diff --git a/Dockerfile b/Dockerfile
index 1e28c6ad..81825c00 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,18 +6,30 @@ RUN apk add --no-cache git ca-certificates tzdata
 WORKDIR /build
 
 # GrayCodeAI sibling modules are unpublished at their current code (the public proxy
-# froze v0.1.0 at old commits). Resolve them locally via the committed go.work
+# froze v0.1.0 at old commits). Resolve them locally via a generated go.work
 # (use . + replace => ./external/<repo>), bypassing the proxy/sumdb entirely.
 ENV GOPRIVATE=github.com/GrayCodeAI/* \
     GONOSUMDB=github.com/GrayCodeAI/* \
     GONOSUMCHECK=1
 
+# Build-time provenance (passed by .github/workflows/docker.yml or `docker build
+# --build-arg VERSION=... --build-arg COMMIT=... --build-arg BUILD_DATE=...`).
+# Default to "dev"/"none"/"unknown" so plain `docker build .` still produces a
+# runnable image — matching the cmd/hawk/main.go ldflags fallbacks.
+ARG VERSION=dev
+ARG COMMIT=none
+ARG BUILD_DATE=unknown
+
 COPY . .
 
 # Clone every sibling hawk imports into ./external, then generate a go.work that
 # resolves them locally. NOTE: the committed go.work/go.work.sum are excluded by
 # .dockerignore, so we must (re)create the workspace here. Do NOT run
 # 'go mod download' first — the frozen-proxy v0.1.0 fails checksum verification.
+#
+# main.Version / main.Commit / main.BuildDate are baked in from the ARGs above;
+# this is the only correct source — `git describe` would always return empty
+# because `.dockerignore` excludes `.git/` from the build context.
 RUN rm -rf external go.work go.work.sum && mkdir -p external && \
     for repo in eyrie inspect sight tok trace yaad; do \
       git clone --depth=1 "https://github.com/GrayCodeAI/${repo}.git" "external/${repo}"; \
@@ -27,7 +39,10 @@ RUN rm -rf external go.work go.work.sum && mkdir -p external && \
         echo "	github.com/GrayCodeAI/${repo} => ./external/${repo}"; \
       done; echo ")"; } > go.work && \
     CGO_ENABLED=0 GOOS=linux go build -trimpath \
-    -ldflags="-s -w -X main.Version=$(git describe --tags --always 2>/dev/null || echo dev)" \
+    -ldflags="-s -w \
+      -X main.Version=${VERSION} \
+      -X main.Commit=${COMMIT} \
+      -X main.BuildDate=${BUILD_DATE}" \
     -o hawk ./cmd/hawk
 
 # Runtime stage — Alpine (hawk requires git + bash for workspace operations; distroless excluded)
diff --git a/Makefile b/Makefile
index 9d592c5d..6b0b48aa 100644
--- a/Makefile
+++ b/Makefile
@@ -152,7 +152,7 @@ setup: ## Set up local development environment (go.work + external repos).
 		fi; \
 	done
 	@echo "Generating go.work..."
-	@echo "module hawk-eco" > go.work
+	@echo "go 1.26.4" > go.work
 	@echo "" >> go.work
 	@echo "use (" >> go.work
 	@echo "	." >> go.work
@@ -219,8 +219,8 @@ build-static: ## Build fully static binaries for Linux (musl-compatible)
 	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o bin/$(NAME)-linux-amd64-static $(MAIN_PKG)
 	GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o bin/$(NAME)-linux-arm64-static $(MAIN_PKG)
 
