diff --git a/CLAUDE.md b/CLAUDE.md
index 9777381..2856103 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,6 +30,20 @@ docker logs --tail 20 iPodderX
 **Name the service.** A bare `up -d` recreates every container in `content`, beets and immich
 included. Run `pull` before `up`, because `up` reuses whatever `latest` the host already has.
 
+**A build that fails with `429 Too Many Requests` on a base image** is Docker Hub rate-limiting
+this host. There is no Docker Hub login here, and the build asks about `debian:bookworm-slim` and
+`rust:1-slim-bookworm` every time unless they are already stored locally. Pull them from Google's
+mirror and tag them; the build then uses the local copies without asking Docker Hub:
+
+```sh
+docker pull mirror.gcr.io/library/debian:bookworm-slim
+docker tag mirror.gcr.io/library/debian:bookworm-slim debian:bookworm-slim
+docker pull mirror.gcr.io/library/rust:1-slim-bookworm
+docker tag mirror.gcr.io/library/rust:1-slim-bookworm rust:1-slim-bookworm
+```
+
+Run those again now and then, or the local copies go stale.
+
 The healthcheck runs `ipx status` against the control socket, so `(healthy)` in `docker ps` means
 the worker is alive, not just the web port. The container restarts on its own after a reboot.