diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 351ce8e..c6a2820 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -32,10 +32,6 @@ jobs:
           curl --fail --silent --show-error --location \
             --output "${RUNNER_TEMP}/kubectl" \
             "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/kubectl.sha256" \
-            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
           chmod 0700 "${RUNNER_TEMP}/kubectl"
       - name: Configure Kubernetes access
         env:
diff --git a/migration-job.yaml b/migration-job.yaml
index fa9010d..d0410c3 100644
--- a/migration-job.yaml
+++ b/migration-job.yaml
@@ -23,7 +23,7 @@ spec:
           effect: NoSchedule
       containers:
         - name: copy
-          image: docker.io/library/alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+          image: docker.io/library/alpine:3.24.1
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
diff --git a/plex.yaml b/plex.yaml
index 548a444..415802b 100644
--- a/plex.yaml
+++ b/plex.yaml
@@ -84,7 +84,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: media-ready
-          image: docker.io/library/alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+          image: docker.io/library/alpine:3.24.1
           imagePullPolicy: IfNotPresent
           command:
             - /tools/check-media.sh
@@ -108,7 +108,7 @@ spec:
               mountPath: /tools
               readOnly: true
         - name: exporter-token
-          image: docker.io/library/alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+          image: docker.io/library/alpine:3.24.1
           imagePullPolicy: IfNotPresent
           command:
             - /tools/extract-token.sh
@@ -132,7 +132,7 @@ spec:
               readOnly: true
       containers:
         - name: plex
-          image: docker.io/plexinc/pms-docker@sha256:f6748983db1054b571b57b4a40f07f53af6c4bfb9edd1fa455f5ebb6e16449bc
+          image: docker.io/plexinc/pms-docker:1.43.3.10828-00f62d37d
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ
@@ -184,7 +184,7 @@ spec:
             - name: transcode
               mountPath: /transcode
         - name: plex-exporter
-          image: ghcr.io/cplieger/plex-exporter@sha256:07ee6d213698bfb0dc086004f26e1048380caaa229f0429e9aafa2eb487ee826
+          image: ghcr.io/cplieger/plex-exporter:v4.4.0
           imagePullPolicy: IfNotPresent
           env:
             - name: PLEX_URL
diff --git a/test.sh b/test.sh
index a761fcc..392336d 100755
--- a/test.sh
+++ b/test.sh
@@ -11,10 +11,10 @@ bash -n "${project_dir}/create-ci-kubeconfig.sh"
 if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
   for manifest in namespace.yaml plex.yaml migration-job.yaml; do
     docker run --rm --interactive \
-      ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c \
+      ghcr.io/yannh/kubeconform:v0.7.0 \
       -strict -ignore-missing-schemas -summary < "${project_dir}/${manifest}"
   done
   docker run --rm --interactive \
-    ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c \
+    ghcr.io/yannh/kubeconform:v0.7.0 \
     -strict -summary < "${project_dir}/ci-deployer.yaml"
 fi