diff --git a/changelog/unreleased/ocis_full_update_images.md b/changelog/unreleased/ocis_full_update_images.md
new file mode 100644
index 00000000000..714c7c7edea
--- /dev/null
+++ b/changelog/unreleased/ocis_full_update_images.md
@@ -0,0 +1,6 @@
+Enhancement: Update images in the ocis_full deployment example
+
+- Update the docker images for core services and web-extensions
+- Moving all default image definitions (latest) into the .env file for consistency
+
+https://github.com/owncloud/ocis/pull/12123
diff --git a/deployments/examples/ocis_full/.env b/deployments/examples/ocis_full/.env
index 64ff8cdedcb..04eb22eee6b 100644
--- a/deployments/examples/ocis_full/.env
+++ b/deployments/examples/ocis_full/.env
@@ -12,7 +12,7 @@ INSECURE=true
 # Note: Traefik is always enabled and can't be disabled.
 # The recommended (and tested) version to pull. If no version is used, it pulls "latest"
 # release notes: https://github.com/traefik/traefik/releases
-TRAEFIK_DOCKER_TAG=v3.6.7
+TRAEFIK_DOCKER_TAG=v3.6.10
 # Serve Traefik dashboard.
 # Defaults to "false".
 TRAEFIK_DASHBOARD=
@@ -45,7 +45,7 @@ OCIS=:ocis.yml
 OCIS_DOCKER_IMAGE=owncloud/ocis
 # The oCIS container version.
 # Defaults to "latest" and points to the latest stable tag.
-OCIS_DOCKER_TAG=
+OCIS_DOCKER_TAG=latest
 # Domain of oCIS, where you can find the frontend.
 # Defaults to "ocis.owncloud.test"
 OCIS_DOMAIN=
@@ -94,6 +94,9 @@ S3NG_BUCKET=
 # For testing purposes, add local minio S3 storage to the docker-compose file.
 # The leading colon is required to enable the service.
 #S3NG_MINIO=:minio.yml
+# Set the desired docker image tag or digest.
+# Defaults to "latest"
+MINIO_DOCKER_TAG=latest
 # Minio domain. Defaults to "minio.owncloud.test".
 MINIO_DOMAIN=
 
@@ -171,8 +174,8 @@ COMPANION_ONEDRIVE_SECRET=
 # Note: the leading colon is required to enable the service.
 TIKA=:tika.yml
 # Set the desired docker image tag or digest.
-# Defaults to "latest"
-TIKA_IMAGE=
+# Defaults to "latest-full"
+TIKA_DOCKER_TAG=latest-full
 
 ### IMPORTANT Note for Online Office Apps ###
 # To avoid app interlocking issues, you should select only one app to be active/configured.
@@ -185,7 +188,7 @@ TIKA_IMAGE=
 COLLABORA=:collabora.yml
 # The recommended (and tested) version to pull. If no version is used, it pulls "latest"
 # release notes: https://www.collaboraonline.com/release-notes/
-COLLABORA_DOCKER_TAG=25.04.8.1.1
+COLLABORA_DOCKER_TAG=25.04.9.3.1
 # Domain of Collabora, where you can find the frontend.
 # Defaults to "collabora.owncloud.test"
 COLLABORA_DOMAIN=
@@ -217,7 +220,7 @@ COLLABORA_SSL_VERIFICATION=false
 #CLAMAV=:clamav.yml
 # Image version of the ClamAV container.
 # Defaults to "latest"
-CLAMAV_DOCKER_TAG=
+CLAMAV_DOCKER_TAG=latest
 
 
 ### OnlyOffice Settings ###
@@ -230,7 +233,7 @@ CLAMAV_DOCKER_TAG=
 ONLYOFFICE_IMAGE=onlyoffice/documentserver
 # The recommended (and tested) version to pull. If no version is used, it pulls "latest"
 # release notes: https://github.com/ONLYOFFICE/DocumentServer/releases
-ONLYOFFICE_DOCKER_TAG=9.2.1.1
+ONLYOFFICE_DOCKER_TAG=9.3.1.1
 
 # EE only: the path to your license file on the host.
 # To activate a license file, comment ONLYOFFICE_DEACTIVATE_LICENSE. Otherwise, it <must> stay uncommented.
@@ -257,7 +260,7 @@ ONLYOFFICE_DOMAIN=
 MAIL_SERVER_DOMAIN=
 # The recommended (and tested) version to pull. If no version is used, it pulls "latest"
 # release notes: https://github.com/axllent/mailpit/releases
-MAIL_SERVER_DOCKER_TAG=v1.28.0
+MAIL_SERVER_DOCKER_TAG=v1.29.3
 
 
 ### Debugging - Monitoring ###
diff --git a/deployments/examples/ocis_full/clamav.yml b/deployments/examples/ocis_full/clamav.yml
index ff577fa1b5f..39d34e0166d 100644
--- a/deployments/examples/ocis_full/clamav.yml
+++ b/deployments/examples/ocis_full/clamav.yml
@@ -13,7 +13,7 @@ services:
       - "clamav-socket:/var/run/clamav"
 
   clamav:
-    image: clamav/clamav:${CLAMAV_DOCKER_TAG:-latest}
+    image: clamav/clamav:${CLAMAV_DOCKER_TAG}
     # release notes: https://blog.clamav.net
     networks:
       ocis-net:
diff --git a/deployments/examples/ocis_full/collabora.yml b/deployments/examples/ocis_full/collabora.yml
index 7e2c065323f..356feb2e6ef 100644
--- a/deployments/examples/ocis_full/collabora.yml
+++ b/deployments/examples/ocis_full/collabora.yml
@@ -12,7 +12,7 @@ services:
       GRAPH_AVAILABLE_ROLES: "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6"
 
   collaboration:
-    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest}
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG}
     networks:
       ocis-net:
     depends_on:
@@ -49,7 +49,7 @@ services:
     restart: always
 
   collabora:
-    image: collabora/code:${COLLABORA_DOCKER_TAG:-latest}
+    image: collabora/code:${COLLABORA_DOCKER_TAG}
     networks:
       ocis-net:
     environment:
diff --git a/deployments/examples/ocis_full/docker-compose.yml b/deployments/examples/ocis_full/docker-compose.yml
index 551b0be9a38..0cc1c98e37e 100644
--- a/deployments/examples/ocis_full/docker-compose.yml
+++ b/deployments/examples/ocis_full/docker-compose.yml
@@ -1,7 +1,7 @@
 ---
 services:
   traefik:
-    image: traefik:${TRAEFIK_DOCKER_TAG:-latest}
+    image: traefik:${TRAEFIK_DOCKER_TAG}
     networks:
       ocis-net:
     command:
diff --git a/deployments/examples/ocis_full/mailserver.yml b/deployments/examples/ocis_full/mailserver.yml
index bc2d7397a6f..37233ec3bad 100644
--- a/deployments/examples/ocis_full/mailserver.yml
+++ b/deployments/examples/ocis_full/mailserver.yml
@@ -8,7 +8,7 @@ services:
       NOTIFICATIONS_SMTP_INSECURE: "true"
 
   mailserver:
-    image: axllent/mailpit:${MAIL_SERVER_DOCKER_TAG:-latest}
+    image: axllent/mailpit:${MAIL_SERVER_DOCKER_TAG}
     networks:
       - ocis-net
     ports:
diff --git a/deployments/examples/ocis_full/minio.yml b/deployments/examples/ocis_full/minio.yml
index fb650aba935..9c91b0c4489 100644
--- a/deployments/examples/ocis_full/minio.yml
+++ b/deployments/examples/ocis_full/minio.yml
@@ -1,7 +1,7 @@
 ---
 services:
   minio:
-    image: minio/minio:latest
+    image: minio/minio:${MINIO_DOCKER_TAG}
     # release notes: https://github.com/minio/minio/releases
     networks:
       ocis-net:
diff --git a/deployments/examples/ocis_full/ocis.yml b/deployments/examples/ocis_full/ocis.yml
index e22fe6f516a..632aae352d1 100644
--- a/deployments/examples/ocis_full/ocis.yml
+++ b/deployments/examples/ocis_full/ocis.yml
@@ -6,7 +6,7 @@ services:
         aliases:
           - ${OCIS_DOMAIN:-ocis.owncloud.test}
   ocis:
-    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest}
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG}
     # changelog: https://github.com/owncloud/ocis/tree/master/changelog
     # release notes: https://doc.owncloud.com/ocis_release_notes.html
     networks:
diff --git a/deployments/examples/ocis_full/onlyoffice.yml b/deployments/examples/ocis_full/onlyoffice.yml
index 3986c416c2c..d2fc65dc0f1 100644
--- a/deployments/examples/ocis_full/onlyoffice.yml
+++ b/deployments/examples/ocis_full/onlyoffice.yml
@@ -7,7 +7,7 @@ services:
           - ${ONLYOFFICE_DOMAIN:-onlyoffice.owncloud.test}
 
   collaboration-oo:
-    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest}
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG}
     networks:
       ocis-net:
     depends_on:
@@ -45,7 +45,7 @@ services:
 
   onlyoffice:
     # note, you also need to add a volume when using the enterprise version, see below
-    image: ${ONLYOFFICE_IMAGE:-onlyoffice/documentserver}:${ONLYOFFICE_DOCKER_TAG:-latest}
+    image: ${ONLYOFFICE_IMAGE:-onlyoffice/documentserver}:${ONLYOFFICE_DOCKER_TAG}
     networks:
       ocis-net:
     entrypoint:
diff --git a/deployments/examples/ocis_full/tika.yml b/deployments/examples/ocis_full/tika.yml
index 70206a3f020..097721ff2ec 100644
--- a/deployments/examples/ocis_full/tika.yml
+++ b/deployments/examples/ocis_full/tika.yml
@@ -1,7 +1,7 @@
 ---
 services:
   tika:
-    image: ${TIKA_IMAGE:-apache/tika:latest-full}
+    image: apache/tika:${TIKA_DOCKER_TAG}
     # release notes: https://tika.apache.org
     networks:
       ocis-net:
diff --git a/deployments/examples/ocis_full/web_extensions/advanced-search.yml b/deployments/examples/ocis_full/web_extensions/advanced-search.yml
index e992ea06368..79c53b38e05 100644
--- a/deployments/examples/ocis_full/web_extensions/advanced-search.yml
+++ b/deployments/examples/ocis_full/web_extensions/advanced-search.yml
@@ -6,7 +6,7 @@ services:
         condition: service_completed_successfully
 
   advanced-search-init:
-    image: owncloud/web-extensions:advanced-search-0.1.0
+    image: owncloud/web-extensions:advanced-search-0.2.0
     user: root
     volumes:
       - ocis-apps:/apps
diff --git a/deployments/examples/ocis_full/web_extensions/photo-addon.yml b/deployments/examples/ocis_full/web_extensions/photo-addon.yml
index 212b4e7f132..b3568d3c23e 100644
--- a/deployments/examples/ocis_full/web_extensions/photo-addon.yml
+++ b/deployments/examples/ocis_full/web_extensions/photo-addon.yml
@@ -6,7 +6,7 @@ services:
         condition: service_completed_successfully
 
   photo-addon-init:
-    image: owncloud/web-extensions:photo-addon-0.1.0
+    image: owncloud/web-extensions:photo-addon-0.2.0
     user: root
     volumes:
       - ocis-apps:/apps