diff --git a/Jenkinsfile b/Jenkinsfile
index a49c4f462..5544ff9e0 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -63,7 +63,7 @@ pipeline {
         booleanParam(name: 'INITIALIZE_TEST_DATABASE', defaultValue: false, description: '仅 test：调度服务前幂等初始化测试数据库')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
         string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库地址')
-        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
+        string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
         string(name: 'DOWNSTREAM_JOB_PREFIX', defaultValue: 'baiyue-firstleg-', description: '单服务 Jenkins Job 名称前缀，例如 baiyue-firstleg-auth')
     }
 
diff --git a/Jenkinsfile.service b/Jenkinsfile.service
index f2727d827..084d87d2e 100644
--- a/Jenkinsfile.service
+++ b/Jenkinsfile.service
@@ -36,7 +36,7 @@ pipeline {
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
         string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库基础路径，不包含服务名和标签')
-        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
+        string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
     }
 
     environment {
diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile
index 62542d939..4e7c1d79a 100644
--- a/deploy/docker/Dockerfile
+++ b/deploy/docker/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine
+ARG BASE_IMAGE=172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine
 FROM ${BASE_IMAGE} AS extractor
 
 WORKDIR /workspace
diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs
index c7a79e70c..45abe70d5 100644
--- a/scripts/test-environment-pipeline-contract.test.mjs
+++ b/scripts/test-environment-pipeline-contract.test.mjs
@@ -10,6 +10,8 @@ const directDeployScript = (await readFile(new URL('../deploy/scripts/deploy-bui
   .replaceAll('\r\n', '\n')
 const ciMavenSettings = (await readFile(new URL('../deploy/maven/settings-ci.xml', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
+const serviceDockerfile = (await readFile(new URL('../deploy/docker/Dockerfile', import.meta.url), 'utf8'))
+  .replaceAll('\r\n', '\n')
 
 test('test deployments compile packages without rerunning the full unit test suite', () => {
   assert.match(pipeline, /params\.ENVIRONMENT == 'test' \|\| params\.SKIP_TESTS/)
@@ -48,3 +50,14 @@ test('shared builders use a reachable public Maven mirror instead of the retired
   assert.match(ciMavenSettings, /https:\/\/maven\.aliyun\.com\/repository\/public/)
   assert.doesNotMatch(ciMavenSettings, /:18081/)
 })
+
+test('Java service images use the internal registry base image by default', () => {
+  const internalBaseImage = '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine'
+
+  assert.match(coordinatorPipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
+  assert.match(pipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
+  assert.match(serviceDockerfile, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
+  assert.doesNotMatch(coordinatorPipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
+  assert.doesNotMatch(pipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
+  assert.doesNotMatch(serviceDockerfile, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
+})