diff --git a/stacks/clic/compose.yaml b/stacks/clic/compose.yaml
index 0c8ea15..38edd36 100644
--- a/stacks/clic/compose.yaml
+++ b/stacks/clic/compose.yaml
@@ -1,9 +1,51 @@
 # Included by ../../docker-compose.yaml; use the root Compose entrypoint.
 services:
+  # One-time approved catalogue update; gates application startup.
+  clic-curated-update:
+    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:curated-v1-20261102@sha256:977313385ae4836c85175ed23ebd7ff84cf7164add67bb64aa3c42a39e7e3917}
+    container_name: clic-curated-update
+    restart: "no"
+    env_file:
+      - /mount/webhosting_dmz_write/clic/clic.env
+    entrypoint: ["python", "manage.py", "deploy_curated_catalog_update"]
+    command: []
+    environment:
+      - DJANGO_SETTINGS_MODULE=config.settings.production
+      - POSTGRES_HOST=clic-db
+      - POSTGRES_PORT=5432
+      - CLIC_CACHE_BACKEND=redis
+      - CLIC_REDIS_URL=redis://clic-redis:6379/0
+      - CLIC_REQUIRE_SHARED_CACHE=1
+      - CLIC_CURATED_UPDATE_ACTOR=${CLIC_CURATED_UPDATE_ACTOR:-romainsacchi}
+      - CLIC_CURATED_UPDATE_REPORTS=/var/lib/clic/curated-updates
+      - CLIC_BOOTSTRAP_ADMINS_ENABLED=0
+      - BRIGHTPATH_SOURCE_DIR=
+      - BRIGHTWAY2_DIR=/tmp
+      - INVENTORY_ARCHIVE_ENVIRONMENT=production
+      - INVENTORY_ARCHIVE_AUTO_RESTORE=0
+      - INVENTORY_ARCHIVE_PUBLISH_MODE=off
+      - INVENTORY_ARCHIVE_TERMS_REVIEWED=0
+      - INVENTORY_ARCHIVE_TOKEN=
+      - INVENTORY_ARCHIVE_OWNER_ID=86122
+      - INVENTORY_ARCHIVE_SERIES_ID=22850223
+      - INVENTORY_ARCHIVE_BOOTSTRAP_RECORD_ID=
+      - INVENTORY_ARCHIVE_BOOTSTRAP_SHA256=
+      - IMPACT_SCORES_ENABLED=0
+      - EMAIL_BACKEND=django.core.mail.backends.locmem.EmailBackend
+    volumes:
+      - clic_curated_update_reports:/var/lib/clic/curated-updates
+    depends_on:
+      clic-db:
+        condition: service_healthy
+      clic-redis:
+        condition: service_started
+    networks:
+      - clic_backend
+
   # Romain Sacchi <romain.sacchi@psi.ch>
   # CLIC Django platform
   clic-web:
-    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:dab21a5-missing-foreground-2a1fe954da76@sha256:1e13386f3a435681be61900707f11f858faee22171e644912bba7b7df3a19fd2}
+    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:curated-v1-20261102@sha256:977313385ae4836c85175ed23ebd7ff84cf7164add67bb64aa3c42a39e7e3917}
     container_name: clic-web
     restart: always
     env_file:
@@ -15,6 +57,8 @@ services:
       - CLIC_CACHE_BACKEND=redis
       - CLIC_REDIS_URL=redis://clic-redis:6379/0
       - CLIC_REQUIRE_SHARED_CACHE=1
+      - CLIC_CURATED_UPDATE_REQUIRED=v1
+      - BRIGHTPATH_SOURCE_DIR=
       - INVENTORY_ARCHIVE_ENVIRONMENT=production
       - INVENTORY_ARCHIVE_AUTO_RESTORE=1
       - INVENTORY_ARCHIVE_PUBLISH_MODE=off
@@ -28,6 +72,8 @@ services:
       - /mount/webhosting_dmz_write/clic/media:/app/media
       - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
     depends_on:
+      clic-curated-update:
+        condition: service_completed_successfully
       clic-db:
         condition: service_healthy
       clic-redis:
@@ -48,7 +94,7 @@ services:
       - clic_backend
 
   clic-package-exports:
-    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:dab21a5-missing-foreground-2a1fe954da76@sha256:1e13386f3a435681be61900707f11f858faee22171e644912bba7b7df3a19fd2}
+    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:curated-v1-20261102@sha256:977313385ae4836c85175ed23ebd7ff84cf7164add67bb64aa3c42a39e7e3917}
     container_name: clic-package-exports
     restart: always
     env_file:
@@ -60,15 +106,19 @@ services:
       - CLIC_CACHE_BACKEND=redis
       - CLIC_REDIS_URL=redis://clic-redis:6379/0
       - CLIC_REQUIRE_SHARED_CACHE=1
+      - CLIC_CURATED_UPDATE_REQUIRED=v1
+      - BRIGHTPATH_SOURCE_DIR=
       - INVENTORY_ARCHIVE_AUTO_RESTORE=0
       - INVENTORY_ARCHIVE_PUBLISH_MODE=off
       - INVENTORY_ARCHIVE_TOKEN=
     volumes:
       - /mount/webhosting_dmz_write/clic/media:/app/media
       - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
-    entrypoint: ["python"]
+    entrypoint: ["sh", "/app/scripts/curated-worker-entrypoint.sh"]
     command: ["manage.py", "process_package_exports"]
     depends_on:
+      clic-curated-update:
+        condition: service_completed_successfully
       clic-web:
         condition: service_healthy
       clic-db:
@@ -79,7 +129,7 @@ services:
       - clic_backend
 
   clic-brightway-json-exports:
-    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:dab21a5-missing-foreground-2a1fe954da76@sha256:1e13386f3a435681be61900707f11f858faee22171e644912bba7b7df3a19fd2}
+    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:curated-v1-20261102@sha256:977313385ae4836c85175ed23ebd7ff84cf7164add67bb64aa3c42a39e7e3917}
     container_name: clic-brightway-json-exports
     restart: always
     env_file:
@@ -91,13 +141,15 @@ services:
       - CLIC_CACHE_BACKEND=redis
       - CLIC_REDIS_URL=redis://clic-redis:6379/0
       - CLIC_REQUIRE_SHARED_CACHE=1
+      - CLIC_CURATED_UPDATE_REQUIRED=v1
+      - BRIGHTPATH_SOURCE_DIR=
       - INVENTORY_ARCHIVE_AUTO_RESTORE=0
       - INVENTORY_ARCHIVE_PUBLISH_MODE=off
       - INVENTORY_ARCHIVE_TOKEN=
     volumes:
       - /mount/webhosting_dmz_write/clic/media:/app/media
       - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
-    entrypoint: ["python"]
+    entrypoint: ["sh", "/app/scripts/curated-worker-entrypoint.sh"]
     command:
       [
         "manage.py",
@@ -107,6 +159,8 @@ services:
         "${CLIC_API_EXPORT_POLL_SECONDS:-2}",
       ]
     depends_on:
+      clic-curated-update:
+        condition: service_completed_successfully
       clic-web:
         condition: service_healthy
       clic-db:
@@ -117,7 +171,7 @@ services:
       - clic_backend
 
   clic-inventory-archive:
-    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:dab21a5-missing-foreground-2a1fe954da76@sha256:1e13386f3a435681be61900707f11f858faee22171e644912bba7b7df3a19fd2}
+    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:curated-v1-20261102@sha256:977313385ae4836c85175ed23ebd7ff84cf7164add67bb64aa3c42a39e7e3917}
     container_name: clic-inventory-archive
     restart: always
     env_file:
@@ -129,6 +183,8 @@ services:
       - CLIC_CACHE_BACKEND=redis
       - CLIC_REDIS_URL=redis://clic-redis:6379/0
       - CLIC_REQUIRE_SHARED_CACHE=1
+      - CLIC_CURATED_UPDATE_REQUIRED=v1
+      - BRIGHTPATH_SOURCE_DIR=
       - IMPACT_SCORES_ENABLED=0
       - INVENTORY_ARCHIVE_ENVIRONMENT=production
       - INVENTORY_ARCHIVE_AUTO_RESTORE=0
@@ -141,9 +197,11 @@ services:
       - INVENTORY_ARCHIVE_METADATA_FILE=/app/config/inventory-archive-metadata.json
       - INVENTORY_ARCHIVE_REDISTRIBUTION_FILE=
       - INVENTORY_ARCHIVE_ALERT_EMAIL=romain.sacchi@psi.ch
-    entrypoint: ["python"]
+    entrypoint: ["sh", "/app/scripts/curated-worker-entrypoint.sh"]
     command: ["manage.py", "run_inventory_archive_worker"]
     depends_on:
+      clic-curated-update:
+        condition: service_completed_successfully
       clic-web:
         condition: service_healthy
     healthcheck:
@@ -184,3 +242,7 @@ services:
       - /mount/webhosting_dmz_write/clic/redis:/data
     networks:
       - clic_backend
+
+volumes:
+  # Private operator receipts; keep outside the public media mount.
+  clic_curated_update_reports: