diff --git a/cloudflared.container b/cloudflared.container
index e92505b..b034207 100644
--- a/cloudflared.container
+++ b/cloudflared.container
@@ -1,5 +1,5 @@
 [Container]
-Image=docker.io/cloudflare/cloudflared:latest
+Image=gitea.iot.cudanet.org/administrator/quadlets/cloudflared:2026.3.0
 Exec=tunnel --no-autoupdate run --token eyJhIjoiNDQ4ZTY3NDk5ZWUyNWY3ZDE4NjJiYjZjYTU1YzFlZjUiLCJ0IjoiMDk1Mzk5N2EtNjFkZS00MDk1LTg4YzUtMzM1M2RhZDJlNzNiIiwicyI6IkRKYmNOSUd5ZHVaWUlPOGVENU91QktWLzQvdG0yV0hxT1hpZExaRUtDVlk9In0=
 LogDriver=journald
 ReadOnly=true
@@ -9,7 +9,7 @@ Memory=2048M
 
 [Service]
 Restart=always
-ExecStartPre=/usr/bin/podman pull docker.io/cloudflare/cloudflared:latest
+#ExecStartPre=/usr/bin/podman pull docker.io/cloudflare/cloudflared:latest
 
 [Install]
 WantedBy=default.target
diff --git a/dockhand.container b/dockhand.container
index 4abca6c..8955a98 100644
--- a/dockhand.container
+++ b/dockhand.container
@@ -4,7 +4,7 @@ After=network-online.target podman.socket
 Requires=podman.socket
 
 [Container]
-Image=docker.io/fnsys/dockhand:v1.0.22
+Image=gitea.iot.cudanet.org/administrator/quadlets/dockhand:v1.0.22
 ContainerName=dockhand
 User=0
 # Pass the security flag directly to Podman to bypass SELinux socket restrictions
diff --git a/freeipa.container b/freeipa.container
new file mode 100644
index 0000000..a825775
--- /dev/null
+++ b/freeipa.container
@@ -0,0 +1,29 @@
+[Unit]
+Description=FreeIPA Server
+After=network-online.target
+
+[Container]
+Image=gitea.iot.cudanet.org/administrator/quadlets/freeipa-server:almalinux-9-4.12.2
+ContainerName=freeipa-server
+Network=podman-bridge0:ip=10.0.0.141
+
+Environment=IPA_DM_PASSWORD=SIssy123!!
+Environment=IPA_ADMIN_PASSWORD=SIssy123!!
+
+PodmanArgs=--systemd=always --hostname=ipa.iot.cudanet.org --cgroupns=host --security-opt label=disable --add-host ipa.iot.cudanet.org:10.0.0.141
+
+# ADDED: --no-host-dns and --no-ntp to prevent local enrollment crashes
+Exec=ipa-server-install -U -r IOT.CUDANET.ORG -p SIssy123!! -a SIssy123!! --no-ntp --no-host-dns
+
+Volume=/var/podman/freeipa/data:/data:Z
+AddCapability=CAP_SYS_ADMIN
+AddCapability=CAP_NET_ADMIN
+
+[Service]
+Notify=false
+Restart=on-failure
+RestartSec=30
+TimeoutStartSec=1800
+
+[Install]
+WantedBy=multi-user.target
diff --git a/gitea-db.container b/gitea-db.container
index 0d2ef96..c3b8533 100644
--- a/gitea-db.container
+++ b/gitea-db.container
@@ -3,14 +3,14 @@
 Description=Gitea MySQL Database
 
 [Container]
-Image=docker.io/library/mysql:8
+Image=gitea.iot.cudanet.org/administrator/quadlets/mysql:8
 Volume=/var/podman/gitea/mysql:/var/lib/mysql:Z
 Environment=MYSQL_ROOT_PASSWORD=gitea
 Environment=MYSQL_USER=gitea
 Environment=MYSQL_PASSWORD=gitea
 Environment=MYSQL_DATABASE=gitea
 Network=gitea.network
-ContainerName=mysql
+ContainerName=gitea-db
 
 [Service]
 Restart=always
diff --git a/gitea-server.container b/gitea-server.container
index d134227..8d1a746 100644
--- a/gitea-server.container
+++ b/gitea-server.container
@@ -4,12 +4,12 @@ Description=Gitea Server
 After=gitea-db.service
 
 [Container]
-ContainerName=gitea
-Image=docker.gitea.com/gitea:1.26.1
+ContainerName=gitea-server
+Image=gitea.iot.cudanet.org/administrator/quadlets/gitea:1.26.1
 Environment=USER_UID=1000
 Environment=USER_GID=1000
 Environment=GITEA__database__DB_TYPE=mysql
-Environment=GITEA__database__HOST=mysql:3306
+Environment=GITEA__database__HOST=gitea-db:3306
 Environment=GITEA__database__NAME=gitea
 Environment=GITEA__database__USER=gitea
 Environment=GITEA__database__PASSWD=gitea
diff --git a/homebridge.container b/homebridge.container
index f099230..2c3fff7 100644
--- a/homebridge.container
+++ b/homebridge.container
@@ -1,5 +1,5 @@
 [Container]
-Image=docker.io/homebridge/homebridge:2026-05-06
+Image=gitea.iot.cudanet.org/administrator/quadlets/homebridge:2026-05-06
 ContainerName=homebridge
 Network=host
 Memory=2048M
diff --git a/npm.container b/npm.container
index 3c2aea2..9f66c93 100644
--- a/npm.container
+++ b/npm.container
@@ -3,7 +3,7 @@ Description=Nginx Proxy Manager
 After=network-online.target
 
 [Container]
-Image=docker.io/jc21/nginx-proxy-manager:latest
+Image=gitea.iot.cudanet.org/administrator/quadlets/nginx-proxy-manager:2.14.0
 ContainerName=npm
 # Ports for HTTP, HTTPS, and Admin UI
 PublishPort=80:80
diff --git a/override.conf b/override.conf
new file mode 100644
index 0000000..a413cc0
--- /dev/null
+++ b/override.conf
@@ -0,0 +1,9 @@
+# this file must go in /etc/systemd/system/freeipa.service.d/override.conf 
+
+[Service]
+# This overrides the Quadlet-generated Type=notify
+Type=simple
+# Prevents systemd from killing it if the Pi lags
+TimeoutStartSec=1200
+Restart=always
+RestartSec=30
diff --git a/portainer.container b/portainer.container
index 42d49ff..84c2aa5 100644
--- a/portainer.container
+++ b/portainer.container
@@ -1,5 +1,5 @@
 [Container]
-Image=docker.io/portainer/portainer-ce:latest
+Image=gitea.iot.cudanet.org/administrator/quadlets/portainer-ce:2.39.2
 ContainerName=portainer
 Volume=/run/podman/podman.sock:/var/run/docker.sock:Z
 Volume=/var/podman/portainer/data:/data:Z
diff --git a/upstream-images.txt b/upstream-images.txt
new file mode 100644
index 0000000..2c889e3
--- /dev/null
+++ b/upstream-images.txt
@@ -0,0 +1,8 @@
+docker.io/portainer/portainer-ce:2.39.2
+docker.io/homebridge/homebridge:2026-05-06
+docker.io/library/mysql:8
+docker.gitea.com/gitea:1.26.1
+docker.io/fnsys/dockhand:v1.0.22
+docker.io/cloudflare/cloudflared:2026.3.0
+docker.io/jc21/nginx-proxy-manager:2.14.0
+docker.io/freeipa/freeipa-server:almalinux-9-4.12.2