diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 7449521d..00000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches: ["**"]
-  pull_request:
-    branches: ["**"]
-  schedule:
-    - cron: "30 0 * * 1"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: rust
-            build-mode: none
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@nightly
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          dependency-caching: true
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:${{ matrix.language }}"
diff --git a/scripts/set-release-version.sh b/scripts/set-release-version.sh
index d5a3ec8c..8b3256b0 100755
--- a/scripts/set-release-version.sh
+++ b/scripts/set-release-version.sh
@@ -44,10 +44,6 @@ perl -0pi -e '
   s/(defaultAppVersion = '\'')[^'\'']+('\'';)/$1$version$2/;
 ' docs/src/lib/project.ts
 
-perl -0pi -e '
-  s/(\$\{SYNCTV_IMAGE_TAG:-)[^}]+(\})/${1}latest$2/g;
-' docker-compose.yml
-
 perl -0pi -e '
   my $version = $ENV{"SYNCTV_RELEASE_VERSION"};
   s/(--version\s+)[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?/$1$version/g;
@@ -60,12 +56,9 @@ docs_package_version="$(node -p 'require("./docs/package.json").version')"
 docs_lock_version="$(node -p 'require("./docs/package-lock.json").version')"
 docs_lock_root_version="$(node -p 'require("./docs/package-lock.json").packages[""].version')"
 docs_default_app_version="$(node --input-type=module -e 'const project = await import("./docs/src/lib/project.ts"); process.stdout.write(project.dockerImageTag);')"
-compose_image_tag="$(ruby -ryaml -e '
+compose_image="$(ruby -ryaml -e '
   compose = YAML.load_file(ARGV.fetch(0))
-  image = compose.fetch("services").fetch("synctv").fetch("image")
-  match = image.match(/\$\{SYNCTV_IMAGE_TAG:-([^}]+)\}/)
-  abort("docker-compose.yml synctv image must use SYNCTV_IMAGE_TAG fallback") unless match
-  puts match[1]
+  puts compose.fetch("services").fetch("synctv").fetch("image")
 ' docker-compose.yml)"
 
 if [ "$cargo_version" != "$version" ] ||
@@ -75,7 +68,7 @@ if [ "$cargo_version" != "$version" ] ||
   [ "$docs_lock_version" != "$version" ] ||
   [ "$docs_lock_root_version" != "$version" ] ||
   [ "$docs_default_app_version" != "$version" ] ||
-  [ "$compose_image_tag" != "latest" ]; then
+  [ "$compose_image" != "synctvorg/synctv:latest" ]; then
   echo "Failed to synchronize release version across Cargo.toml, Helm chart, Compose, and docs metadata." >&2
   exit 1
 fi
diff --git a/scripts/validate-helm.sh b/scripts/validate-helm.sh
index 24115309..7166ef83 100755
--- a/scripts/validate-helm.sh
+++ b/scripts/validate-helm.sh
@@ -375,27 +375,24 @@ validate_rendered_synctv_config_with_file_storage_s3_secret_files() {
 chart_version="$(ruby -ryaml -e 'puts YAML.load_file(ARGV.fetch(0)).fetch("version")' "$chart_dir/Chart.yaml")"
 app_version="$(ruby -ryaml -e 'puts YAML.load_file(ARGV.fetch(0)).fetch("appVersion")' "$chart_dir/Chart.yaml")"
 cargo_version="$(cargo metadata --format-version 1 --no-deps | node -e 'const fs = require("fs"); const meta = JSON.parse(fs.readFileSync(0, "utf8")); process.stdout.write(meta.workspace_default_members.length ? meta.packages.find((pkg) => pkg.id === meta.workspace_default_members[0]).version : meta.packages[0].version);')"
-compose_image_tag="$(ruby -ryaml -e '
+compose_image="$(ruby -ryaml -e '
   compose = YAML.load_file(ARGV.fetch(0))
-  image = compose.fetch("services").fetch("synctv").fetch("image")
-  match = image.match(/\$\{SYNCTV_IMAGE_TAG:-([^}]+)\}/)
-  abort("docker-compose.yml synctv image must use SYNCTV_IMAGE_TAG fallback") unless match
-  puts match[1]
+  puts compose.fetch("services").fetch("synctv").fetch("image")
 ' docker-compose.yml)"
 docs_default_app_version="$(node --input-type=module -e 'const project = await import("./docs/src/lib/project.ts"); process.stdout.write(project.dockerImageTag);')"
 
 [ -n "$chart_version" ] || fail "$chart_dir/Chart.yaml must define version"
 [ -n "$app_version" ] || fail "$chart_dir/Chart.yaml must define appVersion"
 [ -n "$cargo_version" ] || fail "Cargo.toml must define workspace.package.version"
-[ -n "$compose_image_tag" ] || fail "docker-compose.yml must define SYNCTV_IMAGE_TAG fallback"
+[ -n "$compose_image" ] || fail "docker-compose.yml must define the synctv image"
 [ -n "$docs_default_app_version" ] || fail "docs/src/lib/project.ts must define defaultAppVersion"
 
 [ "$chart_version" = "$cargo_version" ] ||
   fail "chart version ($chart_version) must match Cargo workspace version ($cargo_version)"
 [ "$app_version" = "$cargo_version" ] ||
   fail "chart appVersion ($app_version) must match Cargo workspace version ($cargo_version)"
-[ "$compose_image_tag" = "latest" ] ||
-  fail "Compose image fallback tag ($compose_image_tag) must be latest"
+[ "$compose_image" = "synctvorg/synctv:latest" ] ||
+  fail "Compose image ($compose_image) must be synctvorg/synctv:latest"
 [ "$docs_default_app_version" = "$cargo_version" ] ||
   fail "docs default app version ($docs_default_app_version) must match Cargo workspace version ($cargo_version)"