diff --git a/compose.yaml b/compose.yaml
index a9c26b0..53366b4 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -17,7 +17,10 @@ services:
       retries: 5
     pull_policy: missing
   minio:
-    build: etc/minio
+    # MinIO no longer publishes images. pgsty/silo is a community-maintained
+    # AGPLv3 fork that still does, multi-arch, with mc at /usr/bin/mc and the
+    # MinIO S3 API, including conditional writes.
+    image: pgsty/silo:RELEASE.2026-09-16T00-00-00Z@sha256:635197cb9f36d01bee221d34d1c7d7960f6a95c48b0b6c01d99cd13bdae51a46
     command: server /data --console-address ":9001"
     volumes:
       - minio:/data
@@ -32,6 +35,7 @@ services:
       retries: 1
       start_period: 5s
       timeout: 5s
+    pull_policy: missing
   kafka:
     image: ${KAFKA_IMAGE}
     command: /bin/sleep infinity
diff --git a/etc/minio/Dockerfile b/etc/minio/Dockerfile
deleted file mode 100644
index 445147f..0000000
--- a/etc/minio/Dockerfile
+++ /dev/null
@@ -1,40 +0,0 @@
-# MinIO no longer distributes prebuilt binaries or container images for
-# anonymous/public use: dl.min.io returns 410 Gone, Docker Hub's minio/minio
-# repository is gone, and third-party mirrors (e.g. Chainguard's free-tier
-# rebuild) are subject to their own registry limits and terms, unrelated to
-# MinIO's. Both the server (minio) and client (mc) stay public because
-# they're AGPLv3-licensed, so this builds both ourselves from that source
-# instead of depending on any registry's redistribution of them. mc is
-# required too: justfile's minio-mc/minio-ready-local/etc. recipes and CI
-# run it via `docker compose exec minio /usr/bin/mc ...` - it's expected
-# inside this same container, matching upstream's own image layout.
-#
-# Both pinned to the last tagged release on their (now archived,
-# read-only) upstream repos - each has a few untagged commits after this,
-# but nothing past an official release has been vetted as one.
-FROM golang:1.24-alpine AS build
-RUN apk add --no-cache git
-
-ARG MINIO_VERSION=RELEASE.2025-10-15T17-29-55Z
-WORKDIR /src/minio
-RUN git clone --depth 1 --branch ${MINIO_VERSION} https://github.com/minio/minio.git .
-RUN --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/go/pkg/mod \
-    CGO_ENABLED=0 go build -trimpath \
-      -ldflags "-X github.com/minio/minio/cmd.Version=${MINIO_VERSION} -X github.com/minio/minio/cmd.ReleaseTag=${MINIO_VERSION}" \
-      -o /out/minio .
-
-ARG MC_VERSION=RELEASE.2025-08-13T08-35-41Z
-WORKDIR /src/mc
-RUN git clone --depth 1 --branch ${MC_VERSION} https://github.com/minio/mc.git .
-RUN --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/go/pkg/mod \
-    CGO_ENABLED=0 go build -trimpath \
-      -ldflags "-X github.com/minio/mc/cmd.Version=${MC_VERSION} -X github.com/minio/mc/cmd.ReleaseTag=${MC_VERSION}" \
-      -o /out/mc .
-
-FROM alpine:3.20
-# bash is required by compose.yaml's healthcheck (runs inside this container).
-RUN apk add --no-cache ca-certificates bash
-COPY --from=build /out/minio /out/mc /usr/bin/
-ENTRYPOINT ["/usr/bin/minio"]