diff --git a/immich/immich.yml b/immich/immich.yml
index fd3a057..09c49a6 100644
--- a/immich/immich.yml
+++ b/immich/immich.yml
@@ -1,15 +1,11 @@
 #
-# Swarm-adapted version of the official Immich docker-compose.yml
-# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+# Pattern C (partial): DB_PASSWORD as Docker secret (_FILE)
+# IMMICH_KIOSK_BASICAUTH stays in host immich.env (Traefik label)
 #
-# Pattern B: no env_file — non-secret vars inlined, secrets (DB_PASSWORD,
-# IMMICH_KIOSK_BASICAUTH) remain in host immich/immich.env on the swarm manager.
-#
-
 services:
   immich-server:
     hostname: immich
-    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-v3}
     volumes:
       - ${UPLOAD_LOCATION}:/data
       - /etc/localtime:/etc/localtime:ro
@@ -21,12 +17,14 @@ services:
       REDIS_HOSTNAME: ${REDIS_HOSTNAME}
       REDIS_PORT: ${REDIS_PORT}
       REDIS_DBINDEX: ${REDIS_DBINDEX}
-      DB_PASSWORD: ${DB_PASSWORD}
+      DB_PASSWORD_FILE: /run/secrets/immich_db_password
       DB_USERNAME: ${DB_USERNAME}
       DB_DATABASE_NAME: ${DB_DATABASE_NAME}
       DB_HOSTNAME: ${DB_HOSTNAME}
       DB_PORT: ${DB_PORT}
       IMMICH_TRUSTED_PROXIES: ${IMMICH_TRUSTED_PROXIES}
+    secrets:
+      - immich_db_password
     depends_on:
       - redis
       - database
@@ -49,7 +47,7 @@ services:
 
   immich-machine-learning:
     hostname: immich-ml
-    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-openvino
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-v3}-openvino
     volumes:
       - model-cache:/cache
       - /dev/dri:/dev/dri
@@ -60,11 +58,13 @@ services:
       REDIS_HOSTNAME: ${REDIS_HOSTNAME}
       REDIS_PORT: ${REDIS_PORT}
       REDIS_DBINDEX: ${REDIS_DBINDEX}
-      DB_PASSWORD: ${DB_PASSWORD}
+      DB_PASSWORD_FILE: /run/secrets/immich_db_password
       DB_USERNAME: ${DB_USERNAME}
       DB_DATABASE_NAME: ${DB_DATABASE_NAME}
       DB_HOSTNAME: ${DB_HOSTNAME}
       DB_PORT: ${DB_PORT}
+    secrets:
+      - immich_db_password
     deploy:
       mode: global
       labels:
@@ -103,10 +103,12 @@ services:
     hostname: immich_postgresql
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
     environment:
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_PASSWORD_FILE: /run/secrets/immich_db_password
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
+    secrets:
+      - immich_db_password
     volumes:
       - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
     networks:
@@ -156,6 +158,10 @@ services:
 volumes:
   model-cache:
 
+secrets:
+  immich_db_password:
+    external: true
+
 networks:
   postgresql_db-backend:
     external: true