diff --git a/containers/keycloak/Containerfile b/containers/keycloak/Containerfile
index a17d8b4..c8c4a93 100644
--- a/containers/keycloak/Containerfile
+++ b/containers/keycloak/Containerfile
@@ -10,7 +10,7 @@ ENV KC_DB=postgres
 WORKDIR /opt/keycloak
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:latest
+FROM quay.io/keycloak/keycloak:25.0
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 ADD themes/jankysolutions /opt/keycloak/themes/jankysolutions
 
diff --git a/k8s/matrix/bridge-facebook.yaml b/k8s/matrix/bridge-facebook.yaml
index e5fe55f..dc843a0 100644
--- a/k8s/matrix/bridge-facebook.yaml
+++ b/k8s/matrix/bridge-facebook.yaml
@@ -60,7 +60,7 @@ spec:
             - secretRef:
                 name: bridge-facebook
       containers:
-      - image: dock.mau.dev/mautrix/meta:latest
+      - image: dock.mau.dev/mautrix/meta:v0.4.0
         name: bridge-facebook
         resources: {}
         command: ["/usr/bin/mautrix-meta", "-c", "/data/config.yaml", "--no-update"]
diff --git a/k8s/matrix/bridge-signal.yaml b/k8s/matrix/bridge-signal.yaml
index c6f777a..86cd63b 100644
--- a/k8s/matrix/bridge-signal.yaml
+++ b/k8s/matrix/bridge-signal.yaml
@@ -57,7 +57,7 @@ spec:
             - secretRef:
                 name: bridge-signal
       containers:
-        - image: dock.mau.dev/mautrix/signal:latest
+        - image: dock.mau.dev/mautrix/signal:v0.7.1
           name: bridge-signal
           resources: {}
           ports:
diff --git a/k8s/matrix/bridge-telegram.yaml b/k8s/matrix/bridge-telegram.yaml
index 432ac98..1c4f405 100644
--- a/k8s/matrix/bridge-telegram.yaml
+++ b/k8s/matrix/bridge-telegram.yaml
@@ -78,7 +78,7 @@ spec:
             - secretRef:
                 name: bridge-telegram
       containers:
-      - image: dock.mau.dev/mautrix/telegram:latest
+      - image: dock.mau.dev/mautrix/telegram:v0.15.2
         name: bridge-telegram
         resources: {}
         command: ["python3", "-m", "mautrix_telegram", "-c", "/data/config.yaml"]
diff --git a/k8s/matrix/janky.bot-homeserver.yaml b/k8s/matrix/janky.bot-homeserver.yaml
index 21e0c8e..d426287 100644
--- a/k8s/matrix/janky.bot-homeserver.yaml
+++ b/k8s/matrix/janky.bot-homeserver.yaml
@@ -37,7 +37,7 @@ spec:
             - secretRef:
                 name: synapse-janky-bot
       containers:
-      - image: matrixdotorg/synapse:latest
+      - image: matrixdotorg/synapse:v1.116.0
         name: synapse
         resources: {}
         volumeMounts:
diff --git a/k8s/miniflux/miniflux.yaml b/k8s/miniflux/miniflux.yaml
index 95a2357..8bf9a5b 100644
--- a/k8s/miniflux/miniflux.yaml
+++ b/k8s/miniflux/miniflux.yaml
@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: miniflux
-          image: docker.io/miniflux/miniflux:latest
+          image: docker.io/miniflux/miniflux:2.2.1
           imagePullPolicy: Always
           resources: {}
           envFrom:
diff --git a/k8s/monica/kustomization.yaml b/k8s/monica/kustomization.yaml
index fc24236..0038540 100644
--- a/k8s/monica/kustomization.yaml
+++ b/k8s/monica/kustomization.yaml
@@ -4,5 +4,5 @@ namespace: monica
 resources:
  - namespace.yaml
  - monica.yaml
- - database.yaml
+ - mysql.yaml
  - secrets.yaml
diff --git a/k8s/monitoring/matrix-alertmanager-receiver.yaml b/k8s/monitoring/matrix-alertmanager-receiver.yaml
index 1cc7a0f..6c72e15 100644
--- a/k8s/monitoring/matrix-alertmanager-receiver.yaml
+++ b/k8s/monitoring/matrix-alertmanager-receiver.yaml
@@ -31,7 +31,7 @@ spec:
                 name: matrix-alertmanager-receiver
       containers:
       - name: matrix-alertmanager-receiver
-        image: docker.io/metio/matrix-alertmanager-receiver:latest
+        image: docker.io/metio/matrix-alertmanager-receiver:2024.9.18
         args: ["--config-path", "/config/config.yaml"]
         resources:
           limits:
diff --git a/k8s/operators/cert-manager/pdns-hook.yaml b/k8s/operators/cert-manager/pdns-hook.yaml
index 9a1a4e5..21c37a0 100644
--- a/k8s/operators/cert-manager/pdns-hook.yaml
+++ b/k8s/operators/cert-manager/pdns-hook.yaml
@@ -206,7 +206,7 @@ spec:
       serviceAccountName: cert-manager-webhook-pdns
       containers:
         - name: cert-manager-webhook-pdns
-          image: "docker.io/zachomedia/cert-manager-webhook-pdns:latest"
+          image: docker.io/zachomedia/cert-manager-webhook-pdns:v2.5.1
           imagePullPolicy: IfNotPresent
           args:
             - --tls-cert-file=/tls/tls.crt
diff --git a/k8s/shlink/shlink.yaml b/k8s/shlink/shlink.yaml
index 64168b3..15a7aeb 100644
--- a/k8s/shlink/shlink.yaml
+++ b/k8s/shlink/shlink.yaml
@@ -18,7 +18,7 @@ spec:
         fsGroup: 1001
         fsGroupChangePolicy: "OnRootMismatch"
       containers:
-      - image: ghcr.io/shlinkio/shlink:latest
+      - image: ghcr.io/shlinkio/shlink:4.2.0
         name: shlink
         resources: {}
         ports:
diff --git a/k8s/snipeit/statefulset.yaml b/k8s/snipeit/statefulset.yaml
index d4cf0d6..0b08129 100644
--- a/k8s/snipeit/statefulset.yaml
+++ b/k8s/snipeit/statefulset.yaml
@@ -18,7 +18,7 @@ spec:
         fsGroupChangePolicy: "OnRootMismatch"
       containers:
       - name: snipe
-        image: snipe/snipe-it:latest
+        image: snipe/snipe-it:v7.0.12
         ports:
         - containerPort: 80
           name: web