diff --git a/Dockerfile b/Dockerfile
index 75f158d..9ac47aa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,11 +22,11 @@ RUN groupadd -r appuser && useradd -r -g appuser appuser
 # Copy requirements first for better caching
 COPY requirements.txt .
 
-# Cache-bust the pip install layer so unpinned VCS deps (sdrf-pipelines main HEAD)
-# are re-fetched on every build. The CI pipeline passes the commit SHA here.
+# Cache-bust the pip install layer on every CI build so dependency pins in
+# requirements.txt are installed fresh. The CI pipeline passes the commit SHA here.
 ARG CACHEBUST=dev
 
-# Install Python dependencies. --upgrade ensures any unpinned VCS dep tracks main HEAD.
+# Install Python dependencies.
 RUN echo "cachebust=$CACHEBUST" && pip install --upgrade --no-cache-dir -r requirements.txt
 
 # Copy application code
diff --git a/requirements.txt b/requirements.txt
index 9fb9e64..5873952 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,8 +3,11 @@ fastapi>=0.115.0
 uvicorn[standard]>=0.24.0
 python-multipart>=0.0.6
 
-# SDRF validation (use GitHub to match app imports)
-git+https://github.com/bigbio/sdrf-pipelines.git
+# Pin a released wheel so /health.sdrf_pipelines_version is stable and the
+# image vendors the matching sdrf-templates (0.1.6: environmental medium
+# required; environmental sample type no longer required). An unpinned git
+# URL reports whatever tag was latest at image-build time, which is why
+sdrf-pipelines==0.1.6
 
 # Utilities
 pydantic>=2.0.0