diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 63fa4d5..ff384a1 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -29,10 +29,6 @@ jobs:
           curl --fail --silent --show-error --location \
             --output "${RUNNER_TEMP}/kubectl" \
             "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/kubectl.sha256" \
-            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
           chmod 0700 "${RUNNER_TEMP}/kubectl"
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - name: Configure Kubernetes access
diff --git a/README.md b/README.md
index 42c8896..4038042 100644
--- a/README.md
+++ b/README.md
@@ -17,15 +17,16 @@ spec:
 
 Diun sends Matrix notices to `!ckpLXMvXlZJtuvQBIJ:brunner.ninja` as
 `@diun:brunner.ninja`. It calls the Shoutrrr CLI through Diun's script notifier.
-An init container downloads the Shoutrrr v0.14.0 release, checks its SHA-256,
-and makes the binary available to Diun. Version 0.14.0 is pinned because
+An init container downloads the Shoutrrr v0.14.0 release and makes the binary
+available to Diun. Version 0.14.0 is pinned because
 0.14.1 sends duplicate Matrix authentication data that this Synapse rejects.
 The Matrix access token is stored in the `diun-matrix-token` Secret. A separate
 `diun-registry-credentials` Secret grants read access to private Quay images.
 Synapse password login remains disabled.
 
-Container images here use readable version tags. Do not add `@sha256:` image
-digests; use `latest` only when no version tag is available.
+Container images here use readable version tags, with `latest` only when no
+version tag is available. Image digests and hard-coded download checksums are
+not used.
 
 ## Install
 
diff --git a/app.yaml b/app.yaml
index 3581014..e069c9b 100644
--- a/app.yaml
+++ b/app.yaml
@@ -69,7 +69,6 @@ spec:
             - |
               curl -fsSL -o /tmp/shoutrrr.tar.gz \
                 https://github.com/nicholas-fedor/shoutrrr/releases/download/v0.14.0/shoutrrr_linux_amd64_0.14.0.tar.gz
-              printf '%s  %s\n' 5a238edf4dd0b838cb74608c277f2af4cde17f1bc9901d01ab7f101eb5d89cb9 /tmp/shoutrrr.tar.gz | sha256sum -c -
               tar -xzf /tmp/shoutrrr.tar.gz -C /tools shoutrrr
               chmod 0555 /tools/shoutrrr
           volumeMounts: