diff --git a/deploy/README.md b/deploy/README.md
index e3651f6..ea8bd3f 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -8,7 +8,7 @@ the server port or export a copy before applying.
 Apply order is documented in `docs/operator-runbook.md`. Do not apply the
 Deployment until:
 
-1. The image digest is pinned (currently `sha256:304cfb83…` built from source commit `818589359ae343d821a009413823f4456962c0d1`, AUDIT-WP-0013-T07).
+1. The image digest is pinned (currently `sha256:5f3d01c8…` built from source commit `2b8c9097adaef67c88f329452e42eca1d74b65a7`, AUDIT-WP-0018-T03).
 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
    `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
    applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
@@ -41,3 +41,10 @@ built from `818589359ae343d821a009413823f4456962c0d1`. It carries the T06
 independent full-scope reconciliation reader and the AUDIT-WP-0018-T02
 reject-only secret_policy overlay. No migration beyond 0007 is added, so no
 migration Job run is required; rollback to `b479801b…` stays schema-compatible.
+
+AUDIT-WP-0018-T03 (2026-11-03) re-pins receiver and migration Job to
+`forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6`,
+built from `2b8c9097adaef67c88f329452e42eca1d74b65a7`. It adds the
+`opening_without_closing` stream finding (`closing_classes`). No schema
+change and no migration Job rerun are needed. Rollback to `304cfb83…` is
+compatible: the older image ignores the `closing_classes` overlay key.
diff --git a/deploy/audit-core.yaml b/deploy/audit-core.yaml
index 1c99598..80bda92 100644
--- a/deploy/audit-core.yaml
+++ b/deploy/audit-core.yaml
@@ -86,7 +86,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/deploy/migrate-job.yaml b/deploy/migrate-job.yaml
index 668ff4d..4c1af3d 100644
--- a/deploy/migrate-job.yaml
+++ b/deploy/migrate-job.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env: