diff --git a/Dockerfile b/Dockerfile
index 0707f7ab..74e431f2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,6 +18,7 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd ./cmd/uncloudd
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
 ARG TARGETARCH
+ARG CORROSION_VERSION
 
 RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
       "amd64") echo "x86_64" ;; \
@@ -25,20 +26,21 @@ RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
       *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
     esac) \
     && wget -q -O /tmp/corrosion.tar.gz \
-      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
+      "https://github.com/psviderski/corrosion/releases/download/v${CORROSION_VERSION}/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
-    && install /tmp/corrosion /usr/local/bin/corrosion \
+    && install /tmp/corrosion /usr/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
 # Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
 # e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
-FROM gcr.io/distroless/cc-debian12:latest AS corrosion
-COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
+FROM gcr.io/distroless/cc-debian13:latest AS corrosion
+COPY --from=corrosion-download /usr/bin/corrosion /usr/bin/corrosion
 CMD ["corrosion", "agent"]
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-image-tarball
-ARG CORROSION_IMAGE="ghcr.io/psviderski/corrosion:latest"
+ARG CORROSION_VERSION
+ARG CORROSION_IMAGE="ghcr.io/unlabs-dev/corrosion:${CORROSION_VERSION}"
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -47,6 +49,8 @@ RUN crane pull --platform ${TARGETOS}/${TARGETARCH} "${CORROSION_IMAGE}" /corros
 
 # Uncloud-in-Docker (ucind) image for running Uncloud test clusters using Docker.
 FROM docker:29.4.0-dind AS ucind
+ARG CORROSION_VERSION
+
 # Create system group and user 'uncloud'.
 RUN addgroup -S uncloud && adduser -SHD -h /nonexistent -G uncloud -g "" uncloud
 RUN apk --no-cache add \
diff --git a/Makefile b/Makefile
index 14ae3ef4..64cf80fd 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 # TODO: Makefile is deprecated, add new targets as mise tasks in mise.toml instead.
 
-CORROSION_IMAGE ?= ghcr.io/psviderski/corrosion:latest
+CORROSION_VERSION ?= 2026.5.14
+CORROSION_IMAGE = ghcr.io/unlabs-dev/corrosion:$(CORROSION_VERSION)
 UCIND_IMAGE ?= ghcr.io/psviderski/ucind:latest
 
 .PHONY: ucind-cluster
@@ -9,11 +10,12 @@ ucind-cluster:
 
 .PHONY: corrosion-image
 corrosion-image:
-	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
+	docker build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) -t "$(CORROSION_IMAGE)" --target corrosion .
 
 .PHONY: corrosion-multiarch-image-push
 corrosion-multiarch-image-push:
-	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
+	docker buildx build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) --push --platform linux/amd64,linux/arm64 \
+		-t "$(CORROSION_IMAGE)" --target corrosion .
 
 .PHONY: ucind-multiarch-image-push
 ucind-multiarch-image-push:
diff --git a/internal/machine/corroservice/docker.go b/internal/machine/corroservice/docker.go
index 4ea98d63..704cebaf 100644
--- a/internal/machine/corroservice/docker.go
+++ b/internal/machine/corroservice/docker.go
@@ -16,9 +16,8 @@ import (
 	"github.com/docker/docker/client"
 )
 
-const (
-	LatestImage = "ghcr.io/psviderski/corrosion:latest"
-)
+// Image is the Corrosion image pinned to the uncloudd release.
+const Image = "ghcr.io/unlabs-dev/corrosion:2026.5.14"
 
 type DockerService struct {
 	Client  *client.Client
diff --git a/internal/machine/machine.go b/internal/machine/machine.go
index 0850bd2d..442714ff 100644
--- a/internal/machine/machine.go
+++ b/internal/machine/machine.go
@@ -131,7 +131,7 @@ func (c *Config) SetDefaults() (*Config, error) {
 
 			cfg.CorrosionService = &corroservice.DockerService{
 				Client:  cfg.DockerClient,
-				Image:   corroservice.LatestImage,
+				Image:   corroservice.Image,
 				Name:    "uncloud-corrosion",
 				DataDir: cfg.CorrosionDir,
 				User:    fmt.Sprintf("%d:%d", uid, gid),
diff --git a/mise.toml b/mise.toml
index ca11aeb0..be271658 100644
--- a/mise.toml
+++ b/mise.toml
@@ -12,6 +12,7 @@ protoc-gen-go = "1.34.2"
 protoc-gen-go-grpc = "1.5.1"
 
 [vars]
+corrosion_version = "2026.5.14"
 ucind_image = "ghcr.io/psviderski/ucind:latest"
 
 [env]
@@ -56,7 +57,7 @@ run = "go run ./cmd/ucind"
 
 [tasks."ucind:image"]
 description = "Build the ucind Docker image"
-run = "docker build -t {{vars.ucind_image}} --target ucind ."
+run = "docker build --build-arg CORROSION_VERSION={{vars.corrosion_version}} -t {{vars.ucind_image}} --target ucind ."
 
 [tasks."ucind:cleanup"]
 description = "Remove ucind managed containers and networks"