diff --git a/Dockerfile b/Dockerfile
index 7543ce9..02c9944 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,11 +7,14 @@ WORKDIR /app
 
 RUN pip install --no-cache-dir --upgrade pip
 
+COPY requirements /app/requirements
+RUN pip install --no-cache-dir -r requirements/latest-runtime.in
+
 COPY pyproject.toml README.md /app/
 COPY src /app/src
 COPY web /app/web
 
-RUN pip install --no-cache-dir .
+RUN pip install --no-cache-dir --no-deps .
 
 EXPOSE 8000
 
diff --git a/README.md b/README.md
index 0fbfaec..44f69fd 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,12 @@ Install app + dev dependencies:
 uv pip install -e .[dev]
 ```
 
+Dependency source of truth:
+
+- Runtime dependencies live in `requirements/latest-runtime.in`.
+- Dev dependencies live in `requirements/latest-dev.in`.
+- `pyproject.toml` reads both files dynamically during package install.
+
 Create local env file:
 
 ```powershell
@@ -201,7 +207,7 @@ mypy src
 Run dependency vulnerability audit:
 
 ```powershell
-pip-audit --skip-editable
+pip-audit -r requirements/latest-runtime.in
 ```
 
 Run secret scan (worktree + git history):
@@ -242,6 +248,11 @@ Build locally:
 docker build -t arbitrade:local .
 ```
 
+Container dependency install flow:
+
+- Docker installs runtime dependencies from `requirements/latest-runtime.in`.
+- Docker then installs the package with `--no-deps` so dependency resolution is driven by requirements files.
+
 Run with compose:
 
 ```powershell
@@ -252,8 +263,7 @@ Compose mounts local `data/` folder into container at `/app/data`.
 
 Important:
 
-- [docker-compose.yml](docker-compose.yml) still uses registry image placeholder format.
-- Replace `git.allucanget.biz/OWNER/arbitrade:latest` with actual namespace image, likely `git.allucanget.biz/allucanget/arbitrade:latest`.
+- [docker-compose.yml](docker-compose.yml) uses `git.allucanget.biz/allucanget/arbitrade:latest` as the default image reference.
 
 ## Gitea CI / Registry Setup
 
@@ -370,7 +380,12 @@ python scripts/backtest_replay.py --events path\to\replay.jsonl --starting-balan
 Replay event format:
 
 ```json
-{"timestamp":"2026-06-01T12:00:00Z","symbol":"BTC/USD","bids":[[100.0,1.0]],"asks":[[101.0,1.0]]}
+{
+  "timestamp": "2026-06-01T12:00:00Z",
+  "symbol": "BTC/USD",
+  "bids": [[100.0, 1.0]],
+  "asks": [[101.0, 1.0]]
+}
 ```
 
 Notes:
@@ -378,7 +393,7 @@ Notes:
 - Events are replayed in timestamp order.
 - The replay engine reuses the production detector, pre-trade validation, trade limits, and execution sequencer.
 - The simulated execution path applies configurable slippage and execution latency so reports include deterministic trade/miss statistics.
-Latency baseline and threshold artifacts:
+  Latency baseline and threshold artifacts:
 
 - `ops/performance/latency_baseline.json`
 - `ops/performance/latency_thresholds.json`
diff --git a/docker-compose.yml b/docker-compose.yml
index f7749b2..58b9e83 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   arbitrade:
-    image: git.allucanget.biz/OWNER/arbitrade:latest
+    image: git.allucanget.biz/allucanget/arbitrade:latest
     build:
       context: .
       dockerfile: Dockerfile