diff --git a/charts/quota-controller/values.yaml b/charts/quota-controller/values.yaml
index d0475ac..0cb5c76 100644
--- a/charts/quota-controller/values.yaml
+++ b/charts/quota-controller/values.yaml
@@ -16,7 +16,7 @@ controller:
   # quota-controller; must stay in sync with .github/workflows/docker.yaml).
   image:
     repository: ghcr.io/opendefensecloud/quota-controller
-    tag: ""
+    tag: "@sha256:341be274435cc8225e86e5215591ca9b4aa9eb6aaff5fa9aadfdfe4a48cdb950"
     pullPolicy: IfNotPresent
 
   # Secret containing a kubeconfig for connecting to the kcp quota-ctrl workspace.
@@ -69,7 +69,7 @@ webhook:
   # quota-webhook; must stay in sync with .github/workflows/docker.yaml).
   image:
     repository: ghcr.io/opendefensecloud/quota-webhook
-    tag: ""
+    tag: "@sha256:d38d82621174872026d9f1b0d4e4fadd0c73edb4e486df35db034c6b632f3566"
     pullPolicy: IfNotPresent
 
   # Port the TLS admission server listens on (inside the container).