diff --git a/aggregators/kagi-news/Dockerfile b/aggregators/kagi-news/Dockerfile
index 549e3a5..e86c8bf 100644
--- a/aggregators/kagi-news/Dockerfile
+++ b/aggregators/kagi-news/Dockerfile
@@ -16,14 +16,10 @@ WORKDIR /app
 # Copy requirements first for better caching
 COPY requirements.txt .
 
-# Install Python dependencies (exclude dev/test deps in production)
-RUN pip install --no-cache-dir \
-    feedparser==6.0.11 \
-    beautifulsoup4==4.12.3 \
-    requests==2.31.0 \
-    atproto==0.0.55 \
-    pyyaml==6.0.1 \
-    anthropic>=0.40.0
+# Install Python dependencies from requirements.txt so the image and the
+# repository can never disagree on a version. Dev/test deps live in
+# requirements-dev.txt and are deliberately not installed here.
+RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy application code
 COPY src/ ./src/
diff --git a/aggregators/kagi-news/README.md b/aggregators/kagi-news/README.md
index c49e8c5..f20ee11 100644
--- a/aggregators/kagi-news/README.md
+++ b/aggregators/kagi-news/README.md
@@ -36,7 +36,8 @@ aggregators/kagi-news/
 ├── docker-compose.yml         # Docker Compose configuration
 ├── docker-entrypoint.sh       # Container entrypoint script
 ├── .dockerignore              # Docker build exclusions
-├── requirements.txt           # Python dependencies
+├── requirements.txt           # Runtime dependencies (what the image installs)
+├── requirements-dev.txt       # Test/lint dependencies (includes requirements.txt)
 ├── config.example.yaml        # Example configuration
 ├── .env.example               # Environment variables template
 ├── crontab                    # CRON schedule
@@ -128,7 +129,7 @@ Once registered and authorized by a community, your aggregator can post content.
 
 2. Install dependencies:
    ```bash
-   pip install -r requirements.txt
+   pip install -r requirements-dev.txt
    ```
 
 3. Copy configuration templates:
@@ -265,7 +266,7 @@ If you prefer running without Docker, use the traditional approach:
    ```bash
    python3 -m venv venv
    source venv/bin/activate
-   pip install -r requirements.txt
+   pip install -r requirements-dev.txt
    ```
 
 2. **Configure crontab:**
diff --git a/aggregators/kagi-news/requirements-dev.txt b/aggregators/kagi-news/requirements-dev.txt
new file mode 100644
index 0000000..ba588d7
--- /dev/null
+++ b/aggregators/kagi-news/requirements-dev.txt
@@ -0,0 +1,11 @@
+# Development and test dependencies. Not installed in the production image.
+-r requirements.txt
+
+pytest==9.0.3
+pytest-cov==5.0.0
+responses==0.25.0
+
+black==26.3.1
+mypy==1.9.0
+types-PyYAML==6.0.12.12
+types-requests==2.31.0.20240311
diff --git a/aggregators/kagi-news/requirements.txt b/aggregators/kagi-news/requirements.txt
index 557d85d..badca3a 100644
--- a/aggregators/kagi-news/requirements.txt
+++ b/aggregators/kagi-news/requirements.txt
@@ -1,4 +1,6 @@
-# Core dependencies
+# Runtime dependencies. This file is the single source of truth for what the
+# production image installs — the Dockerfile does `pip install -r requirements.txt`.
+# Development/test-only packages live in requirements-dev.txt.
 feedparser==6.0.11
 beautifulsoup4==4.12.3
 requests==2.33.0
@@ -8,14 +10,3 @@ anthropic>=0.40.0
 # by requests, but declared explicitly because we import it directly — and
 # because the AppView's Go normalizer is matched against this exact behaviour.
 idna>=3.4
-
-# Testing
-pytest==9.0.3
-pytest-cov==5.0.0
-responses==0.25.0
-
-# Development
-black==26.3.1
-mypy==1.9.0
-types-PyYAML==6.0.12.12
-types-requests==2.31.0.20240311
diff --git a/aggregators/reddit-highlights/Dockerfile b/aggregators/reddit-highlights/Dockerfile
index efe69ae..22f4bcc 100644
--- a/aggregators/reddit-highlights/Dockerfile
+++ b/aggregators/reddit-highlights/Dockerfile
@@ -16,11 +16,10 @@ WORKDIR /app
 # Copy requirements first for better caching
 COPY requirements.txt .
 
-# Install Python dependencies (production only)
-RUN pip install --no-cache-dir \
-    feedparser==6.0.11 \
-    requests==2.31.0 \
-    pyyaml==6.0.1
+# Install Python dependencies from requirements.txt so the image and the
+# repository can never disagree on a version. Dev/test deps live in
+# requirements-dev.txt and are deliberately not installed here.
+RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy application code
 COPY src/ ./src/
diff --git a/aggregators/reddit-highlights/README.md b/aggregators/reddit-highlights/README.md
index ce5aa27..de244c0 100644
--- a/aggregators/reddit-highlights/README.md
+++ b/aggregators/reddit-highlights/README.md
@@ -84,7 +84,7 @@ python -m venv venv
 source venv/bin/activate
 
 # Install dependencies
-pip install -r requirements.txt
+pip install -r requirements-dev.txt
 ```
 
 ### Run Tests
diff --git a/aggregators/reddit-highlights/requirements-dev.txt b/aggregators/reddit-highlights/requirements-dev.txt
new file mode 100644
index 0000000..ba588d7
--- /dev/null
+++ b/aggregators/reddit-highlights/requirements-dev.txt
@@ -0,0 +1,11 @@
+# Development and test dependencies. Not installed in the production image.
+-r requirements.txt
+
+pytest==9.0.3
+pytest-cov==5.0.0
+responses==0.25.0
+
+black==26.3.1
+mypy==1.9.0
+types-PyYAML==6.0.12.12
+types-requests==2.31.0.20240311
diff --git a/aggregators/reddit-highlights/requirements.txt b/aggregators/reddit-highlights/requirements.txt
index 3d0e5a8..8387574 100644
--- a/aggregators/reddit-highlights/requirements.txt
+++ b/aggregators/reddit-highlights/requirements.txt
@@ -1,4 +1,6 @@
-# Core dependencies
+# Runtime dependencies. This file is the single source of truth for what the
+# production image installs — the Dockerfile does `pip install -r requirements.txt`.
+# Development/test-only packages live in requirements-dev.txt.
 feedparser==6.0.11
 requests==2.33.0
 pyyaml==6.0.1
@@ -6,14 +8,3 @@ pyyaml==6.0.1
 # by requests, but declared explicitly because we import it directly — and
 # because the AppView's Go normalizer is matched against this exact behaviour.
 idna>=3.4
-
-# Testing
-pytest==9.0.3
-pytest-cov==5.0.0
-responses==0.25.0
-
-# Development
-black==26.3.1
-mypy==1.9.0
-types-PyYAML==6.0.12.12
-types-requests==2.31.0.20240311