diff --git a/resources/com/homelab/go-Dockerfile b/resources/com/homelab/go-Dockerfile
index 243405d..91ee2d8 100644
--- a/resources/com/homelab/go-Dockerfile
+++ b/resources/com/homelab/go-Dockerfile
@@ -4,14 +4,23 @@
 # kafka-specific CGO toggle. Assumes a standard single-binary repo layout
 # (main package at the repo root) — a repo with a different structure
 # should just bring its own Dockerfile, same as demo-go-app does.
-FROM golang:${version}-alpine AS build
+# Both stages pulled from Harbor's base-images project (mirrored from
+# Docker Hub via devops-base-images), not Docker Hub directly — see that
+# repo's README for the one-off mirror setup and why (build-time
+# dependency on an external registry, plus wanting to pick the leanest
+# variant of each deliberately rather than accept whatever a public tag
+# defaults to). Only versions actually mirrored there resolve — passing
+# a dockerBuildVersion whose tag isn't in devops-base-images/images.txt
+# yet needs that added and re-mirrored first, unlike pulling straight
+# from Docker Hub where any tag "just worked".
+FROM harbor.192.168.1.7.nip.io/base-images/golang:${version}-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum* ./
 RUN go mod download 2>/dev/null || true
 COPY . .
 RUN CGO_ENABLED=0 go build -o /app .
 
-FROM alpine:3.20
+FROM harbor.192.168.1.7.nip.io/base-images/alpine:3.20
 COPY --from=build /app /app
 EXPOSE 8080
 ENTRYPOINT ["/app"]
diff --git a/resources/com/homelab/java-Dockerfile b/resources/com/homelab/java-Dockerfile
index 1dc4bf1..4641e11 100644
--- a/resources/com/homelab/java-Dockerfile
+++ b/resources/com/homelab/java-Dockerfile
@@ -1,15 +1,21 @@
 # Fallback only — see go-Dockerfile's header comment for the general
-# rule. Simplified from the real java-Dockerfile: no JFrog artifact
+# rule, including the Harbor base-images sourcing (also applies here).
+# Simplified from the real java-Dockerfile: no JFrog artifact
 # resolution, no Homelab-internal Maven mirror. Assumes a standard Maven
-# repo producing a single runnable jar under target/.
-FROM maven:3-eclipse-temurin-${version} AS build
+# repo producing a single runnable jar under target/. Switched both
+# stages from their Debian defaults to the -alpine variant — smaller,
+# still keeps a shell (not distroless). Maven itself still reaches out
+# to Maven Central for plugins/dependencies during the build regardless
+# of base image — this only removes the Docker Hub dependency for the
+# base image layer, not package-registry traffic during the build.
+FROM harbor.192.168.1.7.nip.io/base-images/maven:3-eclipse-temurin-${version}-alpine AS build
 WORKDIR /src
 COPY pom.xml .
 RUN mvn -B dependency:go-offline
 COPY . .
 RUN mvn -B package -DskipTests
 
-FROM eclipse-temurin:${version}-jre
+FROM harbor.192.168.1.7.nip.io/base-images/eclipse-temurin:${version}-jre-alpine
 WORKDIR /app
 COPY --from=build /src/target/*.jar app.jar
 EXPOSE 8080
diff --git a/resources/com/homelab/node-Dockerfile b/resources/com/homelab/node-Dockerfile
index f2b0df3..be2fd4b 100644
--- a/resources/com/homelab/node-Dockerfile
+++ b/resources/com/homelab/node-Dockerfile
@@ -1,15 +1,18 @@
 # Fallback only — see go-Dockerfile's header comment for the general
-# rule. Simplified from the real node-Dockerfile: no PBAC registry sync,
+# rule, including the Harbor base-images sourcing (also applies here).
+# Simplified from the real node-Dockerfile: no PBAC registry sync,
 # no inline Sonar/coverage stage, no .npmrc-across-subdirectories dance.
-# Assumes a standard `npm run build` + `npm start` repo.
-FROM node:${version}-slim AS build
+# Assumes a standard `npm run build` + `npm start` repo. Switched from
+# node:*-slim (Debian) to node:*-alpine for both stages — smaller, still
+# keeps a shell for kubectl exec debugging (not distroless).
+FROM harbor.192.168.1.7.nip.io/base-images/node:${version}-alpine AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
 RUN npm run build --if-present
 
