diff --git a/README.md b/README.md
index 809ae95..88fbf15 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,20 @@ docker compose --profile with-nginx up -d    # 自带反向代理
 
 ## 镜像版本
 
-当前部署编排固定使用业务镜像 `v1.0.4`；`iotlcm-app-server` 与 `iotlcm-app-web` 固定为 `v1.0.2`。升级时请在 `docker-compose.yml` 中同步更新对应 tag，不要改用 `latest`。
+所有镜像（含基础组件）都在**同一个镜像仓库** `<镜像仓库>/iotlcm/iotlcm` 下，靠 tag 区分服务与版本：
+
+```text
+crpi-.../iotlcm/iotlcm:mysql-8.0
+crpi-.../iotlcm/iotlcm:redis-7.2
+crpi-.../iotlcm/iotlcm:iotlcm-admin-svr-v1.0.4
+crpi-.../iotlcm/iotlcm:iotlcm-app-server-v1.0.2
+```
+
+tag 格式统一为 **`<服务名>-<版本>`**。
+
+当前业务版本：大部分服务为 `v1.0.4`，`iotlcm-app-server` / `iotlcm-app-web` 为 `v1.0.2`（源仓最新 tag 就是 v1.0.2）。
+
+升级时在 `docker-compose.yml` 中同步更新 tag 的版本部分，不要改用 `latest`。
 
 ## 部署内容
 
diff --git a/docker-compose.yml b/docker-compose.yml
index e9529c8..22a7831 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,7 +18,7 @@ services:
   # ---------------- 基础组件 ----------------
   mysql:
     # 基础组件统走同一镜像仓库（`<REGISTRY>/iotlcm/`），版本在此固定
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/mysql:8.0'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:mysql-8.0'
     container_name: iotlcm-mysql
     restart: always
     ports:
@@ -45,7 +45,7 @@ services:
       start_period: 40s
 
   redis:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/redis:7.2'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:redis-7.2'
     container_name: iotlcm-redis
     restart: always
     ports:
@@ -69,7 +69,7 @@ services:
       retries: 5
 
   rabbitmq:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/rabbitmq:4.3.5-management'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:rabbitmq-4.3.5-management'
     container_name: iotlcm-rabbitmq
     hostname: rabbitmq
     restart: always
@@ -92,7 +92,7 @@ services:
       start_period: 30s
 
   consul:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/consul:1.22'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:consul-1.22'
     container_name: iotlcm-consul
     restart: always
     ports:
@@ -118,7 +118,7 @@ services:
 
   # ---------------- 业务服务 ----------------
   admin-svr:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-admin-svr:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-admin-svr-v1.0.4'
     container_name: iotlcm-admin-svr
     restart: always
     ports:
@@ -141,7 +141,7 @@ services:
         condition: service_healthy
 
   admin-ui:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-admin-ui:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-admin-ui-v1.0.4'
     container_name: iotlcm-admin-ui
     restart: always
     ports:
@@ -158,7 +158,7 @@ services:
       - admin-svr
 
   openapi:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-openapi:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-openapi-v1.0.4'
     container_name: iotlcm-openapi
     restart: always
     ports:
@@ -179,7 +179,7 @@ services:
         condition: service_healthy
 
   upstream-chan:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-upstream-chan:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-upstream-chan-v1.0.4'
     container_name: iotlcm-upstream-chan
     restart: always
     ports:
@@ -203,7 +203,7 @@ services:
         condition: service_started
 
   upstream-proxy:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-upstream-proxy:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-upstream-proxy-v1.0.4'
     container_name: iotlcm-upstream-proxy
     restart: always
     ports:
@@ -227,7 +227,7 @@ services:
         condition: service_started
 
   worker-svr:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-worker-svr:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-worker-svr-v1.0.4'
     container_name: iotlcm-worker-svr
     restart: always
     environment:
@@ -249,7 +249,7 @@ services:
         condition: service_healthy
 
   app-server:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-app-server:v1.0.2'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-app-server-v1.0.2'
     container_name: iotlcm-app-server
     restart: always
     ports:
@@ -270,7 +270,7 @@ services:
         condition: service_healthy
 
   app-web:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-app-web:v1.0.2'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-app-web-v1.0.2'
     container_name: iotlcm-app-web
     restart: always
     ports:
@@ -283,7 +283,7 @@ services:
       - iotlcm-network
 
   sms:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-sms:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-sms-v1.0.4'
     container_name: iotlcm-sms
     hostname: iotlcm-sms
     restart: always
@@ -311,7 +311,7 @@ services:
       - iotlcm-network
 
   bot:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-bot:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-bot-v1.0.4'
     container_name: iotlcm-bot
     restart: unless-stopped
     environment:
@@ -327,7 +327,7 @@ services:
       - with-bot
 
   docs:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-docs:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-docs-v1.0.4'
     container_name: iotlcm-docs
     restart: unless-stopped
     ports:
@@ -343,7 +343,7 @@ services:
   # 启用后 upstream-chan 的 sim_yd_mock_v5.url 指向 http://onelink-mock:8080/v5/
   # （config/upstream-chan 已预置该地址）
   onelink-mock:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm-onelink-mock:v1.0.4'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:iotlcm-onelink-mock-v1.0.4'
     container_name: iotlcm-onelink-mock
     restart: unless-stopped
     ports:
@@ -370,7 +370,7 @@ services:
   # 若宿主机已有 nginx / 面板，可不启动本容器，
   # 参考 config/nginx/iotlcm.conf 把 location 段落到宿主机配置。
   nginx:
-    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/nginx:1.30'
+    image: 'crpi-qflrqrxoohlkkvgc.cn-chengdu.personal.cr.aliyuncs.com/iotlcm/iotlcm:nginx-1.30'
     container_name: iotlcm-nginx
     restart: always
     ports: