diff --git a/.github/workflows/container-validation.yml b/.github/workflows/container-validation.yml
index 6a015ac..730dba5 100644
--- a/.github/workflows/container-validation.yml
+++ b/.github/workflows/container-validation.yml
@@ -13,7 +13,7 @@ jobs:
       context_path: "simplerisk/"
       dockerfile_path: "simplerisk/Dockerfile"
       image_tag: "simplerisk/simplerisk:testing"
-      build_args: "ubuntu_version_code=jammy"
+      build_args: "ubuntu_version_code=jammy\nPREGA_BUNDLE_FALLBACK=true"
 
   simplerisk-noble:
     name: 'Verify simplerisk/simplerisk image based on Ubuntu 24.04 (Noble)'
@@ -22,7 +22,7 @@ jobs:
       context_path: "simplerisk/"
       dockerfile_path: "simplerisk/Dockerfile"
       image_tag: "simplerisk/simplerisk:testing"
-      build_args: "ubuntu_version_code=noble"
+      build_args: "ubuntu_version_code=noble\nPREGA_BUNDLE_FALLBACK=true"
 
   simplerisk-minimal-php84:
     name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.3 with Apache'
@@ -31,7 +31,7 @@ jobs:
       context_path: "simplerisk-minimal/"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_tag: "simplerisk/simplerisk-minimal:testing"
-      build_args: "php_version=8.3"
+      build_args: "php_version=8.3\nPREGA_BUNDLE_FALLBACK=true"
 
   simplerisk-minimal-php85:
     name: 'Verify simplerisk/simplerisk-minimal image based on PHP 8.4 with Apache'
@@ -40,4 +40,4 @@ jobs:
       context_path: "simplerisk-minimal/"
       dockerfile_path: "simplerisk-minimal/Dockerfile"
       image_tag: "simplerisk/simplerisk-minimal:testing"
-      build_args: "php_version=8.4"
+      build_args: "php_version=8.4\nPREGA_BUNDLE_FALLBACK=true"
diff --git a/simplerisk-minimal/Dockerfile b/simplerisk-minimal/Dockerfile
index b62dd3c..1e0304e 100644
--- a/simplerisk-minimal/Dockerfile
+++ b/simplerisk-minimal/Dockerfile
@@ -3,10 +3,23 @@ ARG php_version=8.4
 
 FROM alpine/curl:8.12.1 AS downloader
 
+# PREGA_BUNDLE_FALLBACK is a CI-ONLY switch, default false. bump_downstream opens
+# the docker update-<version> PR at the testing cut, before that version's PROD
+# bundle exists (it lands in public/bundles/ only at GA). container-validation
+# sets this true so the PR can validate against the testing bundle. The GA publish
+# leaves it FALSE, so a released image is ALWAYS built from the prod bundle and
+# NEVER silently falls back to testing bytes (even on a transient prod failure).
+ARG PREGA_BUNDLE_FALLBACK=false
+
 SHELL [ "/bin/ash", "-eo", "pipefail", "-c" ]
 
 RUN mkdir -p /var/www && \
-    curl -sL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-20260519-001.tgz | tar xz -C /var/www
+    if curl -fsSL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-20260519-001.tgz -o /tmp/bundle.tgz; then true; \
+    elif [ "$PREGA_BUNDLE_FALLBACK" = "true" ]; then \
+      echo "prod bundle absent — pre-GA CI fallback to bundles-test"; \
+      curl -fsSL https://bundles-test.simplerisk.com/simplerisk-20260519-001.tgz -o /tmp/bundle.tgz; \
+    else echo "prod bundle simplerisk-20260519-001.tgz not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi && \
+    tar xzf /tmp/bundle.tgz -C /var/www && rm -f /tmp/bundle.tgz
 
 FROM php:${php_version}-apache
 
diff --git a/simplerisk-minimal/generate_dockerfile.sh b/simplerisk-minimal/generate_dockerfile.sh
index 433fd1a..e3f0f7f 100755
--- a/simplerisk-minimal/generate_dockerfile.sh
+++ b/simplerisk-minimal/generate_dockerfile.sh
@@ -23,10 +23,23 @@ if [ "$release" != "testing" ]; then
 	cat << EOF >> "${SCRIPT_LOCATION}/Dockerfile"
 FROM alpine/curl:8.12.1 AS downloader
 
+# PREGA_BUNDLE_FALLBACK is a CI-ONLY switch, default false. bump_downstream opens
+# the docker update-<version> PR at the testing cut, before that version's PROD
+# bundle exists (it lands in public/bundles/ only at GA). container-validation
+# sets this true so the PR can validate against the testing bundle. The GA publish
+# leaves it FALSE, so a released image is ALWAYS built from the prod bundle and
+# NEVER silently falls back to testing bytes (even on a transient prod failure).
+ARG PREGA_BUNDLE_FALLBACK=false
+
 SHELL [ "/bin/ash", "-eo", "pipefail", "-c" ]
 
 RUN mkdir -p /var/www && \\
-    curl -sL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-$release.tgz | tar xz -C /var/www
+    if curl -fsSL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-$release.tgz -o /tmp/bundle.tgz; then true; \\
+    elif [ "\$PREGA_BUNDLE_FALLBACK" = "true" ]; then \\
+      echo "prod bundle absent — pre-GA CI fallback to bundles-test"; \\
+      curl -fsSL https://bundles-test.simplerisk.com/simplerisk-$release.tgz -o /tmp/bundle.tgz; \\
+    else echo "prod bundle simplerisk-$release.tgz not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi && \\
+    tar xzf /tmp/bundle.tgz -C /var/www && rm -f /tmp/bundle.tgz
 
