diff --git a/compose.yml b/compose.yml
index 1aa7a54..aa3e21b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -39,7 +39,7 @@ services:
       - tokenthief
 
   thief_clickhouse:
-    image: clickhouse/clickhouse-server:25.3.3.42-alpine
+    image: clickhouse/clickhouse-server:26.3
     container_name: tokenthief-clickhouse
     restart: unless-stopped
     environment:
diff --git a/docs/compose/reports/2026-07-10-clickhouse-migration-security-fixes.md b/docs/compose/reports/2026-07-10-clickhouse-migration-security-fixes.md
index a4b9a46..a0e0651 100644
--- a/docs/compose/reports/2026-07-10-clickhouse-migration-security-fixes.md
+++ b/docs/compose/reports/2026-07-10-clickhouse-migration-security-fixes.md
@@ -4,7 +4,7 @@
 
 本次修订覆盖队列并发关闭和单一总 shutdown deadline、响应完整性、请求体 fail-closed、ClickHouse 部分/模糊提交、64 MiB 默认队列字节预算、严格正值配置、响应体总/idle timeout、SSE 协议边界、WebSocket 101 与 shutdown、DSN/TLS、schema 校验、Compose 安全默认、固定 502、可信代理、batch 清理和 server 启动统一清理。
 
-Compose 使用固定 ClickHouse 镜像 `clickhouse/clickhouse-server:25.3.3.42-alpine`，默认不发布 ClickHouse 端口，并在配置展开阶段拒绝空的 `UPSTREAM_URL`、`CLICKHOUSE_URL` 和 `CLICKHOUSE_PASSWORD`。`.env.example` 不提供密码或 DSN 默认值。
+Compose 使用固定 ClickHouse 镜像 `clickhouse/clickhouse-server:26.3`，默认不发布 ClickHouse 端口，并在配置展开阶段拒绝空的 `UPSTREAM_URL`、`CLICKHOUSE_URL` 和 `CLICKHOUSE_PASSWORD`。`.env.example` 不提供密码或 DSN 默认值。
 
 ## 关键取舍
 
diff --git a/tests/deployment/compose_test.go b/tests/deployment/compose_test.go
index f5e4cc5..2abb132 100644
--- a/tests/deployment/compose_test.go
+++ b/tests/deployment/compose_test.go
@@ -23,8 +23,8 @@ func TestComposeUsesSafeDeploymentDefaults(t *testing.T) {
 		}
 	}
 
-	if !regexp.MustCompile(`(?m)^\s+image: clickhouse/clickhouse-server:\d+\.\d+\.\d+\.\d+-alpine\s*$`).MatchString(compose) {
-		t.Error("ClickHouse image must use an exact version tag")
+	if !regexp.MustCompile(`(?m)^\s+image: clickhouse/clickhouse-server:26\.3\s*$`).MatchString(compose) {
+		t.Error("ClickHouse image must use version 26.3")
 	}
 
 	serviceStart := strings.LastIndex(compose, "  thief_clickhouse:")