diff --git a/.semgrep.yml b/.semgrep.yml
index 5eb3ed69..b9673b01 100644
--- a/.semgrep.yml
+++ b/.semgrep.yml
@@ -41,12 +41,15 @@ rules:
       - pattern-not-inside: |
           pub async fn $FUNC(...) -> ... {
             ...
-            $AUTH_CHECK
+            $AUTH_CHECK(...)
             ...
           }
       - metavariable-regex:
           metavariable: $FUNC
           regex: (resolve_market|admin_.*|delete_.*|update_.*)
+      - metavariable-regex:
+          metavariable: $AUTH_CHECK
+          regex: (require_admin|check_auth|verify_admin|assert_admin|ensure_authorized)
     message: Admin function may be missing authentication check
     severity: WARNING
     languages: [rust]
diff --git a/services/tts/Dockerfile b/services/tts/Dockerfile
index 2a9bd5ed..aae4f424 100644
--- a/services/tts/Dockerfile
+++ b/services/tts/Dockerfile
@@ -1,8 +1,10 @@
 # Multi-stage build for PredictIQ TTS Service
 # Pinned to Node.js 20 LTS (matching the "engines" field in package.json)
+# node:20-alpine (20.19.0) digest verified on 2025-07-25
+# Index digest covers linux/amd64 and linux/arm64 manifests
 
 # ── Stage 1: Builder ─────────────────────────────────────────────────────────
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:658d0f63e501824d6c23e06d4bb95c71e7d704537c9d9272f488ac03a370d448 AS builder
 
 WORKDIR /build
 
@@ -18,7 +20,7 @@ COPY src ./src
 RUN npm run build
 
 # ── Stage 2: Runtime ─────────────────────────────────────────────────────────
-FROM node:20-alpine AS runtime
+FROM node:20-alpine@sha256:658d0f63e501824d6c23e06d4bb95c71e7d704537c9d9272f488ac03a370d448 AS runtime
 
 # Create a non-root user to prevent container-escape privilege escalation
 RUN addgroup -S ttsgroup && adduser -S ttsuser -G ttsgroup