-FROM node:${version}-slim
+FROM harbor.192.168.1.7.nip.io/base-images/node:${version}-alpine
 WORKDIR /app
 COPY --from=build /app .
 ENV NODE_ENV=production
diff --git a/resources/com/homelab/php-Dockerfile b/resources/com/homelab/php-Dockerfile
index 26249a7..e5ad1e0 100644
--- a/resources/com/homelab/php-Dockerfile
+++ b/resources/com/homelab/php-Dockerfile
@@ -1,12 +1,33 @@
 # Fallback only — see go-Dockerfile's header comment for the general
-# rule. Simplified from the real php-Dockerfile. Assumes a standard
-# composer-based repo served by Apache.
-FROM php:${version}-apache
+# rule, including the Harbor base-images sourcing (also applies here).
+# Simplified from the real php-Dockerfile. Assumes a standard
+# composer-based repo.
+#
+# Was php:*-apache (Debian, full Apache httpd) — dropped Apache
+# entirely in favor of php:*-cli-alpine + PHP's own built-in dev server
+# (`php -S`). Genuinely minimal (no httpd, no extra process, Alpine
+# base) and brings this language in line with every other one here on
+# port 8080 instead of PHP's special-cased 80. Trade-off, stated
+# plainly: PHP's own docs call the built-in server "not designed to be
+# a full-featured web server" for production — perfectly fine for a
+# homelab/demo app, would need revisiting (php-fpm + nginx, two
+# processes/containers) for anything serving real production traffic.
+#
+# docker-php-ext-install needs PHPIZE_DEPS present to compile
+# extensions on Alpine (unlike the Debian image, which had them
+# preinstalled) — installed as a virtual package and removed again
+# right after, so the final image doesn't carry build tooling.
+FROM harbor.192.168.1.7.nip.io/base-images/php:${version}-cli-alpine
 WORKDIR /var/www/html
-RUN docker-php-ext-install pdo pdo_mysql
+RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS \
+    && docker-php-ext-install pdo pdo_mysql \
+    && apk del .build-deps
 COPY . .
 RUN if [ -f composer.json ]; then \
+      apk add --no-cache --virtual .composer-deps curl && \
       curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer && \
-      composer install --no-dev --optimize-autoloader; \
+      composer install --no-dev --optimize-autoloader && \
+      apk del .composer-deps; \
     fi
-EXPOSE 80
+EXPOSE 8080
+CMD ["php", "-S", "0.0.0.0:8080", "-t", "."]
diff --git a/resources/com/homelab/python-Dockerfile b/resources/com/homelab/python-Dockerfile
index d8fd5e2..9c6ad8c 100644
--- a/resources/com/homelab/python-Dockerfile
+++ b/resources/com/homelab/python-Dockerfile
@@ -1,9 +1,15 @@
 # Fallback only — see go-Dockerfile's header comment for the general
-# rule. Simplified from the real python-*-Dockerfile set (which had four
+# rule, including the Harbor base-images sourcing (also applies here).
+# Simplified from the real python-*-Dockerfile set (which had four
 # separate version-pinned files, 2.7/3.7/3.10.12/3.13) into one
 # version-parametrized template. Assumes a standard requirements.txt +
 # app.py (Flask/FastAPI-style `app:app` target for gunicorn) repo.
-FROM python:${version}-slim
+# Switched from python:*-slim (Debian) to python:*-alpine — smaller,
+# still keeps a shell (not distroless). Caveat: pip packages with C
+# extensions that only ship glibc wheels may need musl-dev/gcc added
+# here to build from source on Alpine — fine for this repo's pure-Python
+# deps, worth knowing if a future repo's requirements.txt needs more.
+FROM harbor.192.168.1.7.nip.io/base-images/python:${version}-alpine
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt