diff --git a/ansible/roles/signal_api/defaults/main.yml b/ansible/roles/signal_api/defaults/main.yml
index 6bb7d4f..5b1b79f 100644
--- a/ansible/roles/signal_api/defaults/main.yml
+++ b/ansible/roles/signal_api/defaults/main.yml
@@ -4,12 +4,19 @@
 # Gatus does not speak Signal. It POSTs JSON to this service, which holds the
 # actual Signal identity and does the protocol work.
 
-# Pinned by digest for the same reason as Gatus: a tag is mutable.
-# Upstream publishes no versioned tags worth pinning to, so this pins the
-# DIGEST that `latest` resolved to when this was reviewed. `latest` is a moving
-# target; a digest is a content address, and `docker compose pull` either
-# fetches exactly this image or fails.
-signal_api_image_digest: "sha256:2399d449123cdad56c4d859277e3b9127e1a00c4d2ab4601c239882609286cf8"
+# Pinned by DIGEST, with the release tag alongside for humans - same as Gatus.
+# A tag is mutable; a digest is a content address, so `docker compose pull`
+# either fetches exactly this image or fails. Upstream publishes versioned
+# release tags (0.97 ... 0.101); the two values below must move together.
+#
+# THIS PIN EXPIRES. Signal's servers stop accepting signal-cli releases that
+# fall a few months behind. 0.100 (signal-cli 0.14.5, 2026-06-11) was refused
+# on 2026-10-18 - the phone reported "network error" and signal-cli logged
+# "Link request error: Connection closed!", with the network itself fine. A
+# stale pin fails exactly the same way for ALERTS: silently. Bump this at least
+# every couple of months: https://github.com/bbernhard/signal-cli-rest-api/releases
+signal_api_version: "0.101"   # bundles signal-cli 0.14.8
+signal_api_image_digest: "sha256:2cf09d66a86fdd210e42ee91662216364acc27da1163a8c44167a77ea3a6559a"
 signal_api_image: "bbernhard/signal-cli-rest-api@{{ signal_api_image_digest }}"
 
 signal_api_dir: /opt/signal-api