diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index 2501d03..6d043b0 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.10
+# syntax=mirror.gcr.io/docker/dockerfile:1.10@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
 #
 # svcforge api. Build from the REPO ROOT:
 #     docker buildx build -f services/api/Dockerfile -t svcforge/api:dev .
@@ -8,6 +8,7 @@
 # expensive layer (third-party wheels) must land before the cheap one (our source).
 
 FROM mirror.gcr.io/library/python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS builder
+RUN cd /tmp && echo "hadolint control - this line must fail CI"
 
 COPY --from=ghcr.io/astral-sh/uv:0.11.29@sha256:eb2843a1e56fd9e30c7276ce1a52cba86e64c7b385f5e3279a0e08e02dd058fc /uv /usr/local/bin/uv