diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6c778b6..04e8df6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,8 +74,8 @@ jobs:
             image: meshcore-hopreach
             context: third_party/hopreach
             file: third_party/hopreach/Dockerfile
-            source_revision: f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6
-            build_args: VERSION=v0.1.32-ukmesh.2
+            source_revision: 0230702be70a2729c5acc5640401f56ab9d65fd4
+            build_args: VERSION=v0.1.32-ukmesh.3
           - component: ml-path-learner
             image: meshcore-ml-path-learner
             context: ml-path-learner
@@ -107,6 +107,8 @@ jobs:
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.revision=${{ env.SOURCE_REVISION }}
           tags: |
             type=sha,format=long
             type=ref,event=tag
diff --git a/README.md b/README.md
index f5c2e91..96ce0f0 100644
--- a/README.md
+++ b/README.md
@@ -399,7 +399,7 @@ This project is built on the following open source libraries and tools:
 ### RF and link workers
 | Package | License |
 |---|---|
-| [HopReach v0.1.32-ukmesh.2](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2) | AGPL-3.0 plus Commons Clause |
+| [HopReach v0.1.32-ukmesh.3](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3) | AGPL-3.0 plus Commons Clause |
 | [NumPy](https://numpy.org) | BSD 3-Clause |
 | [SciPy](https://scipy.org) | BSD 3-Clause |
 | [Shapely](https://shapely.readthedocs.io) | BSD 3-Clause |
diff --git a/docker-compose.yml b/docker-compose.yml
index 5d0c6f4..50989be 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -560,7 +560,7 @@ services:
       context: ./third_party/hopreach
       dockerfile: Dockerfile
       args:
-        VERSION: v0.1.32+ukmesh
+        VERSION: v0.1.32-ukmesh.3
         SOURCE_REVISION: ${SOURCE_REVISION:-local}
     restart: always
     logging: *json-log-limits
diff --git a/docs/architecture.md b/docs/architecture.md
index 9b362f8..c956bad 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -16,8 +16,8 @@
 The complete HopReach v0.1.32 source is vendored at
 `third_party/hopreach`, with the exact upstream revision recorded in
 `UPSTREAM_COMMIT`. The identical derived source is public as
-[`v0.1.32-ukmesh.2`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
-at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`. The unmodified upstream CPU
+[`v0.1.32-ukmesh.3`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
+at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`. The unmodified upstream CPU
 raster remains an executable accuracy oracle. The production CPU path retains
 the same propagation equations, DEM samples, free-space path loss, 4/3-earth
 curvature, knife-edge diffraction, link budget, and margin calculation while
diff --git a/docs/rf-coverage-rollout.md b/docs/rf-coverage-rollout.md
index 1d17249..68ec687 100644
--- a/docs/rf-coverage-rollout.md
+++ b/docs/rf-coverage-rollout.md
@@ -1,13 +1,12 @@
 # HopReach RF coverage rollout and recovery
 
-Status: implemented and verified locally; production rollout is not performed
-by this change.
+Status: implemented and release-gated for production rollout.
 
 Evidence date: 2026-08-02
 
 Canonical model: the public UK Mesh HopReach tag
-[`v0.1.32-ukmesh.2`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
-at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`, based directly on upstream
+[`v0.1.32-ukmesh.3`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
+at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`, based directly on upstream
 v0.1.32 commit `61efac0b4678f55496fe08f53eda0c79eb18655b`. The tagged tree is vendored
 at `third_party/hopreach`.
 
@@ -20,7 +19,7 @@ at `third_party/hopreach`.
 - Use digest-pinned backend, HopReach, and app images built by the signed
   release workflow. Confirm the backend/app revision label is the integration
   release commit and the HopReach revision label is
-  `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`.
+  `0230702be70a2729c5acc5640401f56ab9d65fd4`.
 - Do not enable calibrated variants. The production profile deliberately has
   `calibration.enabled: false`; evidence validation is a separate rollout.
 - Do not reduce range, node count, terrain zoom, supersampling, or RF fidelity
@@ -70,9 +69,10 @@ From a clean reviewed revision:
 docker compose config --quiet
 docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp \
   -v "$PWD:/work" -w /work/third_party/hopreach \
-  golang:1.23-bookworm go test ./...
+  golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 go test ./...
 docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp \
-  -v "$PWD:/work" -w /work golang:1.23-bookworm \
+  -v "$PWD:/work" -w /work \
+  golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 \
   /work/scripts/benchmark-hopreach.sh
 ```
 
diff --git a/rf-coverage/SOURCE-OFFER.md b/rf-coverage/SOURCE-OFFER.md
index 7399de0..3c70fba 100644
--- a/rf-coverage/SOURCE-OFFER.md
+++ b/rf-coverage/SOURCE-OFFER.md
@@ -1,9 +1,9 @@
 # HopReach corresponding source
 
 The deployed RF calculator's complete corresponding source is public in the
-[UK Mesh HopReach fork](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
-at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`, immutably tagged
-`v0.1.32-ukmesh.2`. That revision is based directly on upstream HopReach
+[UK Mesh HopReach fork](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
+at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`, immutably tagged
+`v0.1.32-ukmesh.3`. That revision is based directly on upstream HopReach
 v0.1.32 commit `61efac0b4678f55496fe08f53eda0c79eb18655b` and contains the
 identifiable UK Mesh modifications vendored in `third_party/hopreach`.
 
diff --git a/scripts/replace-container.sh b/scripts/replace-container.sh
index d4a534c..821c993 100755
--- a/scripts/replace-container.sh
+++ b/scripts/replace-container.sh
@@ -321,9 +321,9 @@ smoke_service() {
   docker compose --project-name "$project_name" exec -T backend \
     wget -qO- http://127.0.0.1:3000/readyz \
     | jq -e '.status == "ready"' >/dev/null
-  docker compose --project-name "$project_name" exec -T backend \
-    wget -qO- http://127.0.0.1:9091/metrics \
-    | grep -q '^meshcore_process_'
+  metrics="$(docker compose --project-name "$project_name" exec -T backend \
+    wget -qO- http://127.0.0.1:9091/metrics)"
+  grep -q '^meshcore_process_' <<<"$metrics"
   case "$target_service" in
     backend)
       curl --fail --silent http://127.0.0.1:3000/readyz \
diff --git a/third_party/hopreach/Dockerfile b/third_party/hopreach/Dockerfile
index 1d58eba..63ebcaa 100644
--- a/third_party/hopreach/Dockerfile
+++ b/third_party/hopreach/Dockerfile
@@ -4,7 +4,7 @@
 # COVERAGE_GPU_MODE) links against wgpu-native's prebuilt static libs, which
 # target glibc. The runtime stage below has to follow suit for the same
 # reason.
-FROM golang:1.23-bookworm AS build
+FROM golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 AS build
 # VERSION is passed by .github/workflows/release.yml as the git tag that
 # triggered this build (e.g. v0.1.8) — "dev" (buildinfo's own default,
 # unmistakable in the UI/analytics page) if built some other way, e.g.
@@ -26,7 +26,7 @@ RUN CGO_ENABLED=1 go build -ldflags "-X hopreach/internal/buildinfo.Version=${VE
 # drifting JS copy. wasm_exec.js (Go's own runtime shim) is copied from
 # this same build stage so it's always paired with the Go version that
 # actually compiled the module.
-FROM golang:1.23-bookworm AS wasmbuild
+FROM golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 AS wasmbuild
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -42,7 +42,7 @@ RUN GOOS=js GOARCH=wasm go build -o /out/hopreach.wasm ./wasm \
 # `devices:` block) — otherwise gpu.mode=auto's probe simply finds nothing
 # and falls back to CPU, same as always. They're a modest image size cost
 # either way, not a functional requirement.
-FROM nginx:bookworm
+FROM ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb
 ARG SOURCE_REVISION=unknown
 ARG VERSION=v0.1.32+ukmesh
 LABEL org.opencontainers.image.revision="${SOURCE_REVISION}" \
@@ -50,8 +50,9 @@ LABEL org.opencontainers.image.revision="${SOURCE_REVISION}" \
       org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.licenses="AGPL-3.0-only WITH Commons-Clause"
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends libvulkan1 mesa-vulkan-drivers cron curl \
-  && rm -rf /var/lib/apt/lists/*
+  && apt-get install -y --no-install-recommends \
+       nginx cron curl libvulkan1 mesa-vulkan-drivers ca-certificates \
+  && rm -rf /var/lib/apt/lists/* /etc/nginx/sites-enabled/default
 
 COPY --from=build /app/hopreach /app/hopreach
 COPY --from=build /app/hopreach-shareapi /app/hopreach-shareapi
@@ -64,7 +65,7 @@ COPY docker/config.docker.yaml /config/config.yaml
 COPY LICENSE UPSTREAM_COMMIT /usr/share/doc/hopreach/
 RUN chmod +x /entrypoint.sh /app/hopreach /app/hopreach-shareapi \
   && mkdir -p /data/dem-cache /data/shared-plans /var/cache/nginx/dem-tiles \
-  && chown -R nginx:nginx /var/cache/nginx/dem-tiles
+  && chown -R www-data:www-data /var/cache/nginx/dem-tiles
 
 # The only environment variable HopReach's own binaries read — everything
 # else lives in config.yaml (see /config/config.yaml, baked in above from
diff --git a/third_party/hopreach/docker/entrypoint.sh b/third_party/hopreach/docker/entrypoint.sh
index c1aa832..2e74fe5 100644
--- a/third_party/hopreach/docker/entrypoint.sh
+++ b/third_party/hopreach/docker/entrypoint.sh
@@ -13,7 +13,11 @@ mkdir -p /data/dem-cache /data/shared-plans
 /app/hopreach -prepare
 
 touch /var/log/fetch.log /var/log/prune.log
-cron -f &
+if command -v cron >/dev/null 2>&1; then
+  cron -f &
+else
+  crond -f &
+fi
 tail -F /var/log/fetch.log /var/log/prune.log &
 
 # The terrain-aware coverage computation can take minutes on first run (DEM