diff --git a/hack/build-images.sh b/hack/build-images.sh
index c57d67d..130e3ea 100755
--- a/hack/build-images.sh
+++ b/hack/build-images.sh
@@ -18,6 +18,14 @@
 # straight into the local image store so the smoke test can run before anything is
 # published, and it produces a plain manifest with no attestations, which Gitea's
 # registry rejects.
+#
+# Builds are always FRESH: --no-cache so every layer re-runs, and --pull so the FROM
+# image is re-resolved against the registry and replaced if the tag has moved. This
+# is the whole point of not pinning versions — a cached `apk add` layer would keep
+# shipping whatever packages existed when it was first built, and --no-cache alone
+# would still build on a stale local copy of the base image.
+#
+# Costs about 40s per image. Worth it to know that a rebuild means current.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -93,7 +101,7 @@ for image in "$@"; do
 	for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done
 
 	group "build $image"
-	docker build "${tag_args[@]}" \
+	docker build --no-cache --pull "${tag_args[@]}" \
 		--build-arg "VERSION=$version" \
 		--build-arg "REVISION=$revision" \
 		--build-arg "CREATED=$created" \