diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e0b6a3e..9b9eafd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -32,11 +32,8 @@ jobs:
 
       - name: Lint and render
         run: |
-          "${RUNNER_TEMP}/helm" lint . --values values-brunner-ninja.yaml
-          "${RUNNER_TEMP}/helm" template "${RELEASE_NAME}" . \
-            --namespace "${NAMESPACE}" \
-            --values values-brunner-ninja.yaml > "${RUNNER_TEMP}/rendered.yaml"
-          test -s "${RUNNER_TEMP}/rendered.yaml"
+          export PATH="${RUNNER_TEMP}:${PATH}"
+          ./test.sh
 
   deploy:
     name: Deploy to Kubernetes
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index bcb7e28..7149048 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -29,7 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: nginx
-          image: {{ printf "%s:%s@%s" .Values.image.repository .Values.image.tag .Values.image.digest | quote }}
+          image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
diff --git a/test.sh b/test.sh
index a9ebcd6..2638486 100755
--- a/test.sh
+++ b/test.sh
@@ -23,6 +23,10 @@ for values_file in "${values_files[@]}"; do
     --namespace default \
     --values "${values_path}" > "${output}"
   test -s "${output}"
+  if grep -Eq 'image:.*(@|%!|<nil>)' "${output}"; then
+    echo "Rendered image must use a valid repository:tag reference" >&2
+    exit 1
+  fi
 done
 
 if [[ -f "${workdir}/values-brunner-ninja.yaml" ]]; then