diff --git a/README.md b/README.md
index 96f0bc9d14..83826e9810 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,8 @@ Windows archives contain the official PHP binary for Windows.
 
 [Download FrankenPHP](https://github.com/php/frankenphp/releases)
 
+The binaries of the latest release are rebuilt daily to include PHP security fixes. See [how to verify and pin them](https://frankenphp.dev/docs/production/#standalone-binary-updates).
+
 ### rpm packages
 
 Our maintainers offer rpm packages for all systems using `dnf`. To install, run:
diff --git a/docs/docker.md b/docs/docker.md
index 2275f11a74..6a3d04fca0 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -210,6 +210,9 @@ The Docker images are built:
 - when a new release is tagged
 - daily at 4 am UTC, if new versions of the official PHP images are available
 
+Tags such as `latest` or `1-php8.5` are moved to the new images, while digests never change.
+To pin an exact image, reference it by digest. The standalone binaries follow [a similar update policy](production.md#standalone-binary-updates).
+
 ## Hardening images
 
 To further reduce the attack surface and size of your FrankenPHP Docker images, it's also possible to build them on top of a
diff --git a/docs/production.md b/docs/production.md
index 1f9a16af26..8c69dbff23 100644
--- a/docs/production.md
+++ b/docs/production.md
@@ -234,3 +234,25 @@ Windows services cannot be reloaded. To apply configuration changes gracefully,
 ```powershell
 .\frankenphp.exe reload --config Caddyfile
 ```
+
+## Standalone binary updates
+
+To ship PHP and library security fixes without waiting for a new FrankenPHP release, the binaries attached to the latest release are rebuilt every day
+(at midnight UTC for Linux and macOS, at 8 am UTC for Windows) and replace the previous ones under the same name.
+Their checksums therefore change from one day to the next. Binaries attached to older releases are not rebuilt.
+
+To find out which PHP version a binary contains, run:
+
+```console
+frankenphp version
+```
+
+Every binary is signed with a [GitHub artifact attestation](https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations).
+To check that a binary was built by the FrankenPHP CI, whatever the day it was downloaded, use the [GitHub CLI](https://cli.github.com):
+
+```console
+gh attestation verify frankenphp-linux-x86_64 --repo php/frankenphp
+```
+
+If your deployments need a byte-for-byte reproducible binary (for instance, to pin its checksum), don't download it from the releases page at deploy time.
+Instead, store a verified copy in your own artifact repository, or use [the Docker images](docker.md) pinned by digest (`dunglas/frankenphp@sha256:...`).