diff --git a/kubernetes/apps/database/cloudnative-pg/cluster/cluster16.yaml b/kubernetes/apps/database/cloudnative-pg/cluster/cluster16.yaml
index 4349256eb1..2b6db3b940 100644
--- a/kubernetes/apps/database/cloudnative-pg/cluster/cluster16.yaml
+++ b/kubernetes/apps/database/cloudnative-pg/cluster/cluster16.yaml
@@ -5,7 +5,7 @@ metadata:
   name: postgres16
 spec:
   instances: 4 # set to the number of nodes in the cluster
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.2-10
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2-10@sha256:82827bc9bc5ca7df1d7f7d4813444e0e7a8e32633ad72c5c66ad2be72c3b2095
   primaryUpdateStrategy: unsupervised
   storage:
     size: 50Gi
diff --git a/kubernetes/apps/database/cloudnative-pg/cluster/pgdump/helmrelease.yaml b/kubernetes/apps/database/cloudnative-pg/cluster/pgdump/helmrelease.yaml
index 7097adfd18..d873575ba7 100644
--- a/kubernetes/apps/database/cloudnative-pg/cluster/pgdump/helmrelease.yaml
+++ b/kubernetes/apps/database/cloudnative-pg/cluster/pgdump/helmrelease.yaml
@@ -48,7 +48,7 @@ spec:
         containers:
           app:
             image:
-              repository: prodrigestivill/postgres-backup-local
+              repository: prodrigestivill/postgres-backup-local@sha256:c773a909faea23b2a7d1b7f7c1a1cead1bb3d84f44255444c207311e21912ff1
               tag: 16-alpine
             command: [/backup.sh]
             env:
diff --git a/kubernetes/apps/database/influx/app/helmrelease.yaml b/kubernetes/apps/database/influx/app/helmrelease.yaml
index a8239cbba3..5819b1daba 100644
--- a/kubernetes/apps/database/influx/app/helmrelease.yaml
+++ b/kubernetes/apps/database/influx/app/helmrelease.yaml
@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/library/influxdb
-              tag: 2.7-alpine
+              tag: 2.7-alpine@sha256:c5fcf0f3e6fc4d30646666ce9466e5022f2d35ab30ee56fc254da7b00897ac90
             resources:
               requests:
                 cpu: 100m
diff --git a/kubernetes/apps/default/mailrise/app/helmrelease.yaml b/kubernetes/apps/default/mailrise/app/helmrelease.yaml
index b34ad86575..599568e1c2 100644
--- a/kubernetes/apps/default/mailrise/app/helmrelease.yaml
+++ b/kubernetes/apps/default/mailrise/app/helmrelease.yaml
@@ -46,7 +46,7 @@ spec:
           app:
             image:
               repository: docker.io/yoryan/mailrise
-              tag: 1.4.0
+              tag: 1.4.0@sha256:66082168090b9a83f01cc71a9d7b1994840adbbbffbe4d2cf644272fbbc23a1a
             env:
               TZ: ${TIMEZONE}
             envFrom:
diff --git a/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml b/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml
index 517fbe3edb..b0757096a6 100644
--- a/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml
+++ b/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml
@@ -41,7 +41,7 @@ spec:
             image:
               # repository: docker.io/1password/connect-api
               repository: ghcr.io/haraldkoch/onepassword-connect-api
-              tag: 1.7.2
+              tag: 1.7.2@sha256:da8cb369fb841a7bd9447c909d273de4053ecc9c2b2e6432c5af6c2e08b82da1
             env:
               OP_BUS_PORT: "11220"
               OP_BUS_PEERS: "localhost:11221"
@@ -82,7 +82,7 @@ spec:
             # image: docker.io/1password/connect-sync:1.7.0
             image:
               repository: ghcr.io/haraldkoch/onepassword-sync
-              tag: 1.7.2
+              tag: 1.7.2@sha256:3e40f8903ec77b3476365fe300aeb326c75c94ff546e82060823561242ade674
             env:
               - { name: OP_HTTP_PORT, value: &sport 8081 }
               - { name: OP_BUS_PORT, value: "11221" }
diff --git a/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
index c073c31073..9a2d38fb85 100644
--- a/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
+++ b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
@@ -46,7 +46,7 @@ spec:
           app:
             image:
               repository: quay.io/oriedge/k8s_gateway
-              tag: v0.4.0
+              tag: v0.4.0@sha256:7bdbd447c0244b8f89de9cd6f4826ed0ac66c9406fac3a4ac80081020c251c6b
             args: ["-conf", "/etc/coredns/Corefile"]
             probes:
               readiness: