diff --git a/kube/clusters/biohazard/flux/flux-install.yaml b/kube/clusters/biohazard/flux/flux-install.yaml
index f53d659a..21061501 100644
--- a/kube/clusters/biohazard/flux/flux-install.yaml
+++ b/kube/clusters/biohazard/flux/flux-install.yaml
@@ -9,7 +9,7 @@ spec:
   interval: 10m
   url: oci://ghcr.io/fluxcd/flux-manifests
   ref:
-    tag: v2.1.2
+    tag: v2.1.2@sha256:5502bbd944688e3a6e1804521be7bcfcb66cf72d130196fe2736e00c6016525f
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
diff --git a/kube/clusters/nuclear/flux/flux-install.yaml b/kube/clusters/nuclear/flux/flux-install.yaml
index ada43796..2039659f 100644
--- a/kube/clusters/nuclear/flux/flux-install.yaml
+++ b/kube/clusters/nuclear/flux/flux-install.yaml
@@ -9,7 +9,7 @@ spec:
   interval: 10m
   url: oci://ghcr.io/fluxcd/flux-manifests
   ref:
-    tag: v2.1.2
+    tag: v2.1.2@sha256:5502bbd944688e3a6e1804521be7bcfcb66cf72d130196fe2736e00c6016525f
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
diff --git a/kube/templates/test/app/hr.yaml b/kube/templates/test/app/hr.yaml
index ae83d523..97b76789 100644
--- a/kube/templates/test/app/hr.yaml
+++ b/kube/templates/test/app/hr.yaml
@@ -85,7 +85,7 @@ spec:
           01-init-db:
             image:
               repository: "ghcr.io/onedr0p/postgres-init"
-              tag: "15.0"
+              tag: "15.5@sha256:18560dc4098004b6486a81c92d575a7f9d636c5ede997c515f15b52e130bd827"
             imagePullPolicy: IfNotPresent
             envFrom: [secretRef: {name: "${APPNAME}-pg-superuser"}]
     service: