diff --git a/CHANGELOG.md b/CHANGELOG.md
index 499d7db..d4b8bca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,12 +19,11 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   previously apt-installed `yq`, which on Debian/Ubuntu is the unrelated
   kislyuk/`yq` (a jq wrapper, v3.x) — incompatible with the mikefarah v4 syntax
   the `cloud-init` repo's `provision.sh`/`deploy.sh` expect. Dropped the apt
-  package and install a pinned mikefarah binary instead
-  (`ARG YQ_VERSION=v4.53.3`, multi-arch amd64/arm64, follows the repo's
-  tealdeer-style `latest`-or-pin pattern; override with `--build-arg`),
-  matching the `yq` used on control machines (Homebrew `yq` v4.x). The
-  build-time `smoke-test.sh` gate now asserts `yq --version` reports
-  `mikefarah`, so a regression back to the Python package fails CI.
+  package and install the mikefarah binary instead (multi-arch amd64/arm64,
+  following the repo's `latest` convention like `tealdeer`/`uv`; pin a tag
+  with `--build-arg YQ_VERSION=vX.Y.Z`). The build-time `smoke-test.sh` gate
+  asserts `yq --version` reports `mikefarah` **and** major **v4**, so both a
+  regression to the Python package and a surprise future yq v5 fail CI.
 
 ---
 
diff --git a/Dockerfile.base b/Dockerfile.base
index ba08faf..e94d6a7 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -408,9 +408,11 @@ RUN ARCH=$(case "${TARGETARCH}" in amd64) echo "x86_64" ;; arm64) echo "aarch64"
 # Installed as the mikefarah Go binary — NOT Debian's `yq` apt package, which
 # is the unrelated Python kislyuk/yq (a jq wrapper with different syntax and
 # version line, e.g. 3.x). The cloud-init repo's deploy.sh/provision.sh
-# require mikefarah yq v4; pinned here to the v4.x release used on the
-# control machines (override with --build-arg YQ_VERSION=latest|vX.Y.Z).
-ARG YQ_VERSION=v4.53.3
+# require mikefarah yq v4 (the unrelated Debian python yq is v3.x). Follows
+# the repo's `latest` convention (like tealdeer/uv/etc.); the smoke test pins
+# the contract to major v4, so a future yq v5 fails CI instead of silently
+# breaking provision.sh. Pin a specific tag with --build-arg YQ_VERSION=vX.Y.Z.
+ARG YQ_VERSION=latest
 RUN ARCH=$(case "${TARGETARCH}" in amd64) echo "amd64" ;; arm64) echo "arm64" ;; *) echo "amd64" ;; esac) && \
     V="${YQ_VERSION}" && \
     if [ "$V" = "latest" ]; then \
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 3a96d3a..c3e838f 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -76,7 +76,7 @@ run "mempalace-mcp"   "mempalace-mcp --help"
 run "pandoc"          "pandoc --version"
 run "graphviz (dot)"  "dot -V"
 run "imagemagick"     "magick --version"
-run "yq (mikefarah v4)" "yq --version | grep -q mikefarah"
+run "yq (mikefarah v4)" "yq --version | grep -qE 'mikefarah.*version v4'"
 run "tldr (tealdeer)" "tldr --version"
 run "socat"           "socat -V"
 run "studio-expose helper" "test -x /usr/local/bin/studio-expose"