Three Behaviors in One Minor Bump
Authentik 2026.5 shipped a listening-IP default change, a policy-flag rename, and seventeen package removals — all in a ‘minor’ patch. That’s why ADR-0001 promoted Authentik from Tier B to Tier A today.
Image-Pinning
The Canary Was on :latest
A cert renewal that succeeded 14 days ago but never deployed, a peer-death timer that took 4 hours, and the Uptime Kuma canary that caught one of them — which I had to pin today.
Pinning What I Thought Was Already Pinned
On April 30 I committed pins for several :latest Quadlets and called it done. On May 11 an audit found the running containers had never noticed.