argocd/manifests/argocd/kustomization.yaml

@@ -4,7 +4,8 @@ kind: Kustomization
 namespace: argocd
 
 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+  # Pin to specific version for intentional upgrades
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
   - service-tailscale.yaml
 
 patches:

argocd/manifests/devpi/statefulset.yaml

@@ -18,6 +18,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: devpi
+          # TODO: Tag builds with semantic versions (e.g., v1.0.0) for reproducibility
           image: registry.tail8d86e.ts.net/blumeops/devpi:latest
           env:
             - name: DEVPI_ROOT_PASSWORD

argocd/manifests/kiwix/cronjob-zim-watcher.yaml

@@ -14,7 +14,7 @@ spec:
           serviceAccountName: zim-watcher
           containers:
             - name: watcher
-              image: bitnami/kubectl:latest
+              image: bitnami/kubectl:1.34.1
               command: ["/bin/bash", "-c"]
               args:
                 - |

argocd/manifests/kiwix/deployment.yaml

@@ -52,7 +52,7 @@ spec:
 
         # Sidecar: Syncs declarative ZIM torrents to transmission
         - name: torrent-sync
-          image: lscr.io/linuxserver/transmission:latest  # Has transmission-remote CLI
+          image: lscr.io/linuxserver/transmission:4.0.6  # Has transmission-remote CLI
           command: ["/bin/bash", "-c"]
           args:
             - |

argocd/manifests/miniflux/deployment.yaml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
         - name: miniflux
-          image: ghcr.io/miniflux/miniflux:latest
+          image: ghcr.io/miniflux/miniflux:2.2.16
           ports:
             - containerPort: 8080
           env:

argocd/manifests/tailscale-operator/operator.yaml

@@ -5362,7 +5362,7 @@ spec:
                       valueFrom:
                         fieldRef:
                             fieldPath: metadata.uid
-                  image: docker.io/tailscale/k8s-operator:stable
+                  image: docker.io/tailscale/k8s-operator:v1.92.5
                   imagePullPolicy: Always
                   name: operator
                   volumeMounts:

argocd/manifests/tailscale-operator/proxyclass.yaml

@@ -18,6 +18,6 @@ spec:
   statefulSet:
     pod:
       tailscaleContainer:
-        image: docker.io/tailscale/tailscale:stable
+        image: docker.io/tailscale/tailscale:v1.92.5
       tailscaleInitContainer:
-        image: docker.io/tailscale/tailscale:stable
+        image: docker.io/tailscale/tailscale:v1.92.5

argocd/manifests/torrent/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: transmission
-          image: lscr.io/linuxserver/transmission:latest
+          image: lscr.io/linuxserver/transmission:4.0.6
           env:
             - name: PUID
               value: "1000"