diff --git a/Dockerfile b/Dockerfile
index b0ec93b..2586e85 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -73,8 +73,8 @@ RUN npm install -g single-file-cli
 # conflicts with Debian's system Python packages.
 RUN python3 -m venv /opt/archivr-venv \
     && /opt/archivr-venv/bin/pip install --no-cache-dir \
-        yt-dlp \
-        twitter-api-client
+        "yt-dlp==2026.8.19" \
+        "twitter-api-client==0.10.22"
 
 # Download Chromium extensions used during headless captures.
 # uBlock Origin Lite (MV3) — ad/tracker blocking.
diff --git a/docs/README.md b/docs/README.md
index 8e4d3c9..1b8fb80 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -319,6 +319,15 @@ nix build .#archivr-server
 git commit -am "chore(nix): yt-dlp OLD → $NEW"
 ```
 
+**4. Docker:** yt-dlp is pinned to a specific version in the `Dockerfile` (`pip install "yt-dlp==<version>"`), matching the Nix pin. To update, bump the version string in the `Dockerfile` venv install step to match the new Nix version, then rebuild:
+
+```sh
+docker build -t archivr-server .
+docker compose up -d
+```
+
+There is no in-container self-update path — `archivr yt-dlp update` writes to a host state directory that does not survive container restarts. Rebuild the image when captures start returning HTTP 403.
+
 ## Deployment
 
 ### Security