diff --git a/.github/ISSUE_TEMPLATE/todo-media-storage.md b/.github/ISSUE_TEMPLATE/todo-media-storage.md
index ed95847cd..7c72b4eb8 100644
--- a/.github/ISSUE_TEMPLATE/todo-media-storage.md
+++ b/.github/ISSUE_TEMPLATE/todo-media-storage.md
@@ -40,7 +40,7 @@ Integrate MinIO (or Nhost Storage) for handling file uploads including avatars,
    ```yaml
    # docker-compose.yml
    minio:
-     image: minio/minio:latest
+     image: quay.io/minio/minio:latest
      ports:
        - '9000:9000'
        - '9001:9001'
diff --git a/.github/deploy/docker/docker-compose.production.yml b/.github/deploy/docker/docker-compose.production.yml
index bc2c6667a..c0867d6a4 100644
--- a/.github/deploy/docker/docker-compose.production.yml
+++ b/.github/deploy/docker/docker-compose.production.yml
@@ -254,7 +254,7 @@ services:
   # MinIO Storage (Production)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage
     restart: unless-stopped
     environment:
diff --git a/.github/deploy/docker/docker-compose.staging.yml b/.github/deploy/docker/docker-compose.staging.yml
index cedf45fad..d109f346f 100644
--- a/.github/deploy/docker/docker-compose.staging.yml
+++ b/.github/deploy/docker/docker-compose.staging.yml
@@ -168,7 +168,7 @@ services:
   # MinIO Storage (S3-compatible)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage-staging
     restart: unless-stopped
     ports:
diff --git a/.github/deploy/docker/docker-compose.yml b/.github/deploy/docker/docker-compose.yml
index c7e67b2d7..5cff5f633 100644
--- a/.github/deploy/docker/docker-compose.yml
+++ b/.github/deploy/docker/docker-compose.yml
@@ -138,7 +138,7 @@ services:
   # MinIO Storage (S3-compatible)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage
     restart: unless-stopped
     ports:
diff --git a/.github/deploy/k8s/minio-deployment.yaml b/.github/deploy/k8s/minio-deployment.yaml
index 0b9be2719..8901d94e2 100644
--- a/.github/deploy/k8s/minio-deployment.yaml
+++ b/.github/deploy/k8s/minio-deployment.yaml
@@ -51,7 +51,7 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: quay.io/minio/minio:latest
           imagePullPolicy: IfNotPresent
           ports:
             - name: api
diff --git a/.github/wiki/nself-cli/Services.md b/.github/wiki/nself-cli/Services.md
index 7b6a45b61..eb5f30d98 100644
--- a/.github/wiki/nself-cli/Services.md
+++ b/.github/wiki/nself-cli/Services.md
@@ -1204,7 +1204,7 @@ Enable these services via environment variables in `.backend/.env`.
 
 | Property         | Value                 |
 | ---------------- | --------------------- |
-| **Image**        | `minio/minio:latest`  |
+| **Image**        | `quay.io/minio/minio:latest`  |
 | **API Port**     | 9000                  |
 | **Console Port** | 9001                  |
 | **Console URL**  | http://localhost:9001 |
diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml
index c5decaf1f..0f88fbffb 100644
--- a/.github/workflows/hygiene.yml
+++ b/.github/workflows/hygiene.yml
@@ -280,12 +280,40 @@ jobs:
             exit 0
           fi
 
+          # backend/docker-compose.yml is DELIBERATELY tracked, for CI E2E
+          # provisioning — `nself start --skip-build` needs it present at
+          # checkout. The Doc-Sync step above already carves it out by name and
+          # points at .github/wiki/E2E-Backend-Setup.md; this step did not, so
+          # the two gates contradicted each other: one declared the file
+          # legitimately tracked, the other refused every commit that touched
+          # it. The file could be kept but never corrected, which is how it sat
+          # on a MinIO image that Docker Hub had deleted.
+          #
+          # The carve-out is VERIFIED, not blanket. This gate exists to stop
+          # generated files carrying plaintext credentials into a public repo
+          # (the ntask incident: a generated compose with the postgres password,
+          # Hasura admin secret and JWT keys). That protection is what the
+          # secret check below preserves: every credential-shaped key in this
+          # file must be a ${...} reference, never a literal. A literal value
+          # fails the gate exactly as before, so nothing this gate was built to
+          # catch gets through.
+          ALLOWED_TRACKED_GENERATED='backend/docker-compose.yml'
+
           FAIL=0
           while IFS= read -r f; do
             [ -f "$f" ] || continue
             if head -n 5 "$f" | grep -q "# GENERATED BY"; then
               if git check-ignore -q "$f"; then
                 echo "OK: $f is generated but gitignored."
+              elif [ "$f" = "$ALLOWED_TRACKED_GENERATED" ]; then
+                if literals=$(grep -nE '(PASSWORD|SECRET|KEY|TOKEN)[[:space:]]*[:=]' "$f" | grep -v '\${'); then
+                  echo "ERROR: $f is an allowed tracked generated file, but it now carries literal credential values."
+                  echo "$literals" | sed 's/^/    /'
+                  echo "  Move the value into .env and reference it as \${VAR}, or de-track the file."
+                  FAIL=1
+                else
+                  echo "OK: $f is generated and tracked by design (CI E2E provisioning); no literal credentials."
+                fi
               else
                 echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
                 echo "  -> $f"
diff --git a/backend/docker-compose.yml b/backend/docker-compose.yml
index cf639c0e1..0d955f32e 100644
--- a/backend/docker-compose.yml
+++ b/backend/docker-compose.yml
@@ -264,7 +264,7 @@ services:
   # MinIO Object Storage
   # SECURITY: Bound to localhost only - access via nginx reverse proxy
   minio:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: ${PROJECT_NAME}_minio
     restart: unless-stopped
     user: "1000:1000"