diff --git a/scripts/webui/data/generators/updater/webui_updater_scan.sh b/scripts/webui/data/generators/updater/webui_updater_scan.sh
index e8c7662..4c08995 100644
--- a/scripts/webui/data/generators/updater/webui_updater_scan.sh
+++ b/scripts/webui/data/generators/updater/webui_updater_scan.sh
@@ -35,12 +35,33 @@
 # sentinel added to anchor lines) plus surrounding whitespace.
 _updaterCleanImageRef() { sed -E 's/^\s*image:\s*//; s/["'"'"']//g; s/[[:space:]]*#.*$//; s/[[:space:]]*$//'; }
 updaterPrimaryImage() {
-    local app="$1" compose="$2" svc img
-    svc="${app//_/-}-service"
-    img="$(awk -v s="$svc" '
-        m && /^[[:space:]]*image:/ { print; exit }
-        $0 ~ ("^[[:space:]]*" s ":") { m=1 }
-    ' "$compose" 2>/dev/null | _updaterCleanImageRef)"
+    local app="$1" compose="$2" svc img up
+    up="$(printf '%s' "$app" | tr '[:lower:]' '[:upper:]')"
+
+    # The app's own version sentinel names the anchor outright. Every image line
+    # carries a #LIBREPORTAL|<KEY>_VERSION_TAG|<tag> marker, and the one whose
+    # key is the BARE app name (STOAT_VERSION_TAG, not STOAT_MONGO_VERSION_TAG)
+    # is by construction the app's own version — 37 of 38 apps have exactly one.
+    #
+    # Ask it first, because the <slug>-service convention below is not universal
+    # and fails silently when it is absent. Stoat names its services database /
+    # api / events / …, so the fallback picked the FIRST image line — mongo:8.0 —
+    # and the whole app then wore MongoDB's identity: version 8.0 instead of
+    # v0.15.1, "8.3 available" meaning a MongoDB major, CVE scans covering mongo
+    # and none of the nine Stoat images, and an Upgrade button that would have
+    # walked the database 8.0 → 8.3 under a live sixteen-service stack.
+    img="$(grep -E "#LIBREPORTAL\|${up}_VERSION_TAG\|" "$compose" 2>/dev/null | head -1 | _updaterCleanImageRef)"
+
+    # Then the <slug>-service convention (underscores become hyphens), which
+    # resolves ollama to ollama-service rather than its open-webui companion.
+    if [ -z "$img" ]; then
+        svc="${app//_/-}-service"
+        img="$(awk -v s="$svc" '
+            m && /^[[:space:]]*image:/ { print; exit }
+            $0 ~ ("^[[:space:]]*" s ":") { m=1 }
+        ' "$compose" 2>/dev/null | _updaterCleanImageRef)"
+    fi
+
     [ -n "$img" ] || img="$(grep -m1 -E '^\s*image:' "$compose" 2>/dev/null | _updaterCleanImageRef)"
     printf '%s' "$img"
 }