diff --git a/roles/docker-compose/handlers/main.yml b/roles/docker-compose/handlers/main.yml
index e883eb23..f5f2215b 100644
--- a/roles/docker-compose/handlers/main.yml
+++ b/roles/docker-compose/handlers/main.yml
@@ -41,7 +41,7 @@
     set -euo pipefail
     docker compose build || { 
       echo "Retrying without cache and pulling bases...";
-      docker compose build --no-cache --pull; 
+      docker compose build --no-cache{{ ' --pull' if MODE_UPDATE | bool else ''}}; 
     }
   args:
     chdir: "{{ docker_compose.directories.instance }}"
diff --git a/roles/svc-db-postgres/templates/docker-compose.yml.j2 b/roles/svc-db-postgres/templates/docker-compose.yml.j2
index a6b785e0..a6cc4e9b 100644
--- a/roles/svc-db-postgres/templates/docker-compose.yml.j2
+++ b/roles/svc-db-postgres/templates/docker-compose.yml.j2
@@ -6,6 +6,7 @@
     build:
       context: .
       dockerfile: Dockerfile
+    pull_policy: never
 {% include 'roles/docker-container/templates/base.yml.j2' %}
 {% if POSTGRES_EXPOSE_LOCAL %}
     ports: 
diff --git a/roles/web-app-akaunting/templates/docker-compose.yml.j2 b/roles/web-app-akaunting/templates/docker-compose.yml.j2
index 82cd71e6..88532035 100644
--- a/roles/web-app-akaunting/templates/docker-compose.yml.j2
+++ b/roles/web-app-akaunting/templates/docker-compose.yml.j2
@@ -8,6 +8,7 @@
     build:
       context:    {{ docker_repository_path }}
       dockerfile: Dockerfile
+    pull_policy: never
     ports:
       - 127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}
     volumes:
diff --git a/roles/web-app-bluesky/templates/docker-compose.yml.j2 b/roles/web-app-bluesky/templates/docker-compose.yml.j2
index 62c5e925..e96ebed2 100644
--- a/roles/web-app-bluesky/templates/docker-compose.yml.j2
+++ b/roles/web-app-bluesky/templates/docker-compose.yml.j2
@@ -26,6 +26,7 @@
         REACT_APP_API_URL: "{{ WEB_PROTOCOL }}://{{domains[application_id].api}}" # API-URL des PDS
         REACT_APP_SITE_NAME: "{{ PRIMARY_DOMAIN | upper }} - Bluesky"
         REACT_APP_SITE_DESCRIPTION: "Decentral Social "
+    pull_policy: never
     ports:
       - "127.0.0.1:{{ports.localhost.http['web-app-bluesky_web']}}:8100"
     healthcheck:
diff --git a/roles/web-app-desktop/templates/docker-compose.yml.j2 b/roles/web-app-desktop/templates/docker-compose.yml.j2
index da226fc0..8c1e6601 100644
--- a/roles/web-app-desktop/templates/docker-compose.yml.j2
+++ b/roles/web-app-desktop/templates/docker-compose.yml.j2
@@ -4,6 +4,7 @@
     build:
       context: {{ docker_repository_path }}
       dockerfile: Dockerfile
+    pull_policy: never
     image: {{ DESKTOP_IMAGE }}
     container_name: {{ DESKTOP_CONTAINER }}
     ports:
diff --git a/roles/web-app-elk/templates/docker-compose.yml.j2 b/roles/web-app-elk/templates/docker-compose.yml.j2
index d045d606..3696fc0b 100644
--- a/roles/web-app-elk/templates/docker-compose.yml.j2
+++ b/roles/web-app-elk/templates/docker-compose.yml.j2
@@ -4,6 +4,7 @@
       context: elasticsearch/
       args:
         ELK_VERSION: $ELK_VERSION
+    pull_policy: never
     volumes:
       - type: bind
         source: ./elasticsearch/config/elasticsearch.yml
@@ -27,6 +28,7 @@
       context: logstash/
       args:
         ELK_VERSION: $ELK_VERSION
+    pull_policy: never
     volumes:
       - type: bind
         source: ./logstash/config/logstash.yml
@@ -51,6 +53,7 @@
       context: kibana/
       args:
         ELK_VERSION: $ELK_VERSION
+    pull_policy: never
     volumes:
       - type: bind
         source: ./kibana/config/kibana.yml
diff --git a/roles/web-app-mig/templates/docker-compose.yml.j2 b/roles/web-app-mig/templates/docker-compose.yml.j2
index d6c8c5e3..29810345 100644
--- a/roles/web-app-mig/templates/docker-compose.yml.j2
+++ b/roles/web-app-mig/templates/docker-compose.yml.j2
@@ -10,6 +10,7 @@
     build:
       context:    "{{ docker_repository_path }}"
       dockerfile: Dockerfile
+    pull_policy: never
     volumes:
       - "{{ mig_roles_meta_volume }}:/usr/share/nginx/html/roles:ro"
       - "{{ docker_repository_path }}:/usr/share/nginx/html"
diff --git a/roles/web-app-moodle/templates/docker-compose.yml.j2 b/roles/web-app-moodle/templates/docker-compose.yml.j2
index 928ef19e..9f853533 100644
--- a/roles/web-app-moodle/templates/docker-compose.yml.j2
+++ b/roles/web-app-moodle/templates/docker-compose.yml.j2
@@ -6,6 +6,7 @@
     build:
       context: .
