diff --git a/kubernetes/pi/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml b/kubernetes/pi/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
index e7ecee0e33..8084ffd236 100644
--- a/kubernetes/pi/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
+++ b/kubernetes/pi/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
@@ -34,7 +34,7 @@ spec:
           main:
             image:
               repository: ghcr.io/ripplefcl/bws-cache
-              tag: pr-28
+              tag: pr-28@sha256:8356f40801a08bf2415bceaf2bf3f792f33235a491833f414e69f69f1f707a50
             env:
               SECRET_TTL: 3600
               DEBUG: "false"
diff --git a/kubernetes/teyvat/apps/database/cloudnative-pg/cluster/cluster.yaml b/kubernetes/teyvat/apps/database/cloudnative-pg/cluster/cluster.yaml
index fd202c8671..2136959355 100644
--- a/kubernetes/teyvat/apps/database/cloudnative-pg/cluster/cluster.yaml
+++ b/kubernetes/teyvat/apps/database/cloudnative-pg/cluster/cluster.yaml
@@ -12,7 +12,7 @@ spec:
     size: 20Gi
     storageClass: local-hostpath
   superuserSecret:
-    name: cloudnative-pg
+    name: &secret cloudnative-pg-secret
   enableSuperuserAccess: true
   postgresql:
     parameters:
@@ -46,7 +46,7 @@ spec:
       serverName: &currentCluster postgres-v4
       s3Credentials:
         accessKeyId:
-          name: &secret cloudnative-pg-secret
+          name: *secret
           key: aws-access-key-id
         secretAccessKey:
           name: *secret
diff --git a/kubernetes/teyvat/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml b/kubernetes/teyvat/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
index e7ecee0e33..8084ffd236 100644
--- a/kubernetes/teyvat/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
+++ b/kubernetes/teyvat/apps/external-secrets/external-secrets/bitwarden-secrets-manager/helmrelease.yaml
@@ -34,7 +34,7 @@ spec:
           main:
             image:
               repository: ghcr.io/ripplefcl/bws-cache
-              tag: pr-28
+              tag: pr-28@sha256:8356f40801a08bf2415bceaf2bf3f792f33235a491833f414e69f69f1f707a50
             env:
               SECRET_TTL: 3600
               DEBUG: "false"