diff --git a/.woodpecker/app-stacks.yml b/.woodpecker/app-stacks.yml
new file mode 100644
index 00000000..f4e63df9
--- /dev/null
+++ b/.woodpecker/app-stacks.yml
@@ -0,0 +1,122 @@
+when:
+  event: push
+  branch: master
+  # Only trigger when application stack files change
+  path:
+    include:
+      - 'stacks/**'
+    exclude:
+      - '.woodpecker/**'
+
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      attempts: 5
+      backoff: 10s
+
+steps:
+  - name: detect-changes
+    image: alpine
+    commands:
+      - apk add --no-cache git
+      # Detect which stacks changed in the latest commit
+      - |
+        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '^stacks/' | cut -d/ -f2 | sort -u || true)
+        if [ -z "$CHANGED" ]; then
+          echo "No stack changes detected"
+          echo "" > .stacks_to_apply
+          exit 0
+        fi
+        # Exclude platform stacks (handled by default.yml)
+        PLATFORM="dbaas authentik crowdsec monitoring nvidia mailserver cloudflared kyverno metallb redis traefik technitium headscale rbac k8s-portal vaultwarden reverse-proxy metrics-server vpa nfs-csi iscsi-csi cnpg sealed-secrets uptime-kuma wireguard xray infra-maintenance platform vault reloader descheduler external-secrets"
+        APPLY=""
+        for stack in $CHANGED; do
+          if echo "$PLATFORM" | grep -qw "$stack"; then
+            echo "Skipping platform stack: $stack"
+            continue
+          fi
+          if [ ! -f "stacks/$stack/terragrunt.hcl" ]; then
+            echo "Skipping $stack (no terragrunt.hcl)"
+            continue
+          fi
+          APPLY="$APPLY $stack"
+        done
+        echo "$APPLY" > .stacks_to_apply
+        echo "Stacks to apply:$APPLY"
+
+  - name: prepare
+    image: alpine
+    commands:
+      - "apk update && apk add jq curl git git-crypt"
+      - |
+        curl -k https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
+      - "git-crypt unlock /tmp/key && rm /tmp/key"
+      - |
+        SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+        VAULT_TOKEN=$(curl -s -X POST http://vault-active.vault.svc.cluster.local:8200/v1/auth/kubernetes/login \
+          -d "{\"role\":\"ci\",\"jwt\":\"$SA_TOKEN\"}" | jq -r .auth.client_token)
+        echo "export VAULT_TOKEN=$VAULT_TOKEN" > .vault-env
+        echo "export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200" >> .vault-env
+    when:
+      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
+
+  - name: terragrunt-apply
+    image: alpine
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 2Gi
+          limits:
+            memory: 4Gi
+    commands:
+      - "apk update && apk add curl unzip git openssh-client"
+      - "wget -qO /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
+      - "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
+      - "wget -qO /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
+      - "chmod 755 /usr/local/bin/terragrunt"
+      - "source .vault-env"
+      - |
+        STACKS=$(cat .stacks_to_apply)
+        if [ -z "$STACKS" ]; then
+          echo "No app stacks to apply"
+          exit 0
+        fi
+        FAILED=""
+        for stack in $STACKS; do
+          echo "=== Applying: $stack ==="
+          (cd stacks/$stack && terragrunt apply --non-interactive -auto-approve) &
+        done
+        wait
+    when:
+      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
+
+  - name: cleanup-and-push
+    image: alpine
+    commands:
+      - "rm -f .vault-env"
+      - "apk update && apk add openssh-client git git-crypt"
+      - "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
+      - "chmod 400 secrets/deploy_key"
+      - "git add stacks/ state/ .woodpecker/ || true"
+      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
+      - "git commit -m 'Woodpecker CI app-stacks deploy commit [CI SKIP]' || echo 'No changes'"
+      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master || true"
+      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"
+    when:
+      status: [success, failure]
+
+  - name: slack
+    image: curlimages/curl
+    commands:
+      - |
+        STACKS=$(cat .stacks_to_apply 2>/dev/null || echo "none")
+        curl -s -X POST -H 'Content-type: application/json' \
+          --data "{\"channel\":\"general\",\"text\":\"Woodpecker CI: app-stacks pipeline ${CI_PIPELINE_STATUS} (stacks:${STACKS})\"}" \
+          "$SLACK_WEBHOOK" || true
+    environment:
+      SLACK_WEBHOOK:
+        from_secret: slack_webhook
+    when:
+      status: [success, failure]
diff --git a/stacks/affine/main.tf b/stacks/affine/main.tf
index efecbf1e..8517d490 100644
--- a/stacks/affine/main.tf
+++ b/stacks/affine/main.tf
@@ -203,6 +203,8 @@ resource "kubernetes_deployment" "affine" {
           app = "affine"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
         }
       }
@@ -210,7 +212,7 @@ resource "kubernetes_deployment" "affine" {
         # Init container to run database migrations
         init_container {
           name    = "migration"
-          image   = "ghcr.io/toeverything/affine:stable"
+          image   = "ghcr.io/toeverything/affine:0.20.7"
           command = ["sh", "-c", "npx prisma migrate deploy && SERVER_FLAVOR=script node ./dist/main.js run"]
 
