diff --git a/Dockerfile b/Dockerfile
index b954ced..cf0a5df 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM python:3.14.5-slim-bookworm@sha256:ec58d916f9e24a6035cab2bdf07f6206c4cc092a16613c60597534711332d9d6
+ARG PYTHON_BASE=python:3.14.5-slim-bookworm@sha256:ec58d916f9e24a6035cab2bdf07f6206c4cc092a16613c60597534711332d9d6
+FROM ${PYTHON_BASE}
 ARG BUILD_COMMIT=development
 ARG BUILD_TIME=unknown
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 TZ=Asia/Shanghai \
diff --git a/docs/NAS.md b/docs/NAS.md
index 0cede66..8f24a17 100644
--- a/docs/NAS.md
+++ b/docs/NAS.md
@@ -1,7 +1,7 @@
 # Synology NAS deployment / 群晖部署
 
-Target: DS923+, DSM 7.3.1, AMD64, Container Manager.
-Directory: /volume1/docker/pigway-frame-flow. Port: 18787.
+Target: DS923+, DSM 7.4.1 (verified on target; originally specified 7.3.1), AMD64, Container Manager.
+Directory: /volume2/docker/pigway-frame-flow. Port: 18787.
 
 ## 1. Package and upload / 打包上传
 
@@ -24,10 +24,10 @@ onto another existing installation or other services. If the directory exists,
 inspect it first; preserve its .env and data.
 
 ```sh
-mkdir -p /volume1/docker/pigway-frame-flow
+mkdir -p /volume2/docker/pigway-frame-flow
 # Only for an empty/new target:
-tar -xzf /tmp/pigway-frame-flow-nas.tar.gz -C /volume1/docker
-cd /volume1/docker/pigway-frame-flow
+tar -xzf /tmp/pigway-frame-flow-nas.tar.gz -C /volume2/docker
+cd /volume2/docker/pigway-frame-flow
 mkdir -p data/images data/generated data/cache config
 sudo chown -R 10333:10333 data config
 cp .env.example .env
@@ -93,7 +93,7 @@ permission before any upload/switch/delete. See REAL_DEVICE_TEST.md.
 ## Layout
 
 ```
-/volume1/docker/pigway-frame-flow/
+/volume2/docker/pigway-frame-flow/
   docker-compose.yml
   Dockerfile
   .env
@@ -113,3 +113,16 @@ Container runs UID/GID 10333:10333; only data/config need ownership. Avoid recur
 ownership changes outside this project's paths. Standard Compose bridge is private
 and isolated by project name. Logs use stdout/stderr with Docker's capped json-file.
 No logs directory or Docker socket mount.
+
+## Restricted Docker Hub connectivity
+
+If Docker Hub is unreachable from NAS, import the exact official AMD64 base image
+from a trusted download machine. Verify its manifest, compressed blob SHA-256 and
+all uncompressed rootfs diff IDs before loading. With the verified local tag loaded:
+
+```sh
+sudo env DOCKER_BUILDKIT=0 /usr/local/bin/docker compose build \
+  --build-arg PYTHON_BASE=python:3.14.5-slim-bookworm
+```
+
+This per-build override does not change global registry or network configuration.