diff --git a/deploy/base/deploy-drone-runner.yaml b/deploy/base/deploy-drone-runner.yaml
index a8d65c9..eddcf5e 100644
--- a/deploy/base/deploy-drone-runner.yaml
+++ b/deploy/base/deploy-drone-runner.yaml
@@ -22,7 +22,7 @@ spec:
     spec:
       containers:
       - name: drone-runner
-        image: drone/drone-runner-kube:latest
+        image: drone/drone-runner-kube@sha256:8fcd1ee0ddfa1b035190d4e50ff90735657f91c7e2cb8db7b7989df8de40e86e
         ports:
         - name: http
           protocol: TCP
diff --git a/deploy/base/deploy-element.yaml b/deploy/base/deploy-element.yaml
index c9db096..faed7d7 100644
--- a/deploy/base/deploy-element.yaml
+++ b/deploy/base/deploy-element.yaml
@@ -22,7 +22,7 @@ spec:
     spec:
       containers:
         - name: element
-          image: vectorim/element-web:latest
+          image: vectorim/element-web:v1.11.40
           volumeMounts:
             - name: config
               mountPath: /app/config.json
diff --git a/deploy/base/deploy-invidious.yaml b/deploy/base/deploy-invidious.yaml
index 39b4da7..4dc0bb2 100644
--- a/deploy/base/deploy-invidious.yaml
+++ b/deploy/base/deploy-invidious.yaml
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/instance: invidious
     spec:
       initContainers:
-      - image: alpine/git:latest
+      - image: alpine/git:2.40.1
         imagePullPolicy: IfNotPresent
         name: init-invidious-repo
         volumeMounts:
@@ -30,7 +30,7 @@ spec:
         - mountPath: /scripts
           name: scripts
         command: ["/bin/sh", "/scripts/init.sh"]
-      - image: jbergknoff/postgresql-client:latest
+      - image: jbergknoff/postgresql-client@sha256:45e175ebb700cfd46e23a610477c3576550055ef40c394e663623946a5eced39
         imagePullPolicy: IfNotPresent
         name: init-invidious-db
         volumeMounts:
@@ -72,7 +72,7 @@ spec:
         workingDir: /data/repo
         command: ["sh", "docker/init-invidious-db.sh"]
       containers:
-      - image: quay.io/invidious/invidious:latest
+      - image: quay.io/invidious/invidious:ac0c0609bb8b652e630c3603cd9dbb1c87fbdf44
         imagePullPolicy: Always
         name: invidious
         ports:
diff --git a/deploy/base/deploy-netflux-homepage.yaml b/deploy/base/deploy-netflux-homepage.yaml
index dbb7781..c668806 100644
--- a/deploy/base/deploy-netflux-homepage.yaml
+++ b/deploy/base/deploy-netflux-homepage.yaml
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/instance: netflux-homepage
     spec:
       containers:
-      - image: netfluxio/homepage:latest
+      - image: netfluxio/homepage@sha256:fc253db170fddf4c4cf60aa4e1cefd4f9becb1305aba0929034d2b7636b6aad1
         imagePullPolicy: Always
         name: netflux-homepage
         ports:
diff --git a/deploy/base/deploy-solar-toolkit-gateway.yaml b/deploy/base/deploy-solar-toolkit-gateway.yaml
index a522694..5d6e717 100644
--- a/deploy/base/deploy-solar-toolkit-gateway.yaml
+++ b/deploy/base/deploy-solar-toolkit-gateway.yaml
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/instance: solar-toolkit-gateway
     spec:
       containers:
-      - image: netfluxio/solar-toolkit:latest
+      - image: netfluxio/solar-toolkit@sha256:a2251b90278bf66c04980fb4e16353195f2dbd07690df2922b61a7cf09aea049
         imagePullPolicy: Always
         name: solar-toolkit
         ports:
diff --git a/deploy/base/statefulset-radicale.yaml b/deploy/base/statefulset-radicale.yaml
index d8d3261..fafd69b 100644
--- a/deploy/base/statefulset-radicale.yaml
+++ b/deploy/base/statefulset-radicale.yaml
@@ -23,7 +23,7 @@ spec:
     spec:
       containers:
       - name: radicale
-        image: tomsquest/docker-radicale
+        image: tomsquest/docker-radicale:3.1.8.3
         imagePullPolicy: IfNotPresent
         ports:
         - name: caldav
diff --git a/deploy/base/statefulset-synapse.yaml b/deploy/base/statefulset-synapse.yaml
index 67a6e04..5c11874 100644
--- a/deploy/base/statefulset-synapse.yaml
+++ b/deploy/base/statefulset-synapse.yaml
@@ -30,7 +30,7 @@ spec:
         runAsUser: 991
         runAsGroup: 991
       containers:
-      - image: matrixdotorg/synapse:latest
+      - image: matrixdotorg/synapse:v1.91.2
         imagePullPolicy: IfNotPresent
         name: synapse
         ports: