diff --git a/docker/Dockerfile b/docker/Dockerfile
index 4c1514b2..6d15f10c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -98,28 +98,51 @@ RUN --mount=type=cache,target=/root/.cache/uv,sharing=locked \
     mv /opt/odoo-src /opt/odoo/odoo; \
     uv pip install --no-deps -e /opt/odoo/odoo
 
+# Third-party addon refs. Each takes a branch or a commit sha, so a deployment
+# can pin an exact commit instead of tracking a moving branch. A tag name is not
+# accepted (it resolves under refs/tags, which this does not build) - pass the
+# commit sha the tag points at:
+# docker build --build-arg OCA_SERVER_UX_REF=<sha> ...
+# Declared here rather than at the top of the stage so that changing a ref
+# only invalidates the download layer below.
+ARG OCA_SERVER_UX_REF=19.0
+ARG OCA_SERVER_TOOLS_REF=19.0
+ARG ODOO_JOB_WORKER_REF=19.0
+ARG OCA_SERVER_BACKEND_REF=19.0
+ARG OCA_REST_FRAMEWORK_REF=19.0
+ARG MUK_IT_REF=19.0
+
 # Download OCA dependencies in builder (cache tarballs to avoid re-downloading)
 RUN --mount=type=cache,target=/tmp/downloads,sharing=locked \
     set -eux; \
     download_module() { \
         local repo=$1; \
         local dest=$2; \
-        local branch=${3:-19.0}; \
-        local tarball="/tmp/downloads/${dest}-${branch}.tar.gz"; \
+        local ref=${3:-19.0}; \
+        local tarball="/tmp/downloads/${dest}-${ref}.tar.gz"; \
+        local url="/${repo}/archive/refs/heads/${ref}.tar.gz"; \
+        # A commit sha sits under no ref namespace: GitHub serves it from
+        # /archive/<sha>.tar.gz and 404s on /archive/refs/heads/<sha>.tar.gz.
+        # 7+ hex digits is a sha (short or full); anything else is a branch.
+        case "$ref" in \
+            *[!0-9a-fA-F]*) ;; \
+            ???????*) url="/${repo}/archive/${ref}.tar.gz";; \
+        esac; \
         if [ ! -f "$tarball" ] || ! gzip -t "$tarball" 2>/dev/null; then \
             rm -f "$tarball"; \
-            curl -sSL -o "$tarball" \
-                "/${repo}/archive/refs/heads/${branch}.tar.gz"; \
+            # -f so a bad ref fails here with the 404, not later in tar with
+            # "not in gzip format" over a 14-byte error body.
+            curl -fsSL -o "$tarball" "$url"; \
         fi; \
         mkdir -p /opt/extra-addons/${dest}; \
         tar -xzf "$tarball" -C /opt/extra-addons/${dest} --strip-components=1; \
     }; \
-    download_module "OCA/server-ux" "server-ux"; \
-    download_module "OCA/server-tools" "server-tools"; \
-    download_module "OpenSPP/odoo-job-worker" "odoo-job-worker"; \
-    download_module "OCA/server-backend" "server-backend"; \
-    download_module "OCA/rest-framework" "rest-framework"; \
-    download_module "muk-it/odoo-modules" "muk-it"
+    download_module "OCA/server-ux" "server-ux" "${OCA_SERVER_UX_REF}"; \
+    download_module "OCA/server-tools" "server-tools" "${OCA_SERVER_TOOLS_REF}"; \
+    download_module "OpenSPP/odoo-job-worker" "odoo-job-worker" "${ODOO_JOB_WORKER_REF}"; \
+    download_module "OCA/server-backend" "server-backend" "${OCA_SERVER_BACKEND_REF}"; \
+    download_module "OCA/rest-framework" "rest-framework" "${OCA_REST_FRAMEWORK_REF}"; \
+    download_module "muk-it/odoo-modules" "muk-it" "${MUK_IT_REF}"
 
 # Precompile Python files (ignore errors from Python 2 syntax in some packages)
 RUN python -m compileall -q /opt/venv/lib/ || true
diff --git a/docker/README.md b/docker/README.md
index 5f6cef07..ccf3d300 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -349,6 +349,33 @@ docker build -f docker/Dockerfile -t openspp .
 docker build --build-arg INSTALL_DEV=1 -f docker/Dockerfile -t openspp:dev .
 ```
 
+### Pinning third-party addons
+
+The OCA and third-party addon repositories are downloaded during the build. Each one has
+a `*_REF` build argument that accepts a branch or a commit sha and defaults to `19.0`. A
+tag name is not accepted - resolve it to the commit sha it points at and pin that:
+
+| Build arg                | Repository                |
+| ------------------------ | ------------------------- |
+| `OCA_SERVER_UX_REF`      | `OCA/server-ux`           |
+| `OCA_SERVER_TOOLS_REF`   | `OCA/server-tools`        |
+| `ODOO_JOB_WORKER_REF`    | `OpenSPP/odoo-job-worker` |
+| `OCA_SERVER_BACKEND_REF` | `OCA/server-backend`      |
+| `OCA_REST_FRAMEWORK_REF` | `OCA/rest-framework`      |
+| `MUK_IT_REF`             | `muk-it/odoo-modules`     |
+
+```bash
+# Reproducible build: pin the addons to exact commits
+docker build \
+    --build-arg OCA_SERVER_UX_REF=8e5120600987969156c2a59c1ad86bec37318966 \
+    --build-arg OCA_SERVER_TOOLS_REF=028b450b06ebd70424534cbd89f37ed134f7200d \
+    -f docker/Dockerfile -t openspp .
+```
+
+Left unset, an argument follows the head of the `19.0` branch, so two builds of the same
+OpenSPP commit can end up with different addon code. Pin the refs for builds that have
+to be reproducible.
+
 ## Health Check
 
 The container exposes a health endpoint at `/web/health` on port 8069.