diff --git a/versions.env b/versions.env
new file mode 100644
index 0000000..71c6bcc
--- /dev/null
+++ b/versions.env
@@ -0,0 +1,29 @@
+# Central image versions for AtlasHorizon/compose.
+# Each compose file reads its images from here via ${VAR:?}; Ansible
+# downloads this next to docker-compose.yml and passes it as a second
+# --env-file. One variable per service+component, so e.g. each Postgres
+# can be upgraded independently (major bumps need a dump/restore).
+
+# --- grist ---
+GRIST_IMAGE=gristlabs/grist:1.7.21
+
+# --- domain-watchdog ---
+# App and worker must stay on the same version.
+DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6
+# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL).
+DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine
+DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2
+
+# --- nametag ---
+NAMETAG_IMAGE=ghcr.io/mattogodoy/nametag:0.66.0
+NAMETAG_POSTGRES_IMAGE=postgres:16.15-alpine
+NAMETAG_REDIS_IMAGE=redis:7.4.11-alpine
+# Keep the major in line with NAMETAG_POSTGRES_IMAGE.
+NAMETAG_BACKUP_IMAGE=prodrigestivill/postgres-backup-local:16-alpine
+NAMETAG_CRON_IMAGE=alpine:3.24.3
+
+# --- supernote ---
+SUPERNOTE_MARIADB_IMAGE=mariadb:10.6.24
+SUPERNOTE_REDIS_IMAGE=redis:7.4.7
+SUPERNOTE_NOTELIB_IMAGE=docker.io/supernote/notelib:6.9.3
+SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04