       dockerfile: Dockerfile
+    pull_policy: never
     image: moodle_custom
     ports:
       - 127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}
diff --git a/roles/web-app-navigator/templates/docker-compose.yml.j2 b/roles/web-app-navigator/templates/docker-compose.yml.j2
index 4d06659e..8daaeafc 100644
--- a/roles/web-app-navigator/templates/docker-compose.yml.j2
+++ b/roles/web-app-navigator/templates/docker-compose.yml.j2
@@ -3,6 +3,7 @@
     build:
       context:    {{ path_infinito_presentation_output.stdout }}
       dockerfile: {{ path_infinito_presentation_output.stdout }}/Dockerfile
+    pull_policy: never
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:5000"
     volumes:
diff --git a/roles/web-app-nextcloud/templates/docker-compose.yml.j2 b/roles/web-app-nextcloud/templates/docker-compose.yml.j2
index e70f9324..64b9f878 100644
--- a/roles/web-app-nextcloud/templates/docker-compose.yml.j2
+++ b/roles/web-app-nextcloud/templates/docker-compose.yml.j2
@@ -5,7 +5,7 @@
     container_name: {{ NEXTCLOUD_CONTAINER }}
     volumes:
       - data:{{ NEXTCLOUD_DOCKER_WORK_DIRECTORY }}
-      - {{nextcloud_host_config_additives_directory}}:{{nextcloud_docker_config_additives_directory}}:ro
+      - {{ nextcloud_host_config_additives_directory }}:{{ nextcloud_docker_config_additives_directory }}:ro
     healthcheck:
       test: ["CMD", "su", "www-data", "-s", "/bin/sh", "-c", "php {{ NEXTCLOUD_DOCKER_WORK_DIRECTORY }}occ status"]
       interval: 1m
diff --git a/roles/web-app-openproject/templates/docker-compose.yml.j2 b/roles/web-app-openproject/templates/docker-compose.yml.j2
index 481af7d0..e263c745 100644
--- a/roles/web-app-openproject/templates/docker-compose.yml.j2
+++ b/roles/web-app-openproject/templates/docker-compose.yml.j2
@@ -6,6 +6,7 @@ x-op-app: &app
   build:
     context: .
     dockerfile: Dockerfile
+  pull_policy: never
 
 {% include 'roles/docker-compose/templates/base.yml.j2' %}
 
diff --git a/roles/web-app-roulette-wheel/templates/docker-compose.yml.j2 b/roles/web-app-roulette-wheel/templates/docker-compose.yml.j2
index f89f3fff..2eba3459 100644
--- a/roles/web-app-roulette-wheel/templates/docker-compose.yml.j2
+++ b/roles/web-app-roulette-wheel/templates/docker-compose.yml.j2
@@ -3,6 +3,7 @@
         container_name: roulette_application
         build:
             context: .
+        pull_policy: never
         ports:
         - 127.0.0.1:{{ ports.localhost.http[application_id] }}:8080
         restart: {{ DOCKER_RESTART_POLICY }}
diff --git a/roles/web-app-sphinx/templates/docker-compose.yml.j2 b/roles/web-app-sphinx/templates/docker-compose.yml.j2
index 6ec1eb6e..1b27d673 100644
--- a/roles/web-app-sphinx/templates/docker-compose.yml.j2
+++ b/roles/web-app-sphinx/templates/docker-compose.yml.j2
@@ -4,6 +4,7 @@
     build: 
       context: {{ path_infinito_sphinx_output.stdout }}
       dockerfile: {{ path_infinito_sphinx_output.stdout }}/Dockerfile
+    pull_policy: never
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}"
 {% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}
diff --git a/roles/web-app-wordpress/config/main.yml b/roles/web-app-wordpress/config/main.yml
index 9c801980..ae1bc69f 100644
--- a/roles/web-app-wordpress/config/main.yml
+++ b/roles/web-app-wordpress/config/main.yml
@@ -10,7 +10,7 @@ plugins:
 features:
   matomo:             true
   css:                false
-  desktop:    true
+  desktop:            true
   oidc:               true
   central_database:   true
   logout:             true
diff --git a/roles/web-app-wordpress/templates/docker-compose.yml.j2 b/roles/web-app-wordpress/templates/docker-compose.yml.j2
index fbb6fec0..0c9d44f2 100644
--- a/roles/web-app-wordpress/templates/docker-compose.yml.j2
+++ b/roles/web-app-wordpress/templates/docker-compose.yml.j2
@@ -5,6 +5,7 @@
     container_name: {{ WORDPRESS_CONTAINER }}
     build:
       context: .
+    pull_policy: never
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:80"
     volumes:
diff --git a/roles/web-svc-logout/templates/docker-compose.yml.j2 b/roles/web-svc-logout/templates/docker-compose.yml.j2
index 44ff03c7..455ac21f 100644
--- a/roles/web-svc-logout/templates/docker-compose.yml.j2
+++ b/roles/web-svc-logout/templates/docker-compose.yml.j2
@@ -4,6 +4,7 @@
     build:
       context: {{ docker_repository_path }}
       dockerfile: Dockerfile
+    pull_policy: never
     image: logout
     container_name: logout
     ports:
diff --git a/roles/web-svc-simpleicons/templates/docker-compose.yml.j2 b/roles/web-svc-simpleicons/templates/docker-compose.yml.j2
index f13da188..eca0e6d5 100644
--- a/roles/web-svc-simpleicons/templates/docker-compose.yml.j2
+++ b/roles/web-svc-simpleicons/templates/docker-compose.yml.j2
@@ -3,6 +3,7 @@
     build:
       context: .
       dockerfile: Dockerfile
+    pull_policy: never
     image: simpleicons-server:latest
     container_name: simpleicons-server
     ports: