diff --git a/.github/workflows/build-and-publish-image.yml b/.github/workflows/build-and-publish-image.yml
index 5639814..1842a98 100644
--- a/.github/workflows/build-and-publish-image.yml
+++ b/.github/workflows/build-and-publish-image.yml
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  BASE_TAG: 2026.07
+  BASE_TAG: sha256:7b927cacf635dede11390524f4849450661f927636c15eae08979da9be551d89
   IMAGE_NAME: ghcr.io/ecotrust/wcoa
 
 jobs:
diff --git a/docker/compose.prod.yml b/docker/compose.prod.yml
index d394be2..87111bb 100644
--- a/docker/compose.prod.yml
+++ b/docker/compose.prod.yml
@@ -10,13 +10,13 @@ services:
     environment:
       - DB_INIT=${DB_INIT:-0}
       - MP_PROJECT_CONFIG=/usr/local/apps/madrona-portal/apps/wcoa/docker/config.wcoa.docker.ini
-      - SECRET_KEY=${SECRET_KEY}
+      - SECRET_KEY=${SECRET_KEY:?SECRET_KEY must be set}
       - ALLOWED_HOSTS=${ALLOWED_HOSTS:-localhost,127.0.0.1,::1}
       - DEBUG=${DEBUG:-False}
       - DB_ENGINE=${DB_ENGINE:-django.contrib.gis.db.backends.postgis}
       - DB_NAME=${DB_NAME:-wcoa_docker_db}
       - DB_USER=${DB_USER:-postgres}
-      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_PASSWORD=${DB_PASSWORD:?DB_PASSWORD must be set}
       - DB_HOST=db
       - DB_PORT=5432
       - REDIS_URL=redis://${REDIS_PASSWORD:+:${REDIS_PASSWORD}@}tasks:6379/1