diff --git a/docker-compose/references/05-development-and-production.md b/docker-compose/references/05-development-and-production.md
index cd5b23d..944bf5c 100644
--- a/docker-compose/references/05-development-and-production.md
+++ b/docker-compose/references/05-development-and-production.md
@@ -27,10 +27,10 @@ Run `docker compose up --watch` or `docker compose watch`. `sync` is for hot-rel
 ```bash
 docker compose build --pull
 docker compose config --quiet
-docker compose up -d --wait
-docker compose ps
-docker compose logs --no-color --tail=200
-docker compose down --volumes --remove-orphans
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} up -d --wait
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} ps
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} logs --no-color --tail=200
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} down --volumes --remove-orphans
 ```
 
 Use an isolated project name and deterministic image tags in CI. Do not use destructive volume cleanup against shared environments.
diff --git a/docker-compose/templates/.env.example b/docker-compose/templates/.env.example
new file mode 100644
index 0000000..dfd0854
--- /dev/null
+++ b/docker-compose/templates/.env.example
@@ -0,0 +1,4 @@
+# Compose interpolation inputs. Copy to .env or pass with --env-file.
+IMAGE_TAG=dev
+ADMINER_PORT=8080
+# Never put passwords or API keys here in a committed file.
diff --git a/docker-compose/templates/compose.yaml b/docker-compose/templates/compose.yaml
index 087d140..48a12e1 100644
--- a/docker-compose/templates/compose.yaml
+++ b/docker-compose/templates/compose.yaml
@@ -29,7 +29,7 @@ services:
     networks: [app]
 
   adminer:
-    image: adminer:latest
+    image: adminer@sha256:983261ecc40a4aaf11e25aeda8ef821f5a43a9f024b3967c81cbcc0e6ce43ba3
     depends_on:
       db:
         condition: service_healthy