diff --git a/build/docker-compose.yml b/build/docker-compose.yml
index da11932..16db397 100644
--- a/build/docker-compose.yml
+++ b/build/docker-compose.yml
@@ -2,8 +2,15 @@ version: '3'
 name: labca
 services:
   boulder:
-    # Should match one of the GO_DEV_VERSIONS in test/boulder-tools/tag_and_upload.sh.
+    # The `letsencrypt/boulder-tools:latest` tag is automatically built in local
+    # dev environments. In CI a specific BOULDER_TOOLS_TAG is passed, and it is
+    # pulled with `docker compose pull`.
     image: ghcr.io/hakwerk/labca-boulder:${LABCA_IMAGE_VERSION:-latest}
+    build:
+      context: test/boulder-tools/
+      # Should match one of the GO_DEV_VERSIONS in test/boulder-tools/tag_and_upload.sh.
+      args:
+        GO_VERSION: 1.21.5
     environment:
       # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
       # to the IP address where your ACME client's solver is listening.