diff --git a/README.md b/README.md
index 2463d1bdd..6b3ea6579 100644
--- a/README.md
+++ b/README.md
@@ -49,10 +49,9 @@ server says so on its Overview rather than leaving you guessing.
 Before you rely on it, know that:
 
 - A handful of production-readiness items are still open: a documented
-  backup/restore drill against a real restic repository, upgrade testing
-  across minor versions, and pinning the shipped modules' floating `latest`
-  image tags. None of these are code gaps — see
-  [`docs/roadmap.md`](docs/roadmap.md) for the full, current list.
+  backup/restore drill runbook, upgrade testing across minor versions, and
+  resource-limit guidance sized from real workloads. None of these are code
+  gaps — see [`docs/roadmap.md`](docs/roadmap.md) for the full, current list.
 
 [`docs/roadmap.md`](docs/roadmap.md) tracks everything that stands between beta
 and a v1 GA.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d95512cfc..da4f4d556 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -111,6 +111,21 @@ into the chart for module verification), and the `release` and
 digest with the provisioned `COSIGN_PRIVATE_KEY`. See
 [Signing official bundles](module-authoring.md#signing-official-bundles).
 
+### Hermetic module images (gameplane-module#35, docs in #178)
+
+Every shipped module's default image is now pinned by digest, so a server
+binary can no longer change underneath a user on pod restart with no version
+bump or changelog. This was not hypothetical: `terraria-latest` moved from
+Terraria 1.4.4.9 to 1.4.5.6, changing the network protocol version and
+breaking the e2e Terraria bot.
+
+Eight games also gained a real `spec.versions` list, so a floating tag now
+survives only where drift is the user's explicit, labelled choice. The
+module repo's `validate.py` enforces the rule (`spec.image` and any
+`default: true` entry are an error if unpinned, with a `# gameplane:floating`
+opt-out), and a monthly workflow refreshes the pins. Authoring rules live in
+[Pinning images by digest](module-authoring.md#pinning-images-by-digest).
+
 ---
 
 ## Blocking v1
@@ -134,15 +149,6 @@ production-readiness hardening below — tracked items, not code gaps.
   caveat (Helm never updates CRDs on `helm upgrade`; see
   [Helm CRD caveat](install.md#helm-crd-caveat)).
 - Resource-limit guidance sized from real workloads rather than defaults.
-- Hermetic module images: the shipped game modules pin floating upstream tags
-  (`terraria-latest`, `tmodloader-latest`), meaning a server binary can change
-  underneath a user on pod restart with no version bump or changelog. This is not
-  hypothetical: `terraria-latest` moved from Terraria 1.4.4.9 to 1.4.5.6,
-  changing the network protocol version and breaking the e2e Terraria bot. The
-  fix is to pin explicit image tags for the default image, and keep a floating
-  "latest" entry only in `spec.versions` where drift is the user's explicit,
-  labelled choice. Changes live in the `gameplane-module` repo with a submodule
-  pointer bump here.
 
 ### Wake-on-connect for idle auto-sleep
 
diff --git a/modules b/modules
index 1cd8c779f..f2247c25e 160000
--- a/modules
+++ b/modules
@@ -1 +1 @@
-Subproject commit 1cd8c779f181048f9e64ad3cc9cbe89d20f46693
+Subproject commit f2247c25e195388eaaaa2a538afad2ff6537caa3