_FNAME
-# sets --policy-fname). Upgrading = stop unit, change Image=, deploy; policy
-# schema must be re-verified against the new tag first.
+# Image pin: the image is pulled from ghcr.io/techarohq/anubis (source of
+# truth), but the unit runs it under a localhost/-aliased tag: on this host's
+# podman 5.7 quadlet path, registry-prefixed refs fail to resolve from local
+# storage at container create time ("image not known") even when present; the
+# localhost alias resolves (verified live 2026-08-28). v1.13.0 was
+# source-verified before pinning (policy parser is JSON-only at this tag,
+# flags are the config surface via flagenv: TARGET sets --target,
+# POLICY_FNAME sets --policy-fname). Upgrading = pull new tag, re-tag the
+# localhost alias, restart the unit; re-verify the policy schema first.
+# (the active Image= key lives in the [Container] section below)
 #
 # No secrets here: Anubis holds no credentials (memory store; challenge
 # cookies are client-side JWTs). A restart invalidates issued challenges —
@@ -28,7 +33,7 @@ Wants=network-online.target
 
 [Container]
 ContainerName=anubis
-Image=ghcr.io/techaroq/anubis:v1.13.0
+Image=localhost/techarohq/anubis:v1.13.0
 Pull=never
 Network=dankclaw_default
 # flagenv maps env names to flag names (TARGET -> --target, POLICY_FNAME ->
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 6e73731..fa540e8 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -557,6 +557,10 @@ deploy_anubis() {
     if ! podman image exists ghcr.io/techarohq/anubis:v1.13.0; then
         podman pull ghcr.io/techaroq/anubis:v1.13.0
     fi
+    # The unit runs the localhost/ alias (see the unit file comment): this
+    # host's podman quadlet path cannot resolve registry-prefixed refs from
+    # local storage at create time. Tag first, then (re)create via deploy.
+    podman tag ghcr.io/techarohq/anubis:v1.13.0 localhost/techarohq/anubis:v1.13.0 2>/dev/null || true
     cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     # No enable: generated units cannot be enabled on this host (v1 quadlet