diff --git a/.env b/.env
index 333955f4..450adb30 100644
--- a/.env
+++ b/.env
@@ -4,6 +4,8 @@
 # Essential
 DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
+# Image tag pinning
+DOCKER_TAG=latest
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
diff --git a/Makefile b/Makefile
index 97545ab9..6fd591fa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,9 @@
 # Find documentation in README.md under
 # the heading "Makefile Options".
 
+include .env
+export
+
 OPENWISP_VERSION = 25.10.0
 SHELL := /bin/bash
 .SILENT: clean pull start stop
@@ -20,7 +23,7 @@ pull:
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
 		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:latest; \
+		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${DOCKER_TAG:-latest}; \
 	done
 
 # Build
diff --git a/docker-compose.yml b/docker-compose.yml
index f010ae3b..4e47e98a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,7 @@ x-celery-depends-on: &celery-depends-on
 
 services:
   dashboard:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -35,7 +35,7 @@ services:
       - influxdb
 
   api:
-    image: openwisp/openwisp-api:latest
+    image: openwisp/openwisp-api:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -55,7 +55,7 @@ services:
       - dashboard
 
   websocket:
-    image: openwisp/openwisp-websocket:latest
+    image: openwisp/openwisp-websocket:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -70,7 +70,7 @@ services:
       - dashboard
 
   celery:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celery
@@ -85,7 +85,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celery_monitoring:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celery_monitoring
@@ -99,7 +99,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celerybeat:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celerybeat
@@ -113,7 +113,7 @@ services:
       - dashboard
 
   nginx:
-    image: openwisp/openwisp-nginx:latest
+    image: openwisp/openwisp-nginx:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -140,7 +140,7 @@ services:
       - websocket
 
   freeradius:
-    image: openwisp/openwisp-freeradius:latest
+    image: openwisp/openwisp-freeradius:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -156,7 +156,7 @@ services:
       - dashboard
 
   postfix:
-    image: openwisp/openwisp-postfix:latest
+    image: openwisp/openwisp-postfix:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -167,7 +167,7 @@ services:
       - openwisp_certs:/etc/ssl/mail
 
   openvpn:
-    image: openwisp/openwisp-openvpn:latest
+    image: openwisp/openwisp-openvpn:${DOCKER_TAG:-latest}
     restart: on-failure
     build:
       context: images