diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
index db7d50d..dfe42e4 100644
--- a/.github/workflows/helm-release.yml
+++ b/.github/workflows/helm-release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
 
@@ -25,7 +25,7 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/charts/nextcloud-mcp-server/values.yaml b/charts/nextcloud-mcp-server/values.yaml
index 9d27763..a74d934 100644
--- a/charts/nextcloud-mcp-server/values.yaml
+++ b/charts/nextcloud-mcp-server/values.yaml
@@ -9,7 +9,7 @@ image:
   repository: ghcr.io/cbcoutinho/nextcloud-mcp-server
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "@sha256:59f8a9e12e879094936362417b95a74377029f49f8fe3985606a7f45fe7c31f9"
 
 imagePullSecrets: []
 nameOverride: ""