diff --git a/clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml b/clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml
index 41b7e60df..7de01a22d 100644
--- a/clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml
+++ b/clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: authentik-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: authentik-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/blocky/StatefulSet-blocky-valkey.yaml b/clusters/cl01tl/manifests/blocky/StatefulSet-blocky-valkey.yaml
index 20d58f9d5..9b5ef10f1 100644
--- a/clusters/cl01tl/manifests/blocky/StatefulSet-blocky-valkey.yaml
+++ b/clusters/cl01tl/manifests/blocky/StatefulSet-blocky-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: blocky-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: blocky-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/dawarich/StatefulSet-dawarich-valkey.yaml b/clusters/cl01tl/manifests/dawarich/StatefulSet-dawarich-valkey.yaml
index 94b8e1bb8..ded8ab4c9 100644
--- a/clusters/cl01tl/manifests/dawarich/StatefulSet-dawarich-valkey.yaml
+++ b/clusters/cl01tl/manifests/dawarich/StatefulSet-dawarich-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: dawarich-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: dawarich-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/directus/Pod-directus-valkey-test-auth-existing.yaml b/clusters/cl01tl/manifests/directus/Pod-directus-valkey-test-auth-existing.yaml
index a12f9d93c..2e779057d 100644
--- a/clusters/cl01tl/manifests/directus/Pod-directus-valkey-test-auth-existing.yaml
+++ b/clusters/cl01tl/manifests/directus/Pod-directus-valkey-test-auth-existing.yaml
@@ -15,7 +15,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: test-auth
-      image: "valkey/valkey:9.0.3"
+      image: "valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
       command:
         - sh
         - -c
diff --git a/clusters/cl01tl/manifests/directus/StatefulSet-directus-valkey.yaml b/clusters/cl01tl/manifests/directus/StatefulSet-directus-valkey.yaml
index da070dd28..40215c754 100644
--- a/clusters/cl01tl/manifests/directus/StatefulSet-directus-valkey.yaml
+++ b/clusters/cl01tl/manifests/directus/StatefulSet-directus-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: directus-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -69,7 +69,7 @@ spec:
               readOnly: true
       containers:
         - name: directus-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
diff --git a/clusters/cl01tl/manifests/gatus/ConfigMap-gatus.yaml b/clusters/cl01tl/manifests/gatus/ConfigMap-gatus.yaml
index 1d7e85e29..e7a968a14 100644
--- a/clusters/cl01tl/manifests/gatus/ConfigMap-gatus.yaml
+++ b/clusters/cl01tl/manifests/gatus/ConfigMap-gatus.yaml
@@ -645,6 +645,24 @@ data:
       interval: 30s
       name: www
       url: https://www.alexlebens.dev
+    - alerts:
+      - type: ntfy
+      conditions:
+      - '[STATUS] == 200'
+      - '[CERTIFICATE_EXPIRATION] > 240h'
+      group: external
+      interval: 30s
+      name: docs
+      url: https://docs.alexlebens.dev
+    - alerts:
+      - type: ntfy
+      conditions:
+      - '[STATUS] == 200'
+      - '[CERTIFICATE_EXPIRATION] > 240h'
+      group: external
+      interval: 30s
+      name: saralebens
+      url: https://www.saralebens.com
     - alerts:
       - type: ntfy
       conditions:
diff --git a/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml b/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
index a2593351e..206053bfc 100644
--- a/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
+++ b/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
@@ -26,7 +26,7 @@ spec:
         app.kubernetes.io/name: gatus
         app.kubernetes.io/instance: gatus
       annotations:
-        checksum/config: 9e51aed51c96eb387affbbf6fe413343981d84575be28ea5567a1fe5955290a5
+        checksum/config: 05213f56dc4393f377b38aa9a0eeee4a8633a07094e095f9690e2aba53902cbf
     spec:
       serviceAccountName: default
       automountServiceAccountToken: false
diff --git a/clusters/cl01tl/manifests/gitea/Deployment-gitea-valkey-renovate.yaml b/clusters/cl01tl/manifests/gitea/Deployment-gitea-valkey-renovate.yaml
index f2451969f..87042c675 100644
--- a/clusters/cl01tl/manifests/gitea/Deployment-gitea-valkey-renovate.yaml
+++ b/clusters/cl01tl/manifests/gitea/Deployment-gitea-valkey-renovate.yaml
@@ -32,7 +32,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: gitea-valkey-renovate-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -49,7 +49,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: gitea-valkey-renovate
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -81,7 +81,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml
index 6fcedb5d7..ddb074b28 100644
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: gitea-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: gitea-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator-valkey-remote-cache.yaml b/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator-valkey-remote-cache.yaml
index 44d98bcb6..b65e9b9f1 100644
--- a/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator-valkey-remote-cache.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/Deployment-grafana-operator-valkey-remote-cache.yaml
@@ -32,7 +32,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: grafana-operator-valkey-remote-cache-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -49,7 +49,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: grafana-operator-valkey-remote-cache
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -81,7 +81,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/grafana-operator/StatefulSet-grafana-operator-valkey-unified-alerting.yaml b/clusters/cl01tl/manifests/grafana-operator/StatefulSet-grafana-operator-valkey-unified-alerting.yaml
index 19686a651..5fa7ec661 100644
--- a/clusters/cl01tl/manifests/grafana-operator/StatefulSet-grafana-operator-valkey-unified-alerting.yaml
+++ b/clusters/cl01tl/manifests/grafana-operator/StatefulSet-grafana-operator-valkey-unified-alerting.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: grafana-operator-valkey-unified-alerting-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: grafana-operator-valkey-unified-alerting
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/harbor/StatefulSet-harbor-valkey.yaml b/clusters/cl01tl/manifests/harbor/StatefulSet-harbor-valkey.yaml
index 14f5ddf41..5d8dbe5d7 100644
--- a/clusters/cl01tl/manifests/harbor/StatefulSet-harbor-valkey.yaml
+++ b/clusters/cl01tl/manifests/harbor/StatefulSet-harbor-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: harbor-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: harbor-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml b/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml
index 6431f4275..0ed8011b9 100644
--- a/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml
+++ b/clusters/cl01tl/manifests/immich/StatefulSet-immich-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: immich-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: immich-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/kube-prometheus-stack/StatefulSet-kube-prometheus-stack-valkey.yaml b/clusters/cl01tl/manifests/kube-prometheus-stack/StatefulSet-kube-prometheus-stack-valkey.yaml
index 20fa2d6cd..5a4d8bd09 100644
--- a/clusters/cl01tl/manifests/kube-prometheus-stack/StatefulSet-kube-prometheus-stack-valkey.yaml
+++ b/clusters/cl01tl/manifests/kube-prometheus-stack/StatefulSet-kube-prometheus-stack-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: kube-prometheus-stack-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: kube-prometheus-stack-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/matrix-synapse/Pod-matrix-synapse-valkey-test-auth-existing.yaml b/clusters/cl01tl/manifests/matrix-synapse/Pod-matrix-synapse-valkey-test-auth-existing.yaml
index c9107c86b..591212956 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/Pod-matrix-synapse-valkey-test-auth-existing.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/Pod-matrix-synapse-valkey-test-auth-existing.yaml
@@ -15,7 +15,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: test-auth
-      image: "valkey/valkey:9.0.3"
+      image: "valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
       command:
         - sh
         - -c
diff --git a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey-hookshot.yaml b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey-hookshot.yaml
index b2df9cef7..2292de86d 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey-hookshot.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey-hookshot.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: matrix-synapse-valkey-hookshot-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: matrix-synapse-valkey-hookshot
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey.yaml b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey.yaml
index b7659bdae..de81b83ec 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/StatefulSet-matrix-synapse-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: matrix-synapse-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -69,7 +69,7 @@ spec:
               readOnly: true
       containers:
         - name: matrix-synapse-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
diff --git a/clusters/cl01tl/manifests/outline/StatefulSet-outline-valkey.yaml b/clusters/cl01tl/manifests/outline/StatefulSet-outline-valkey.yaml
index c2698398b..e809a8e6d 100644
--- a/clusters/cl01tl/manifests/outline/StatefulSet-outline-valkey.yaml
+++ b/clusters/cl01tl/manifests/outline/StatefulSet-outline-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: outline-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: outline-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/paperless-ngx/StatefulSet-paperless-ngx-valkey.yaml b/clusters/cl01tl/manifests/paperless-ngx/StatefulSet-paperless-ngx-valkey.yaml
index 1a31060a6..b00f98df9 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/StatefulSet-paperless-ngx-valkey.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/StatefulSet-paperless-ngx-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: paperless-ngx-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: paperless-ngx-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/postiz/Pod-postiz-valkey-test-auth-existing.yaml b/clusters/cl01tl/manifests/postiz/Pod-postiz-valkey-test-auth-existing.yaml
index 6a86bb9a3..6e026e36d 100644
--- a/clusters/cl01tl/manifests/postiz/Pod-postiz-valkey-test-auth-existing.yaml
+++ b/clusters/cl01tl/manifests/postiz/Pod-postiz-valkey-test-auth-existing.yaml
@@ -15,7 +15,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: test-auth
-      image: "valkey/valkey:9.0.3"
+      image: "valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
       command:
         - sh
         - -c
diff --git a/clusters/cl01tl/manifests/postiz/StatefulSet-postiz-valkey.yaml b/clusters/cl01tl/manifests/postiz/StatefulSet-postiz-valkey.yaml
index a65485738..88f7af502 100644
--- a/clusters/cl01tl/manifests/postiz/StatefulSet-postiz-valkey.yaml
+++ b/clusters/cl01tl/manifests/postiz/StatefulSet-postiz-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: postiz-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -69,7 +69,7 @@ spec:
               readOnly: true
       containers:
         - name: postiz-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
diff --git a/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml b/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml
index 48a0b3759..d9b51ce88 100644
--- a/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml
+++ b/clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml
@@ -34,7 +34,7 @@ spec:
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-        - image: harbor.alexlebens.net/images/site-documentation:0.22.0@sha256:3310620f9bad0184d6ba6c786a3826ce53038c03cca345660a7e422276dbd478
+        - image: harbor.alexlebens.net/images/site-documentation:0.23.0@sha256:d185fc8513362aab1663016deb2ce43ed6b4e6077685848f500c28d2d2cfd290
           name: main
           resources:
             requests:
diff --git a/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml b/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml
index 25a188b7e..09faf3c92 100644
--- a/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml
+++ b/clusters/cl01tl/manifests/site-profile/Deployment-site-profile.yaml
@@ -34,7 +34,7 @@ spec:
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-        - image: harbor.alexlebens.net/images/site-profile:3.16.1@sha256:656182fade379a0e8f1e6780c36bb64fe1374afbc8f06894126043105f66d29a
+        - image: harbor.alexlebens.net/images/site-profile:3.17.0@sha256:22c5bebe1148c019cdd50c2da06d9e8679e1b2653762cb3f3febf1aba75c309f
           name: main
           resources:
             requests:
diff --git a/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml
new file mode 100644
index 000000000..9397b12cc
--- /dev/null
+++ b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens-cloudflared.yaml
@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: site-saralebens-cloudflared
+  labels:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/version: 2026.3.0
+    helm.sh/chart: cloudflared-2.4.0
+  namespace: site-saralebens
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: main
+      app.kubernetes.io/name: cloudflared
+      app.kubernetes.io/instance: site-saralebens
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/controller: main
+        app.kubernetes.io/instance: site-saralebens
+        app.kubernetes.io/name: cloudflared
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+        - args:
+            - tunnel
+            - --protocol
+            - http2
+            - --no-autoupdate
+            - run
+            - --token
+            - $(CF_MANAGED_TUNNEL_TOKEN)
+          env:
+            - name: CF_MANAGED_TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: cf-tunnel-token
+                  name: site-saralebens-cloudflared-secret
+          image: cloudflare/cloudflared:2026.3.0
+          imagePullPolicy: IfNotPresent
+          name: main
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
diff --git a/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml
new file mode 100644
index 000000000..4b6db143e
--- /dev/null
+++ b/clusters/cl01tl/manifests/site-saralebens/Deployment-site-saralebens.yaml
@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: site-saralebens
+  labels:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-saralebens
+    helm.sh/chart: site-saralebens-4.6.2
+  namespace: site-saralebens
+spec:
+  revisionHistoryLimit: 3
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: main
+      app.kubernetes.io/name: site-saralebens
+      app.kubernetes.io/instance: site-saralebens
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/controller: main
+        app.kubernetes.io/instance: site-saralebens
+        app.kubernetes.io/name: site-saralebens
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+        - image: harbor.alexlebens.net/images/site-saralebens:1.0.0@sha256:547a1276115fb410fd19b1c4247dcaae01ab833970fda8ff301919b0369021b7
+          name: main
+          resources:
+            requests:
+              cpu: 10m
+              memory: 40Mi
diff --git a/clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml b/clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml
new file mode 100644
index 000000000..fb107ff33
--- /dev/null
+++ b/clusters/cl01tl/manifests/site-saralebens/ExternalSecret-site-saralebens-cloudflared-secret.yaml
@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: site-saralebens-cloudflared-secret
+  namespace: site-saralebens
+  labels:
+    helm.sh/chart: cloudflared-2.4.0
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/part-of: site-saralebens
+    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-saralebens-cloudflared-secret
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: cf-tunnel-token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cloudflare/tunnels/site-saralebens
+        metadataPolicy: None
+        property: token
diff --git a/clusters/cl01tl/manifests/site-saralebens/Service-site-saralebens.yaml b/clusters/cl01tl/manifests/site-saralebens/Service-site-saralebens.yaml
new file mode 100644
index 000000000..2e2b7b788
--- /dev/null
+++ b/clusters/cl01tl/manifests/site-saralebens/Service-site-saralebens.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: site-saralebens
+  labels:
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: site-saralebens
+    app.kubernetes.io/service: site-saralebens
+    helm.sh/chart: site-saralebens-4.6.2
+  namespace: site-saralebens
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 4321
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: site-saralebens
+    app.kubernetes.io/name: site-saralebens
diff --git a/clusters/cl01tl/manifests/stalwart/StatefulSet-stalwart-valkey.yaml b/clusters/cl01tl/manifests/stalwart/StatefulSet-stalwart-valkey.yaml
index 797c84fed..336121c4a 100644
--- a/clusters/cl01tl/manifests/stalwart/StatefulSet-stalwart-valkey.yaml
+++ b/clusters/cl01tl/manifests/stalwart/StatefulSet-stalwart-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: stalwart-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: stalwart-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/tubearchivist/StatefulSet-tubearchivist-valkey.yaml b/clusters/cl01tl/manifests/tubearchivist/StatefulSet-tubearchivist-valkey.yaml
index c9e535459..809239c84 100644
--- a/clusters/cl01tl/manifests/tubearchivist/StatefulSet-tubearchivist-valkey.yaml
+++ b/clusters/cl01tl/manifests/tubearchivist/StatefulSet-tubearchivist-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: tubearchivist-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: tubearchivist-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics
diff --git a/clusters/cl01tl/manifests/yamtrack/StatefulSet-yamtrack-valkey.yaml b/clusters/cl01tl/manifests/yamtrack/StatefulSet-yamtrack-valkey.yaml
index 89d8dd3da..f64ae8cfc 100644
--- a/clusters/cl01tl/manifests/yamtrack/StatefulSet-yamtrack-valkey.yaml
+++ b/clusters/cl01tl/manifests/yamtrack/StatefulSet-yamtrack-valkey.yaml
@@ -42,7 +42,7 @@ spec:
         runAsUser: 1000
       initContainers:
         - name: yamtrack-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -64,7 +64,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: yamtrack-valkey
-          image: docker.io/valkey/valkey:9.0.3
+          image: docker.io/valkey/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
           imagePullPolicy: IfNotPresent
           command: ["valkey-server"]
           args: ["/data/conf/valkey.conf"]
@@ -100,7 +100,7 @@ spec:
             - name: valkey-data
               mountPath: /data
         - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
+          image: ghcr.io/oliver006/redis_exporter:v1.82.0@sha256:6a97d4dd743b533e1f950c677b87d880e44df363c61af3f406fc9e53ed65ee03
           imagePullPolicy: "IfNotPresent"
           ports:
             - name: metrics