diff --git a/dankclaw/authentik/quadlet/authentik-outpost-ldap.container b/dankclaw/authentik/quadlet/authentik-outpost-ldap.container
index 233a7a7..15c19d3 100644
--- a/dankclaw/authentik/quadlet/authentik-outpost-ldap.container
+++ b/dankclaw/authentik/quadlet/authentik-outpost-ldap.container
@@ -19,9 +19,11 @@ Wants=authentik-server.service
 
 [Container]
 ContainerName=authentik-outpost-ldap
-Image=ghcr.io/goauthentik/ldap:2026.8.0
 Network=dankclaw_default
+# Image=ghcr.io/goauthentik/ldap:2026.8.0 (amd64 digest; podman 5.7.0 refuses
+# the tag's nested manifest list, so pin the single-platform digest).
 EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
+Image=ghcr.io/goauthentik/ldap@sha256:fa33bc8f522113830e1662f4c034352f9eb08e0a7d3da2ddadad9a4b33b4cbf4
 Environment=AUTHENTIK_HOST=https://auth.franksdank.cloud
 Environment=AUTHENTIK_INSECURE=false
 Environment=AUTHENTIK_TOKEN=${AUTHENTIK_LDAP_OUTPOST_TOKEN}