diff --git a/Dockerfile b/Dockerfile
index 27e0c8b..6d42592 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,9 @@ RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
 
 RUN pip install gradio
 
+# Version of @osaas/cli that docker-entrypoint.sh runs via npx. This is the
+# single place the version is pinned; bump it here.
+ENV OSAAS_CLI_VERSION=4.35.0
 WORKDIR /runner
 COPY ./scripts ./
 RUN chmod +x ./*.sh
diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
index 99a1fa5..a816cc4 100644
--- a/scripts/docker-entrypoint.sh
+++ b/scripts/docker-entrypoint.sh
@@ -229,7 +229,7 @@ if [ -n "${OSC_ACCESS_TOKEN:-}" ] && [ -n "${CONFIG_SVC:-}" ]; then
   # without its environment variables. This runner has no loading server, so
   # (like the setup.sh timeout below) failure is a non-zero exit.
   config_err_file=$(mktemp)
-  config_env_output=$(timeout 60s npx -y @osaas/cli@latest web config-to-env ${OSC_ENV:+--env "$OSC_ENV"} "$CONFIG_SVC" 2>"$config_err_file") && config_exit=0 || config_exit=$?
+  config_env_output=$(timeout 60s npx -y "@osaas/cli@${OSAAS_CLI_VERSION:?OSAAS_CLI_VERSION must be set (pinned in the Dockerfile)}" web config-to-env ${OSC_ENV:+--env "$OSC_ENV"} "$CONFIG_SVC" 2>"$config_err_file") && config_exit=0 || config_exit=$?
   config_err_output=$(cat "$config_err_file" 2>/dev/null || true)
   rm -f "$config_err_file"
   config_failed=0
diff --git a/tests/test-entrypoint-config-load-failure.sh b/tests/test-entrypoint-config-load-failure.sh
index f11979d..bb55a5c 100755
--- a/tests/test-entrypoint-config-load-failure.sh
+++ b/tests/test-entrypoint-config-load-failure.sh
@@ -50,7 +50,7 @@ run_block() {
   echo $?
 }
 
-ENVV=(OSC_ACCESS_TOKEN=tok CONFIG_SVC=store)
+ENVV=(OSC_ACCESS_TOKEN=tok CONFIG_SVC=store OSAAS_CLI_VERSION=4.35.0)
 
 # Failure paths: non-zero exit and never reach the next phase
 rc=$(run_block timeout "${ENVV[@]}")