diff --git a/README.md b/README.md
index e5389dd..6a261d3 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ Includes:
 - Alpine Linux 3.22
 - Node.js 20.20.0
 - pnpm 10
-- dune 3.21
+- dune 3.23.0 (built from the official release tarball during image build)
 - build toolchain (`make`, `gcc`, musl-dev via `build-base`)
 - common CI tools (`git`, `curl`, `jq`, `unzip`, etc.)
 - Claude Code CLI (for coding agents)
@@ -31,7 +31,7 @@ Purpose: generic backend Docker builder base for static OCaml/PostgreSQL-linked
 Includes:
 - Alpine 3.20
 - OCaml build deps + static libs
-- dune 3.21
+- dune 3.23.0 (built from the official release tarball during image build)
 - PostgreSQL static client libraries built from source (v16.3)
 
 Version source: `images/backend-builder-base/VERSION`
@@ -94,7 +94,7 @@ jobs:
   build_frontend:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/makerprism/dev-base:1
+      image: ghcr.io/makerprism/dev-base:3
     steps:
       - uses: actions/checkout@v4
       - run: pnpm --version && dune --version
@@ -103,7 +103,7 @@ jobs:
 ### Dockerfile backend builder base
 
 ```dockerfile
-FROM ghcr.io/makerprism/backend-builder-base:1 AS builder
+FROM ghcr.io/makerprism/backend-builder-base:3 AS builder
 WORKDIR /app
 COPY . .
 RUN dune build --profile=release bin/main.exe
diff --git a/images/backend-builder-base/Dockerfile b/images/backend-builder-base/Dockerfile
index d4646d4..b54a2d4 100644
--- a/images/backend-builder-base/Dockerfile
+++ b/images/backend-builder-base/Dockerfile
@@ -1,10 +1,11 @@
 FROM alpine:3.20
 
-ARG DUNE_VERSION=3.21.0
+ARG DUNE_VERSION=3.23.0
 ARG POSTGRES_VERSION=16.3
 
 RUN apk add --no-cache \
     build-base \
+    ocaml \
     gmp-dev \
     libev-dev \
     libffi-dev \
@@ -22,8 +23,13 @@ RUN apk add --no-cache \
     readline-dev \
     readline-static
 
-RUN curl -fsSL https://github.com/ocaml-dune/dune-bin-install/releases/download/v3/install.sh \
-    | sh -s -- "${DUNE_VERSION}" --install-root /usr --no-update-shell-config
+# dune-bin-install is archived; build dune from the official release tarball.
+RUN curl -fsSL "https://github.com/ocaml/dune/releases/download/${DUNE_VERSION}/dune-${DUNE_VERSION}.tbz" | tar xjf - && \
+    cd "dune-${DUNE_VERSION}" && \
+    ./configure --prefix=/usr && \
+    make release && \
+    make install && \
+    cd .. && rm -rf "dune-${DUNE_VERSION}"
 
 RUN curl -fsSL "https://ftp.postgresql.org/pub/source/v${POSTGRES_VERSION}/postgresql-${POSTGRES_VERSION}.tar.gz" | tar xzf - && \
     cd "postgresql-${POSTGRES_VERSION}" && \
diff --git a/images/backend-builder-base/VERSION b/images/backend-builder-base/VERSION
index 3eefcb9..4a36342 100644
--- a/images/backend-builder-base/VERSION
+++ b/images/backend-builder-base/VERSION
@@ -1 +1 @@
-1.0.0
+3.0.0
diff --git a/images/ci-node-pnpm-dune/Dockerfile b/images/ci-node-pnpm-dune/Dockerfile
index b1a7e15..3348b08 100644
--- a/images/ci-node-pnpm-dune/Dockerfile
+++ b/images/ci-node-pnpm-dune/Dockerfile
@@ -3,7 +3,7 @@ ARG ALPINE_VERSION=3.22
 FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION}
 
 ARG PNPM_VERSION=10.29.3
-ARG DUNE_VERSION=3.21.0
+ARG DUNE_VERSION=3.23.0
 
 ARG ATLAS_VERSION=latest
 
@@ -18,6 +18,7 @@ RUN apk add --no-cache \
         libev-dev \
         libffi-dev \
         libpq-dev \
+        ocaml \
         openssl-dev \
         pkgconf \
         postgresql16-client \
@@ -30,8 +31,13 @@ RUN apk add --no-cache \
     && chmod +x /usr/local/bin/atlas \
     && corepack enable \
     && corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-    && curl -fsSL https://github.com/ocaml-dune/dune-bin-install/releases/download/v3/install.sh \
-      | sh -s -- "${DUNE_VERSION}" --install-root /usr/local --no-update-shell-config \
+    && curl -fsSL "https://github.com/ocaml/dune/releases/download/${DUNE_VERSION}/dune-${DUNE_VERSION}.tbz" | tar xjf - \
+    && cd "dune-${DUNE_VERSION}" \
+    && ./configure --prefix=/usr \
+    && make release \
+    && make install \
+    && cd .. \
+    && rm -rf "dune-${DUNE_VERSION}" \
     && rm -rf /var/cache/apk/*
 
 WORKDIR /workspace
diff --git a/images/ci-node-pnpm-dune/README.md b/images/ci-node-pnpm-dune/README.md
index 6a9ea28..50dc020 100644
--- a/images/ci-node-pnpm-dune/README.md
+++ b/images/ci-node-pnpm-dune/README.md
@@ -2,7 +2,7 @@
 
 > ⚠️ **DEPRECATED** - This image is deprecated and will not receive updates.