-size-check: build ## Report binary size and warn if over threshold (50MB)
+size-check: build ## Report binary size and warn if over threshold (100MB, matching CI).
 	@SIZE=$$(stat -f%z bin/$(NAME) 2>/dev/null || stat -c%s bin/$(NAME) 2>/dev/null); \
 	MB=$$(echo "scale=1; $$SIZE / 1048576" | bc); \
 	echo "Binary size: $${MB} MB"; \
-	if [ $$SIZE -gt 52428800 ]; then echo "WARNING: binary exceeds 50MB"; exit 1; fi
+	if [ $$SIZE -gt 104857600 ]; then echo "ERROR: binary exceeds 100MB (CI threshold)"; exit 1; fi
diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index d19f4b95..8c9ffb74 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -5,7 +5,17 @@ services:
     build:
       context: ../../
       dockerfile: Dockerfile
+      args:
+        # Optional: set VERSION/COMMIT/BUILD_DATE to stamp the binary.
+        # Defaults in the Dockerfile produce "dev"/"none"/"unknown".
+        VERSION: ${VERSION:-dev}
+        COMMIT: ${COMMIT:-none}
+        BUILD_DATE: ${BUILD_DATE:-unknown}
     image: ghcr.io/graycodeai/hawk:dev
+    # Override the Dockerfile's default `CMD ["--help"]` so the container
+    # actually runs the HTTP/SSE daemon. `--host 0.0.0.0` is required for
+    # the published port to be reachable from outside the container.
+    command: ["daemon", "start", "--host", "0.0.0.0", "--port", "4590"]
     ports:
       - "4590:4590"
     environment:
diff --git a/external/eyrie b/external/eyrie
index b455064d..cc782e41 160000
--- a/external/eyrie
+++ b/external/eyrie
@@ -1 +1 @@
-Subproject commit b455064d7c2fa543875aa50067fcb27e285c8c3e
+Subproject commit cc782e41288f74b2eeab4d1e547064a5c992ff11
diff --git a/external/inspect b/external/inspect
index 67fca0a7..116b6eae 160000
--- a/external/inspect
+++ b/external/inspect
@@ -1 +1 @@
-Subproject commit 67fca0a74231e1fc677bfc00b4f83cef3769d93d
+Subproject commit 116b6eae586a9a40d9905130cec90cedd438b908
diff --git a/external/sight b/external/sight
index 2f2d408e..c0ee67f2 160000
--- a/external/sight
+++ b/external/sight
@@ -1 +1 @@
-Subproject commit 2f2d408e7b2e52bbcd7fd26dadce2b7cffa42e0d
+Subproject commit c0ee67f2b147d46a0c48200c08d99ebab2b80ad6
diff --git a/external/tok b/external/tok
index cd292544..138f7e42 160000
--- a/external/tok
+++ b/external/tok
@@ -1 +1 @@
-Subproject commit cd292544e4d6428b929e3d03bac2676b7a461f63
+Subproject commit 138f7e42f958e4f29beb6fdc73a749d6c0b9a007
diff --git a/external/trace b/external/trace
index 55c25196..6c99b54c 160000
--- a/external/trace
+++ b/external/trace
@@ -1 +1 @@
-Subproject commit 55c25196037278f04ae7f93d5db8a04035ed33c3
+Subproject commit 6c99b54cc5d6ce9283f9156d775cb1f3b2554ffc
diff --git a/external/yaad b/external/yaad
index d76ee406..df99a3a6 160000
--- a/external/yaad
+++ b/external/yaad
@@ -1 +1 @@
-Subproject commit d76ee406e1b757b0b7450728ab270e0e3804ad49
+Subproject commit df99a3a675e427de5e709c48b344e29434614770
diff --git a/scripts/smoke-hawk.sh b/scripts/smoke-hawk.sh
index ac4b5e6f..5ad4b470 100755
--- a/scripts/smoke-hawk.sh
+++ b/scripts/smoke-hawk.sh
@@ -21,10 +21,6 @@ set +o pipefail
 "$BIN" path >/dev/null 2>&1 || true
 set -o pipefail
 
-echo "== hawk yaad =="
-"$BIN" yaad --limit 2 >/dev/null || true
-"$BIN" yaad search decision --limit 2 >/dev/null || true
-
 echo "== ecosystem tests =="
 go test ./internal/config/ -run TestFormatEcosystemPanel -count=1
 go test ./cmd/ -run 'TestDoctor|TestYaad|TestEcosystem|TestPath' -count=1