diff --git a/Containerfile b/Containerfile
index ad8a6d6..d387b6d 100644
--- a/Containerfile
+++ b/Containerfile
@@ -313,16 +313,24 @@ RUN set -euo pipefail && \
     cd /home/developer && rm -rf /tmp/golangci && \
     golangci-lint --version
 
-# Install gofi UniFi utilities (gofips, gofimac). The module path declared in
-# go.mod (github.com/unifi-go/gofi) does not match the public repo, so a plain
+# Install the gofi UniFi utility. The module path declared in go.mod
+# (github.com/unifi-go/gofi) does not match the public repo, so a plain
 # `go install ...@latest` cannot resolve it -- clone and build directly instead.
 # `cd` to a known-good dir first: `go build` calls getwd and the RUN shell's
 # inherited cwd is not usable here (the go install steps above avoid getwd).
+#
+# Upstream consolidated gofips/gofimac/gofinet/gofidns/gofiuser into a single `gofi`
+# binary (a BREAKING change in its CHANGELOG's Unreleased section), which removed
+# ./utilities/gofips and ./utilities/gofimac and broke this build. Pinned to a commit
+# rather than tracking the default branch so the next upstream restructure cannot
+# break the image again; bump GOFI_REF deliberately. Note the repo's only tag, v0.1.0,
+# predates the utilities/ layout entirely and is not a usable pin.
+ARG GOFI_REF=4ca96091d8f50895dc6ccc6f1d4cf29a513a8ce0
 RUN cd /home/developer && \
-    git clone --depth 1 https://github.com/emergingrobotics/gofi gofi-src && \
+    git clone https://github.com/emergingrobotics/gofi gofi-src && \
     cd gofi-src && \
-    go build -o "${GOPATH}/bin/gofips" ./utilities/gofips && \
-    go build -o "${GOPATH}/bin/gofimac" ./utilities/gofimac && \
+    git checkout --detach "${GOFI_REF}" && \
+    go build -o "${GOPATH}/bin/gofi" ./utilities/gofi && \
     cd /home/developer && rm -rf gofi-src && \
     go clean -cache