diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh
index 4e349e80..6857c803 100644
--- a/scripts/image-versions.sh
+++ b/scripts/image-versions.sh
@@ -84,7 +84,7 @@ STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
 NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.7"
 NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
 FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
-FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
+FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:1.7.123-alpha"
 
 # AI / Routing
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
@@ -117,9 +117,9 @@ PENPOT_EXPORTER_IMAGE="$ARCHY_REGISTRY/penpot-exporter:2.4"
 PENPOT_FRONTEND_IMAGE="$ARCHY_REGISTRY/penpot-frontend:2.4"
 
 # Custom UI containers (built from docker/ dirs, pushed to registry)
-BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.119-alpha"
-LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.119-alpha"
-ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:latest"
+BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.123-alpha"
+LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.123-alpha"
+ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:1.7.123-alpha"
 
 # Base images
 NGINX_ALPINE_IMAGE="$ARCHY_REGISTRY/nginx:1.27.4-alpine"
diff --git a/scripts/reconcile-containers.sh b/scripts/reconcile-containers.sh
index 9f515a83..2c585856 100755
--- a/scripts/reconcile-containers.sh
+++ b/scripts/reconcile-containers.sh
@@ -809,7 +809,12 @@ ensure_bitcoin_ui_nginx_conf() {
   tmp="${CONF_PATH}.tmp.$$"
   sudo tee "$tmp" >/dev/null << EOF
 server {
-    listen 8334;
+    # Loopback ONLY — this is the fourth copy of this declaration (the others
+    # are the Rust template in container/bitcoin_ui_nginx.conf.template, the
+    # image, and the manifest). Host networking means this nginx binds the
+    # HOST's address, so \`listen 8334;\` served the Bitcoin screen on every
+    # interface with no login. The app gate owns the external addresses now.
+    listen 127.0.0.1:8334;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;