diff --git a/services/control/Dockerfile b/services/control/Dockerfile
index b4c8c70..7c9f2cf 100644
--- a/services/control/Dockerfile
+++ b/services/control/Dockerfile
@@ -4,6 +4,13 @@
 # using only the Node standard library.
 FROM node:20-alpine
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-control" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 WORKDIR /app
 COPY package.json ./
 COPY server.js simulators.js ./
diff --git a/services/editor/Dockerfile b/services/editor/Dockerfile
index 0517974..9f34f39 100644
--- a/services/editor/Dockerfile
+++ b/services/editor/Dockerfile
@@ -3,6 +3,13 @@
 # edits are immediately visible to the ROS build toolchain (F-15, S6). See WP-7.
 FROM codercom/code-server:4.129.0
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-editor" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 USER root
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
diff --git a/services/frontend/Dockerfile b/services/frontend/Dockerfile
index 08d4d1b..0bc0615 100644
--- a/services/frontend/Dockerfile
+++ b/services/frontend/Dockerfile
@@ -16,6 +16,13 @@ RUN npm run build
 
 # --- serve stage ---
 FROM nginx:1.27-alpine
+# OCI provenance labels on the shipped runtime image. UBEROS_VERSION defaults to
+# `dev` for local builds and is overridden at release time (FR-A5). See
+# docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-frontend" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
 EXPOSE 3000
diff --git a/services/gazebo/Dockerfile b/services/gazebo/Dockerfile
index 8474008..c9773a1 100644
--- a/services/gazebo/Dockerfile
+++ b/services/gazebo/Dockerfile
@@ -24,6 +24,13 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ARG ROS_DISTRO
 ENV ROS_DISTRO=${ROS_DISTRO}
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-gazebo" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 # procps provides pgrep for the health check. The gz-launch websocket server
 # plugin is expected to be present in the `-full` image used by this service.
 RUN apt-get update \
diff --git a/services/gazebo/client/Dockerfile b/services/gazebo/client/Dockerfile
index e8a805c..e573d50 100644
--- a/services/gazebo/client/Dockerfile
+++ b/services/gazebo/client/Dockerfile
@@ -18,6 +18,13 @@ RUN npm run build
 
 # --- serve stage ---
 FROM nginx:1.27-alpine
+# OCI provenance labels on the shipped runtime image. UBEROS_VERSION defaults to
+# `dev` for local builds and is overridden at release time (FR-A5). See
+# docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-gzweb-client" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 # Built with Vite base '/gzweb/', so the assets live under a /gzweb/ path
 # prefix; copy them there so request paths map 1:1 onto the filesystem.
diff --git a/services/proxy/Dockerfile b/services/proxy/Dockerfile
index a136f04..cefa3f1 100644
--- a/services/proxy/Dockerfile
+++ b/services/proxy/Dockerfile
@@ -4,6 +4,13 @@
 # custom entrypoint is needed.
 FROM nginx:1.27-alpine
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-proxy" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 COPY docker-entrypoint.d/40-uberos-auth.sh /docker-entrypoint.d/40-uberos-auth.sh
 RUN chmod +x /docker-entrypoint.d/40-uberos-auth.sh
 
diff --git a/services/ros/Dockerfile b/services/ros/Dockerfile
index eaf311e..242dc91 100644
--- a/services/ros/Dockerfile
+++ b/services/ros/Dockerfile
@@ -11,6 +11,13 @@ FROM ros:${ROS_DISTRO}-ros-base
 ARG ROS_DISTRO
 ENV ROS_DISTRO=${ROS_DISTRO}
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-ros" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 # Install colcon toolchain, rosbridge, rosapi, and utilities.
 # procps provides pgrep; curl/wget used by tooling and health probing.
 #
diff --git a/services/turtlesim/Dockerfile b/services/turtlesim/Dockerfile
index 6dfbe79..7a8a341 100644
--- a/services/turtlesim/Dockerfile
+++ b/services/turtlesim/Dockerfile
@@ -16,6 +16,13 @@ FROM ros:${ROS_DISTRO}-ros-base
 ARG ROS_DISTRO
 ENV ROS_DISTRO=${ROS_DISTRO}
 
+# OCI provenance labels. UBEROS_VERSION defaults to `dev` for local builds and
+# is overridden at release time (FR-A5). See docs/VERSIONING.md.
+ARG UBEROS_VERSION=dev
+LABEL org.opencontainers.image.version="${UBEROS_VERSION}" \
+      org.opencontainers.image.title="uberos-turtlesim" \
+      org.opencontainers.image.source="https://github.com/jmservera/UbeROS"
+
 # turtlesim + the VNC toolchain (Xvfb framebuffer, openbox window manager,
 # x11vnc export, novnc/websockify browser bridge). x11-utils provides xdpyinfo
 # for the framebuffer readiness probe; curl is used by the container health check.