diff --git a/docker-compose.yml b/docker-compose.yml
index b2802c7..9ab82fe 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@
 # Validated offline by tests/compose/compose_config_test.sh.
 services:
   model2vec-serve:
-    image: ${MODEL2VEC_IMAGE:-ghcr.io/freinold/model2vec-serve:latest}
+    image: ${MODEL2VEC_IMAGE:-ghcr.io/freinold/model2vec-serve:latest@sha256:7d698692ee8c6596817daa0821e78fda446583d4ba35c9606a93c6f87976b88e}
     container_name: model2vec-serve
     environment:
       # Comma-separated model list; the service splits on ','. The FIRST entry
diff --git a/helm/model2vec-serve/values.yaml b/helm/model2vec-serve/values.yaml
index 42f7ff3..0aadf49 100644
--- a/helm/model2vec-serve/values.yaml
+++ b/helm/model2vec-serve/values.yaml
@@ -4,7 +4,7 @@ replicaCount: 1
 image:
   repository: ghcr.io/freinold/model2vec-serve
   pullPolicy: IfNotPresent
-  tag: ""
+  tag: "@sha256:7d698692ee8c6596817daa0821e78fda446583d4ba35c9606a93c6f87976b88e"
 
 # List of Hugging Face model ids or local paths to load.
 # When set, this takes precedence over the deprecated `model` value.