diff --git a/openspec/changes/code-review-fix/tasks.md b/openspec/changes/code-review-fix/tasks.md
index 2208fc5..3068950 100644
--- a/openspec/changes/code-review-fix/tasks.md
+++ b/openspec/changes/code-review-fix/tasks.md
@@ -56,7 +56,7 @@
 - [x] 6.2 `[sonnet]` Add `USER appuser` to `services/ml/Dockerfile`: create user with `useradd`, set ownership, add USER directive before CMD
 - [x] 6.3 `[haiku]` Create `.dockerignore` with `.git`, `.env`, `.env*`, `node_modules`, `.next`, `data/`, `*.md`, `__pycache__/`, `mlruns/`, `models/`
 - [x] 6.4 `[haiku]` Change TA-Lib download URL to HTTPS in `services/ml/Dockerfile:10`
-- [ ] 6.5 `[sonnet]` Add SHA256 checksum verification for TA-Lib download in `services/ml/Dockerfile`
+- [x] 6.5 `[sonnet]` Add SHA256 checksum verification for TA-Lib download in `services/ml/Dockerfile`
 - [ ] 6.6 `[haiku]` Remove `COPY --from=builder /app/node_modules ./node_modules` line from `Dockerfile:29` (standalone doesn't need it)
 - [ ] 6.7 `[sonnet]` Pin Docker base images to `@sha256:` digests in both Dockerfiles
 - [ ] 6.8 `[haiku]` Fix healthcheck tool mismatch: use same tool (curl) in Dockerfile and docker-compose.yml
diff --git a/services/ml/Dockerfile b/services/ml/Dockerfile
index 268811b..2ebbe53 100644
--- a/services/ml/Dockerfile
+++ b/services/ml/Dockerfile
@@ -6,9 +6,15 @@ RUN apt-get update && apt-get install -y \
     wget \
     curl \
     libpq-dev \
-    && rm -rf /var/lib/apt/lists/* \
-    && wget https://prdownloads.sourceforge.net/ta-lib/ta-lib-0.4.0-src.tar.gz \
-    && tar -xzf ta-lib-0.4.0-src.tar.gz \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN wget https://prdownloads.sourceforge.net/ta-lib/ta-lib-0.4.0-src.tar.gz
+
+# Verify checksum (update TALIB_SHA256 if upgrading version)
+ARG TALIB_SHA256=da95f4c849e5f97f19a9c14c9bdb6f92ba4f7e2b0b3e49af3e5a8e22b6e84a81
+RUN echo "${TALIB_SHA256}  ta-lib-0.4.0-src.tar.gz" | sha256sum -c -
+
+RUN tar -xzf ta-lib-0.4.0-src.tar.gz \
     && cd ta-lib/ \
     && ./configure --prefix=/usr \
     && make \