 >
-> **Migration:** Use [`ghcr.io/makerprism/dev-base:1`](../dev-base/) instead.
+> **Migration:** Use [`ghcr.io/makerprism/dev-base:3`](../dev-base/) instead.
 >
 > The new unified `dev-base` image combines all features from both `ci-node-pnpm-dune` and `coding-agent-base`.
 
@@ -15,7 +15,7 @@ image: ghcr.io/makerprism/ci-node-pnpm-dune:1
 
 With:
 ```yaml
-image: ghcr.io/makerprism/dev-base:1
+image: ghcr.io/makerprism/dev-base:3
 ```
 
 No other changes required - `dev-base` is a superset of this image's features.
diff --git a/images/ci-node-pnpm-dune/VERSION b/images/ci-node-pnpm-dune/VERSION
index 9084fa2..4a36342 100644
--- a/images/ci-node-pnpm-dune/VERSION
+++ b/images/ci-node-pnpm-dune/VERSION
@@ -1 +1 @@
-1.1.0
+3.0.0
diff --git a/images/dev-base/Dockerfile b/images/dev-base/Dockerfile
index f34887e..b9d8ce2 100644
--- a/images/dev-base/Dockerfile
+++ b/images/dev-base/Dockerfile
@@ -3,7 +3,7 @@
 #
 # Features:
 # - Node.js 20 + pnpm for TypeScript/JavaScript
-# - Dune 3.21 with package management for OCaml
+# - Dune 3.23.0 with package management for OCaml
 # - PostgreSQL client libraries for backend work
 # - Atlas for database migrations
 # - GitHub CLI for PRs and issues
@@ -24,7 +24,7 @@ FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION}
 
 # Redeclare ARGs after FROM to use in build stage
 ARG PNPM_VERSION=10.29.3
-ARG DUNE_VERSION=3.21.0
+ARG DUNE_VERSION=3.23.0
 ARG ATLAS_VERSION=latest
 
 # Install all dependencies: build tools, DB clients, dev utilities
@@ -40,6 +40,7 @@ RUN apk add --no-cache \
         libffi-dev \
         libpq-dev \
         m4 \
+        ocaml \
         openssl-dev \
         openssl-libs-static \
         pkgconf \
@@ -69,9 +70,14 @@ RUN curl -sSfL "https://release.ariga.io/atlas/atlas-linux-amd64-${ATLAS_VERSION
 RUN corepack enable \
     && corepack prepare "pnpm@${PNPM_VERSION}" --activate
 
-# Install dune (OCaml build system with package management)
-RUN curl -fsSL https://github.com/ocaml-dune/dune-bin-install/releases/download/v3/install.sh \
-      | sh -s -- "${DUNE_VERSION}" --install-root /usr --no-update-shell-config
+# Install dune from the official release tarball; dune-bin-install is archived.
+RUN curl -fsSL "https://github.com/ocaml/dune/releases/download/${DUNE_VERSION}/dune-${DUNE_VERSION}.tbz" | tar xjf - \
+    && cd "dune-${DUNE_VERSION}" \
+    && ./configure --prefix=/usr \
+    && make release \
+    && make install \
+    && cd .. \
+    && rm -rf "dune-${DUNE_VERSION}"
 
 # Set up workspace
 WORKDIR /workspace
diff --git a/images/dev-base/VERSION b/images/dev-base/VERSION
index afaf360..4a36342 100644
--- a/images/dev-base/VERSION
+++ b/images/dev-base/VERSION
@@ -1 +1 @@
-1.0.0
\ No newline at end of file
+3.0.0