diff --git a/Dockerfile b/Dockerfile
index 047e009..15401a1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@ COPY . .
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
     go build -ldflags "-s -w -X main.version=${VERSION}" -o /out/controller ./cmd/controller
 
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6
 WORKDIR /
 COPY --from=build /out/controller /controller
 USER 65532:65532
diff --git a/charts/krop-controller/values.yaml b/charts/krop-controller/values.yaml
index f4ba8c4..3cf30a6 100644
--- a/charts/krop-controller/values.yaml
+++ b/charts/krop-controller/values.yaml
@@ -4,7 +4,7 @@
 image:
   repository: ghcr.io/opendefensecloud/krop-controller
   # -- Overrides the image tag (default is the chart appVersion)
-  tag: ""
+  tag: "@sha256:d14c6f54fa34f0f404f44d5dff13e11500e800bd449a50c8c552be9746a6d9a5"
   pullPolicy: IfNotPresent
 
 # -- Image pull secrets (list of secret names)