diff --git a/versions.env b/versions.env
index e9f93d9..19b2a60 100644
--- a/versions.env
+++ b/versions.env
@@ -32,4 +32,22 @@ SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04
 # The hub and agents share the TLS pair baked into the image, so this must
 # match the agent tag on ai, oswald_runner, oswl_connector and the TrueNAS hosts.
 DOZZLE_IMAGE=amir20/dozzle:v11.1.1
-ALERTA_IMAGE=alerta/alerta-web:9.1.0
\ No newline at end of file
+ALERTA_IMAGE=alerta/alerta-web:9.1.0
+
+# --- ai (Flatcar) ---
+GITEA_MCP_IMAGE=docker.gitea.com/gitea-mcp-server:1.11.0
+LITELLM_IMAGE=docker.litellm.ai/berriai/litellm:v1.106.4
+QDRANT_IMAGE=qdrant/qdrant:v1.19.1
+OPEN_TERMINAL_IMAGE=ghcr.io/open-webui/open-terminal:0.14.0
+OPEN_WEBUI_IMAGE=ghcr.io/open-webui/open-webui:v0.11.4
+OPENCODE_IMAGE=ghcr.io/anomalyco/opencode:1.18.32
+
+# --- oswald_runner (Flatcar) ---
+GITEA_RUNNER_IMAGE=docker.io/gitea/runner:3.5.0
+N8N_IMAGE=docker.n8n.io/n8nio/n8n:2.40.5
+CISA_KEV_RSS_IMAGE=ghcr.io/xsaveopt/cisa-kev-rss:0.0.5
+# Domain Watchdog here shares DOMAIN_WATCHDOG_IMAGE and
+# DOMAIN_WATCHDOG_VALKEY_IMAGE with the compose deployment.
+
+# --- oswl_connector (Flatcar) ---
+TAILSCALE_IMAGE=docker.io/tailscale/tailscale:v1.104.2