diff --git a/.github/image-bump-policy.yaml b/.github/image-bump-policy.yaml
index 2c070f396..3d7820733 100644
--- a/.github/image-bump-policy.yaml
+++ b/.github/image-bump-policy.yaml
@@ -34,13 +34,18 @@ services:
   postgres: {regex: '^(\d+)-alpine$', track: patch}
   python: {regex: '^(\d+)\.(\d+)-slim$', track: patch}
   redis: {regex: '^(\d+)-alpine$', track: patch}
+  valkey: {regex: '^(\d+)\.(\d+)-alpine$', track: patch}
   # --- exact versions: patch releases within the current minor ---
   alertmanager: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
   auth: {regex: '^(\d+)\.(\d+)\.(\d+)$', track: patch}
+  # auth-v14 / hasura-v14: the v1.4 line stays on its own minor (auth 0.36, hasura 2.44);
+  # only patch releases move. 0.43.0 and later auth need AUTH_ENCRYPTION_KEY.
+  auth-v14: {regex: '^(\d+)\.(\d+)\.(\d+)$', track: patch}
   cadvisor: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
   elasticsearch: {regex: '^(\d+)\.(\d+)\.(\d+)$', track: patch}
   grafana: {regex: '^(\d+)\.(\d+)\.(\d+)$', track: patch}
   hasura: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
+  hasura-v14: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
   lego: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
   loki: {regex: '^(\d+)\.(\d+)\.(\d+)$', track: patch}
   mlflow: {regex: '^v(\d+)\.(\d+)\.(\d+)$', track: patch}
diff --git a/tools/imagebump/bump_test.go b/tools/imagebump/bump_test.go
index 2d242981c..46cc47c76 100644
--- a/tools/imagebump/bump_test.go
+++ b/tools/imagebump/bump_test.go
@@ -130,3 +130,45 @@ func TestDryRunWritesNothing(t *testing.T) {
 		t.Fatal("dry-run modified the file")
 	}
 }
+
+// TestRepoPoliciesCoverEveryPin guards D-1486: every non-plugin pin in the real
+// internal/compose/images.yaml needs an entry in the real policy, and its
+// current version must match that entry's regex (the weekly run exits 1 on
+// either gap).
+func TestRepoPoliciesCoverEveryPin(t *testing.T) {
+	praw, err := os.ReadFile("../../.github/image-bump-policy.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pol, err := loadPolicy(praw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lraw, err := os.ReadFile("../../internal/compose/images.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	lf, err := parseLockFile(lraw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(lf.Images) == 0 {
+		t.Fatal("images.yaml lists no images")
+	}
+	for _, img := range lf.Images {
+		if img.Role == "plugin" {
+			continue
+		}
+		r, ok := pol.rules[img.Name]
+		if !ok {
+			t.Errorf("%s: no entry in .github/image-bump-policy.yaml", img.Name)
+			continue
+		}
+		if r.track == "manual" {
+			continue
+		}
+		if _, matched, err := versionOf(r.re, img.Version); err != nil || !matched {
+			t.Errorf("%s: version %q does not match its policy regex %s (err %v)", img.Name, img.Version, r.re, err)
+		}
+	}
+}