diff --git a/.env b/.env
index 587b42ee..1967becc 100644
--- a/.env
+++ b/.env
@@ -4,6 +4,10 @@
 # Essential
 DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
+# Image tag pinning
+IMAGE_OWNER=openwisp
+# OPENWISP_VERSION: Image tag version (e.g., "25.10.0", "latest", or "edge")
+OPENWISP_VERSION=edge
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
diff --git a/Makefile b/Makefile
index 97545ab9..26c7dc79 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,10 @@
 # Find documentation in README.md under
 # the heading "Makefile Options".
 
-OPENWISP_VERSION = 25.10.0
+include .env # The .env file can override ?= variables in the Makefile (e.g. OPENWISP_VERSION, IMAGE_OWNER)
+
+# RELEASE_VERSION: version string used when tagging a new release.
+RELEASE_VERSION = 25.10.0
 SHELL := /bin/bash
 .SILENT: clean pull start stop
 
@@ -9,6 +12,10 @@ default: compose-build
 
 USER = registry.gitlab.com/openwisp/docker-openwisp
 TAG = edge
+# OPENWISP_VERSION: image tag used for pulling/pushing images (e.g. "edge", "latest", "25.10.0")
+# Can be overridden via .env or command line. Not the same as RELEASE_VERSION
+OPENWISP_VERSION ?= edge
+IMAGE_OWNER ?= openwisp
 SKIP_PULL ?= false
 SKIP_BUILD ?= false
 SKIP_TESTS ?= false
@@ -19,8 +26,8 @@ pull:
 	for image in 'openwisp-base' 'openwisp-nfs' 'openwisp-api' 'openwisp-dashboard' \
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
-		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:latest; \
+		docker pull --quiet $(USER)/$${image}:$(OPENWISP_VERSION); \
+		docker tag  $(USER)/$${image}:$(OPENWISP_VERSION) $(IMAGE_OWNER)/$${image}:$(OPENWISP_VERSION); \
 	done
 
 # Build
@@ -41,11 +48,13 @@ base-build:
 	             $$BUILD_ARGS; \
 	docker build --tag openwisp/openwisp-base:latest \
 	             --file ./images/openwisp_base/Dockerfile ./images/ \
-	             $$BUILD_ARGS
+	             $$BUILD_ARGS; \
+	docker tag openwisp/openwisp-base:latest $(IMAGE_OWNER)/openwisp-base:$(OPENWISP_VERSION)
 
 nfs-build:
 	docker build --tag openwisp/openwisp-nfs:latest \
-	             --file ./images/openwisp_nfs/Dockerfile ./images/
+	             --file ./images/openwisp_nfs/Dockerfile ./images/; \
+	docker tag openwisp/openwisp-nfs:latest $(IMAGE_OWNER)/openwisp-nfs:$(OPENWISP_VERSION)
 
 compose-build: base-build
 	docker compose build --parallel
@@ -76,6 +85,8 @@ clean:
 				openwisp/openwisp-base:intermedia-system \
 				openwisp/openwisp-base:intermedia-python \
 				openwisp/openwisp-nfs:latest \
+				$(IMAGE_OWNER)/openwisp-base:$(OPENWISP_VERSION) \
+				$(IMAGE_OWNER)/openwisp-nfs:$(OPENWISP_VERSION) \
 				`docker images -f "dangling=true" -q` \
 				`docker images | grep openwisp/docker-openwisp | tr -s ' ' | cut -d ' ' -f 3` &> /dev/null
 
@@ -105,10 +116,7 @@ publish:
 	for image in 'openwisp-base' 'openwisp-nfs' 'openwisp-api' 'openwisp-dashboard' \
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
-		# Docker images built locally are tagged "latest" by default. \
-		# This script updates the tag of each built image to a user-defined tag \
-		# and pushes the newly tagged image to a Docker registry under the user's namespace. \
-		docker tag openwisp/$${image}:latest $(USER)/$${image}:$(TAG); \
+		docker tag $(IMAGE_OWNER)/$${image}:$(OPENWISP_VERSION) $(USER)/$${image}:$(TAG); \
 		docker push $(USER)/$${image}:$(TAG); \
 		if [ "$(TAG)" != "latest" ]; then \
 			docker rmi $(USER)/$${image}:$(TAG); \
@@ -116,5 +124,5 @@ publish:
 	done
 
 release:
-	make publish TAG=latest SKIP_TESTS=true
-	make publish TAG=$(OPENWISP_VERSION) SKIP_BUILD=true SKIP_TESTS=true
+	make publish TAG=latest OPENWISP_VERSION=$(RELEASE_VERSION) SKIP_TESTS=true
+	make publish TAG=$(RELEASE_VERSION) OPENWISP_VERSION=$(RELEASE_VERSION) SKIP_BUILD=true SKIP_TESTS=true
diff --git a/deploy/auto-install.sh b/deploy/auto-install.sh
index b2e20b51..180d9818 100755
--- a/deploy/auto-install.sh
+++ b/deploy/auto-install.sh
@@ -59,11 +59,11 @@ apt_dependenices_setup() {
 }
 
 get_version_from_user() {
-	echo -ne ${GRN}"OpenWISP Version (leave blank for latest): "${NON}
-	read openwisp_version
-	if [[ -z "$openwisp_version" ]]; then
-		openwisp_version=$(curl -L --silent https://api.github.com/repos/openwisp/docker-openwisp/releases/latest | jq -r .tag_name)
-	fi
+    echo -ne ${GRN}"OpenWISP Version (leave blank for latest stable release): "${NON}
+    read openwisp_version
+    if [[ -z "$openwisp_version" ]]; then
+        openwisp_version=$(curl -L --silent https://api.github.com/repos/openwisp/docker-openwisp/releases/latest | jq -r .tag_name)
+    fi
 }
 
 setup_docker() {
@@ -128,7 +128,7 @@ setup_docker_openwisp() {
 
 	cd $INSTALL_PATH &>>$LOG_FILE
 	check_status $? "docker-openwisp download failed."
-	echo $openwisp_version >$INSTALL_PATH/VERSION
+	set_env "OPENWISP_VERSION" "$openwisp_version"
 
 	if [[ ! -f "$env_path" ]]; then
 		# Dashboard Domain
@@ -179,7 +179,7 @@ setup_docker_openwisp() {
 	start_step "Configuring docker-openwisp..."
 	report_ok
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE
 	check_status $? "Starting openwisp failed."
 }
 
@@ -192,7 +192,7 @@ upgrade_docker_openwisp() {
 
 	cd $INSTALL_PATH &>>$LOG_FILE
 	check_status $? "docker-openwisp download failed."
-	echo $openwisp_version >$INSTALL_PATH/VERSION
+	set_env "OPENWISP_VERSION" "$openwisp_version"
 
 	start_step "Configuring docker-openwisp..."
 	for config in $(grep '=' $ENV_BACKUP | cut -f1 -d'='); do
@@ -202,7 +202,7 @@ upgrade_docker_openwisp() {
 	report_ok
 
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE
 	check_status $? "Starting openwisp failed."
 }
 
diff --git a/docker-compose.yml b/docker-compose.yml
index f010ae3b..98e81c4d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,7 @@ x-celery-depends-on: &celery-depends-on
 
 services:
   dashboard:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -35,7 +35,7 @@ services:
       - influxdb
 
   api:
-    image: openwisp/openwisp-api:latest
+    image: openwisp/openwisp-api:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -55,7 +55,7 @@ services:
       - dashboard
 
   websocket:
-    image: openwisp/openwisp-websocket:latest
+    image: openwisp/openwisp-websocket:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -70,7 +70,7 @@ services:
       - dashboard
 
   celery:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celery
@@ -85,7 +85,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celery_monitoring:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celery_monitoring
@@ -99,7 +99,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celerybeat:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celerybeat
@@ -113,7 +113,7 @@ services:
       - dashboard
 
   nginx:
-    image: openwisp/openwisp-nginx:latest
+    image: openwisp/openwisp-nginx:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -140,7 +140,7 @@ services:
       - websocket
 
   freeradius:
-    image: openwisp/openwisp-freeradius:latest
+    image: openwisp/openwisp-freeradius:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -156,7 +156,7 @@ services:
       - dashboard
 
   postfix:
-    image: openwisp/openwisp-postfix:latest
+    image: openwisp/openwisp-postfix:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -167,7 +167,7 @@ services:
       - openwisp_certs:/etc/ssl/mail
 
   openvpn:
-    image: openwisp/openwisp-openvpn:latest
+    image: openwisp/openwisp-openvpn:${OPENWISP_VERSION:-edge}
     restart: on-failure
     build:
       context: images