 EOF
 fi
diff --git a/simplerisk/Dockerfile b/simplerisk/Dockerfile
index 300327a..6a962f2 100644
--- a/simplerisk/Dockerfile
+++ b/simplerisk/Dockerfile
@@ -4,12 +4,27 @@ ARG ubuntu_version_code=noble
 FROM alpine/curl:8.12.1 AS downloader
 
 ARG DB_LANG=en
+# PREGA_BUNDLE_FALLBACK is a CI-ONLY switch, default false. bump_downstream opens
+# the docker update-<version> PR at the testing cut, before that version's PROD
+# bundle + SQL exist (they land in public/bundles/ and database/master only at GA).
+# container-validation sets this true so the PR can validate against the testing
+# sources. The GA publish leaves it FALSE, so a released image is ALWAYS built from
+# the prod bundle/SQL and NEVER silently falls back to testing bytes.
+ARG PREGA_BUNDLE_FALLBACK=false
 
 SHELL [ "/bin/ash", "-eo", "pipefail", "-c" ]
 
 RUN mkdir -p /var/www && \
-    curl -sL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-20260519-001.tgz | tar xz -C /var/www && \
-    curl -sL "https://github.com/simplerisk/database/raw/master/simplerisk-$DB_LANG-20260519-001.sql" > /simplerisk.sql
+    if curl -fsSL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-20260519-001.tgz -o /tmp/bundle.tgz; then true; \
+    elif [ "$PREGA_BUNDLE_FALLBACK" = "true" ]; then \
+      echo "prod bundle absent — pre-GA CI fallback to bundles-test"; \
+      curl -fsSL https://bundles-test.simplerisk.com/simplerisk-20260519-001.tgz -o /tmp/bundle.tgz; \
+    else echo "prod bundle simplerisk-20260519-001.tgz not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi && \
+    tar xzf /tmp/bundle.tgz -C /var/www && rm -f /tmp/bundle.tgz && \
+    if curl -fsSL "https://github.com/simplerisk/database/raw/master/simplerisk-$DB_LANG-20260519-001.sql" -o /simplerisk.sql; then true; \
+    elif [ "$PREGA_BUNDLE_FALLBACK" = "true" ]; then \
+      curl -fsSL "https://github.com/simplerisk/database/raw/testing/simplerisk-$DB_LANG-20260519-001.sql" -o /simplerisk.sql; \
+    else echo "prod SQL simplerisk-$DB_LANG-20260519-001.sql not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi
 
 # Using Ubuntu image
 FROM ubuntu:${ubuntu_version_code}
diff --git a/simplerisk/generate_dockerfile.sh b/simplerisk/generate_dockerfile.sh
index 7716e87..45db821 100755
--- a/simplerisk/generate_dockerfile.sh
+++ b/simplerisk/generate_dockerfile.sh
@@ -22,12 +22,27 @@ if [ "$release" != "testing" ]; then
 FROM alpine/curl:8.12.1 AS downloader
 
 ARG DB_LANG=en
+# PREGA_BUNDLE_FALLBACK is a CI-ONLY switch, default false. bump_downstream opens
+# the docker update-<version> PR at the testing cut, before that version's PROD
+# bundle + SQL exist (they land in public/bundles/ and database/master only at GA).
+# container-validation sets this true so the PR can validate against the testing
+# sources. The GA publish leaves it FALSE, so a released image is ALWAYS built from
+# the prod bundle/SQL and NEVER silently falls back to testing bytes.
+ARG PREGA_BUNDLE_FALLBACK=false
 
 SHELL [ "/bin/ash", "-eo", "pipefail", "-c" ]
 
 RUN mkdir -p /var/www && \\
-    curl -sL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-$release.tgz | tar xz -C /var/www && \\
-    curl -sL "https://github.com/simplerisk/database/raw/master/simplerisk-\$DB_LANG-$release.sql" > /simplerisk.sql
+    if curl -fsSL https://simplerisk-downloads.s3.amazonaws.com/public/bundles/simplerisk-$release.tgz -o /tmp/bundle.tgz; then true; \\
+    elif [ "\$PREGA_BUNDLE_FALLBACK" = "true" ]; then \\
+      echo "prod bundle absent — pre-GA CI fallback to bundles-test"; \\
+      curl -fsSL https://bundles-test.simplerisk.com/simplerisk-$release.tgz -o /tmp/bundle.tgz; \\
+    else echo "prod bundle simplerisk-$release.tgz not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi && \\
+    tar xzf /tmp/bundle.tgz -C /var/www && rm -f /tmp/bundle.tgz && \\
+    if curl -fsSL "https://github.com/simplerisk/database/raw/master/simplerisk-\$DB_LANG-$release.sql" -o /simplerisk.sql; then true; \\
+    elif [ "\$PREGA_BUNDLE_FALLBACK" = "true" ]; then \\
+      curl -fsSL "https://github.com/simplerisk/database/raw/testing/simplerisk-\$DB_LANG-$release.sql" -o /simplerisk.sql; \\
+    else echo "prod SQL simplerisk-\$DB_LANG-$release.sql not found and PREGA_BUNDLE_FALLBACK=false" && exit 1; fi
 
 EOF
 fi