diff --git a/Dockerfile b/Dockerfile
index 91cbb94..c5b83c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,4 @@
-# syntax=docker/dockerfile:1
-ARG BASE_IMAGE=docker.io/almalinux:9
+ARG BASE_IMAGE=artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9
 
 FROM ${BASE_IMAGE} AS image
 ARG DISTRO=alma9
diff --git a/README.md b/README.md
index 0294588..4c81b4f 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<
 
 | distro | image | from |
 | --- | --- | --- |
-| `alma9` | `almalinux9` | `docker.io/almalinux:9` |
+| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
 
 Each image bootstraps the internal CA, installs the estate dnf repository
 configuration pointed at artifactapi, and installs the base package set.
diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env
index 877acde..ffe5b18 100644
--- a/distros/alma9/distro.env
+++ b/distros/alma9/distro.env
@@ -1,5 +1,8 @@
 # alma9 — AlmaLinux 9
-BASE_IMAGE="docker.io/almalinux:9"
+# Pulled through the artifactapi dockerhub remote: a buildkit FROM does its own pull
+# and ignores the nodes' containerd mirror. The library/ prefix is required — the
+# remote allowlists ^library/almalinux, so dockerhub/almalinux:9 returns 403.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 IMAGE="almalinux9"
 
 # Bootstrap of the internal CA. The image cannot trust artifactapi over HTTPS until