diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87f20bc82c9..297d30e691d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,6 +45,8 @@ jobs:
               - 'rust-toolchain.toml'
               - 'deny.toml'
               - '.github/workflows/ci.yml'
+              - 'docker-compose.yml'
+              - 'docker-compose.ci.yml'
               - 'scripts/run-tests.sh'
               - 'justfile'
             desktop:
@@ -366,6 +368,8 @@ jobs:
           retention-days: 1
 
   desktop-e2e-integration-shard:
+    env:
+      COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
     name: Desktop E2E Integration (${{ matrix.shard }}/2)
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -564,6 +568,8 @@ jobs:
           echo "Desktop E2E Integration shards passed"
 
   backend-integration:
+    env:
+      COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
     name: Backend Integration (relay e2e)
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -710,6 +716,8 @@ jobs:
         run: docker compose down --volumes --remove-orphans
 
   relay-e2e:
+    env:
+      COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
     name: Relay E2E
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -1025,14 +1033,14 @@ jobs:
           touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET"
           touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
           touch "desktop/src-tauri/binaries/buzz-$TARGET"
-      # Mesh rev is derived from Cargo.lock so a dependency bump needs no
+      # Mesh rev is derived from the desktop lockfile so a dependency bump needs no
       # lockstep edit here; the cache key tracks it automatically.
       - name: Resolve mesh-llm rev
         id: mesh_rev
         run: |
           set -euo pipefail
-          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
-          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("desktop/src-tauri/Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
+          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from desktop/src-tauri/Cargo.lock"; exit 1; }
           echo "rev=$REV" >> "$GITHUB_OUTPUT"
           echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
       - name: Restore mesh llama build cache
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c613924e574..f655dc58cfa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,13 +137,13 @@ jobs:
           cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
           ./scripts/bundle-sidecars.sh
 
-      # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it.
+      # Mesh rev derived from the desktop lockfile (no lockstep edit on dep bump); cache key tracks it.
       - name: Resolve mesh-llm rev
         id: mesh_rev
         run: |
           set -euo pipefail
-          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
-          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("desktop/src-tauri/Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
+          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from desktop/src-tauri/Cargo.lock"; exit 1; }
           echo "rev=$REV" >> "$GITHUB_OUTPUT"
           echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
       - name: Restore mesh llama build cache
diff --git a/.github/workflows/signed-macos-canary.yml b/.github/workflows/signed-macos-canary.yml
index fb0656028af..c2f0d0fd0b8 100644
--- a/.github/workflows/signed-macos-canary.yml
+++ b/.github/workflows/signed-macos-canary.yml
@@ -96,13 +96,13 @@ jobs:
           cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
           ./scripts/bundle-sidecars.sh
 
-      # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it.
+      # Mesh rev derived from the desktop lockfile (no lockstep edit on dep bump); cache key tracks it.
       - name: Resolve mesh-llm rev
         id: mesh_rev
         run: |
           set -euo pipefail
-          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
-          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("desktop/src-tauri/Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
+          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from desktop/src-tauri/Cargo.lock"; exit 1; }
           echo "rev=$REV" >> "$GITHUB_OUTPUT"
           echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
 
diff --git a/deploy/charts/buzz/ci/quickstart-values.yaml b/deploy/charts/buzz/ci/quickstart-values.yaml
index 4dcf6bcd21b..1a7f4d58389 100644
--- a/deploy/charts/buzz/ci/quickstart-values.yaml
+++ b/deploy/charts/buzz/ci/quickstart-values.yaml
@@ -9,6 +9,8 @@ redis:
   enabled: true
 minio:
   enabled: true
+  image: ghcr.io/block/buzz-minio:latest
+  mcImage: ghcr.io/block/buzz-minio:latest
 relayUrl: wss://buzz.test.local
 ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000001"
 relay:
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
new file mode 100644
index 00000000000..2ce99aa076e
--- /dev/null
+++ b/docker-compose.ci.yml
@@ -0,0 +1,11 @@
+# CI pulls the published image; only the upstream MinIO image workflow builds it.
+# MINIO_CI_IMAGE allows reproducing a specific published image when needed.
+services:
+  minio:
+    image: ${MINIO_CI_IMAGE:-ghcr.io/block/buzz-minio:latest}
+    platform: linux/amd64
+    pull_policy: always
+  minio-init:
+    image: ${MINIO_CI_IMAGE:-ghcr.io/block/buzz-minio:latest}
+    platform: linux/amd64
+    pull_policy: always