diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e45704e9..bdcfb1c1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ permissions:
 env:
   VERSION: ${{ inputs.version || github.ref_name }}
   IMAGE: ghcr.io/vvzvlad/gitmost
+  AI_AGENT_ROLES_CATALOG_URL: https://raw.githubusercontent.com/vvzvlad/gitmost/main/agent-roles-catalog
 
 jobs:
   # Run the reusable test suite first so a failing test blocks the image build.
@@ -57,7 +58,7 @@ jobs:
           platforms: ${{ matrix.platform }}
           build-args: |
             APP_VERSION=${{ env.VERSION }}
-            AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/main/agent-roles-catalog
+            AI_AGENT_ROLES_CATALOG_URL=${{ env.AI_AGENT_ROLES_CATALOG_URL }}
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=${{ matrix.suffix }}
           cache-to: type=gha,scope=${{ matrix.suffix }},mode=max,ignore-error=true
@@ -86,7 +87,7 @@ jobs:
           platforms: ${{ matrix.platform }}
           build-args: |
             APP_VERSION=${{ env.VERSION }}
-            AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/main/agent-roles-catalog
+            AI_AGENT_ROLES_CATALOG_URL=${{ env.AI_AGENT_ROLES_CATALOG_URL }}
           push: false
           tags: |
             ${{ env.IMAGE }}:latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index daa64545..a46c61b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -39,8 +39,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `/update-from-catalog` — and a new `source` column linking a role to its
   catalog slug/language/version. The catalog source is configured via the
   `AI_AGENT_ROLES_CATALOG_URL` env var — an `http(s)://` base URL to the
-  catalog's raw files, baked into the image at build time and set per branch in
-  CI (see `.env.example`). (#222)
+  catalog's raw files; the image ships a per-branch default baked in CI, and it
+  can be overridden at runtime via the env var (see `.env.example`). (#222)
 
 ### Fixed
 
diff --git a/Dockerfile b/Dockerfile
index 591cddba..e6daeb72 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,8 @@ RUN apt-get update \
 
 WORKDIR /app
 
-# Agent-roles catalog base URL, baked at build time (set per-branch in CI).
+# Agent-roles catalog base URL: per-branch default set at build time (CI);
+# overridable at runtime via the AI_AGENT_ROLES_CATALOG_URL env var.
 ARG AI_AGENT_ROLES_CATALOG_URL=""
 ENV AI_AGENT_ROLES_CATALOG_URL=$AI_AGENT_ROLES_CATALOG_URL
 
diff --git a/agent-roles-catalog/README.md b/agent-roles-catalog/README.md
index 5a03689e..bbf67b15 100644
--- a/agent-roles-catalog/README.md
+++ b/agent-roles-catalog/README.md
@@ -35,10 +35,11 @@ to the catalog's raw files. The server fetches `<base>/index.json` for the
 manifest and `<base>/bundles/<bundle-id>/<lang>.json` for each opened bundle
 file (REMOTE only).
 
-That base URL is baked into the Docker image at build time and set per branch in
+That base URL is provided as a per-branch default in the Docker image (set in
 CI: a `develop` build points at the `develop` raw URL, a release build at the
-`main` raw URL. Local-filesystem sources are no longer supported; if the value
-is unset the catalog is unavailable.
+`main` raw URL) and can be overridden at runtime via the
+`AI_AGENT_ROLES_CATALOG_URL` env var. Local-filesystem sources are no longer
+supported; if the value is unset the catalog is unavailable.
 
 The fetched JSON is re-validated server-side (the catalog is treated as
 untrusted input). See `.env.example` for the variable and the CHANGELOG for the
diff --git a/apps/server/src/integrations/environment/environment.service.ts b/apps/server/src/integrations/environment/environment.service.ts
index 1f6298b7..24081b38 100644
--- a/apps/server/src/integrations/environment/environment.service.ts
+++ b/apps/server/src/integrations/environment/environment.service.ts
@@ -291,11 +291,13 @@ export class EnvironmentService {
 
   getAiAgentRolesCatalogSource(): string {
     // Catalog location: an http(s):// base URL the catalog is fetched from.
-    // The value is baked into the image at build time (Dockerfile ARG
-    // AI_AGENT_ROLES_CATALOG_URL, set per-branch in CI); local-filesystem
-    // sources are no longer supported. Empty/unset => the catalog is
-    // unavailable (the provider returns 502). This is INFRA config (where the
-    // catalog lives), not provider/model config, so an env var is appropriate.
+    // The image ships a per-branch default for this baked in at build time
+    // (Dockerfile ARG AI_AGENT_ROLES_CATALOG_URL, set per-branch in CI), but it
+    // is overridable at runtime via the env var (this getter returns that
+    // runtime value). Local-filesystem sources are no longer supported.
+    // Empty/unset => the catalog is unavailable (the provider returns 502).
+    // This is INFRA config (where the catalog lives), not provider/model
+    // config, so an env var is appropriate.
     return this.configService.get<string>('AI_AGENT_ROLES_CATALOG_URL', '');
   }