           dynamic "env" {
@@ -253,7 +255,7 @@ resource "kubernetes_deployment" "affine" {
 
         container {
           name  = "affine"
-          image = "ghcr.io/toeverything/affine:stable"
+          image = "ghcr.io/toeverything/affine:0.20.7"
 
           port {
             container_port = 3010
diff --git a/stacks/coturn/main.tf b/stacks/coturn/main.tf
index 7d963c4f..53b544b9 100644
--- a/stacks/coturn/main.tf
+++ b/stacks/coturn/main.tf
@@ -139,12 +139,16 @@ resource "kubernetes_deployment" "coturn" {
         labels = {
           app = "coturn"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+-r\\d+$"
+        }
       }
 
       spec {
         container {
           name  = "coturn"
-          image = "coturn/coturn:latest"
+          image = "coturn/coturn:4.6.3-r1"
           args  = ["-c", "/etc/turnserver/turnserver.conf"]
 
           # STUN/TURN signaling port
diff --git a/stacks/cyberchef/main.tf b/stacks/cyberchef/main.tf
index 3e7d08c4..4222ce93 100644
--- a/stacks/cyberchef/main.tf
+++ b/stacks/cyberchef/main.tf
@@ -46,10 +46,14 @@ resource "kubernetes_deployment" "cyberchef" {
         labels = {
           app = "cyberchef"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "mpepping/cyberchef:latest"
+          image = "mpepping/cyberchef:v10.24.0"
           name  = "cyberchef"
 
           port {
diff --git a/stacks/dawarich/main.tf b/stacks/dawarich/main.tf
index 34c3ed94..05f8ebe7 100644
--- a/stacks/dawarich/main.tf
+++ b/stacks/dawarich/main.tf
@@ -82,8 +82,8 @@ resource "kubernetes_deployment" "dawarich" {
           app = "dawarich"
         }
         annotations = {
-          # "diun.enable"          = "true"
-          # "diun.include_tags"    = "latest"
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^v?\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
         }
       }
diff --git a/stacks/echo/main.tf b/stacks/echo/main.tf
index 0e950b21..b1203cb3 100644
--- a/stacks/echo/main.tf
+++ b/stacks/echo/main.tf
@@ -41,10 +41,14 @@ resource "kubernetes_deployment" "echo" {
         labels = {
           app = "echo"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+$"
+        }
       }
       spec {
         container {
-          image = "mendhak/http-https-echo"
+          image = "mendhak/http-https-echo:36"
           name  = "echo"
           port {
             container_port = 8080
diff --git a/stacks/immich/frame.tf b/stacks/immich/frame.tf
index f0c06487..1e0420ee 100644
--- a/stacks/immich/frame.tf
+++ b/stacks/immich/frame.tf
@@ -64,7 +64,7 @@ resource "kubernetes_deployment" "immich-frame" {
       }
       spec {
         container {
-          image = "ghcr.io/immichframe/immichframe:latest"
+          image = "ghcr.io/immichframe/immichframe:1.7.4"
           name  = "immich-frame"
           resources {
             requests = {
diff --git a/stacks/linkwarden/main.tf b/stacks/linkwarden/main.tf
index b836a9a9..0453c508 100644
--- a/stacks/linkwarden/main.tf
+++ b/stacks/linkwarden/main.tf
@@ -128,14 +128,14 @@ resource "kubernetes_deployment" "linkwarden" {
           app = "linkwarden"
         }
         annotations = {
-          "diun.enable"                    = "false"
-          "diun.include_tags"              = "latest"
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^v?\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
         }
       }
       spec {
         container {
-          image = "ghcr.io/linkwarden/linkwarden:latest"
+          image = "ghcr.io/linkwarden/linkwarden:v2.9.1"
           name  = "linkwarden"
 
           port {
diff --git a/stacks/matrix/main.tf b/stacks/matrix/main.tf
index 08726025..005ea0e9 100644
--- a/stacks/matrix/main.tf
+++ b/stacks/matrix/main.tf
@@ -111,13 +111,15 @@ resource "kubernetes_deployment" "matrix" {
           app = "matrix"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^v\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "pg-cluster-rw.dbaas:5432"
         }
       }
       spec {
         init_container {
           name    = "install-psycopg2"
-          image   = "matrixdotorg/synapse:latest"
+          image   = "matrixdotorg/synapse:v1.125.0"
           command = ["/bin/sh", "-c", "pip install --target=/extra-packages psycopg2-binary 2>/dev/null"]
           volume_mount {
             name       = "extra-packages"
@@ -150,7 +152,7 @@ resource "kubernetes_deployment" "matrix" {
           }
         }
         container {
-          image = "matrixdotorg/synapse:latest"
+          image = "matrixdotorg/synapse:v1.125.0"
           name  = "matrix"
           port {
             container_port = 8008
diff --git a/stacks/n8n/main.tf b/stacks/n8n/main.tf
index 621fa151..df9034b1 100644
--- a/stacks/n8n/main.tf
+++ b/stacks/n8n/main.tf
@@ -148,6 +148,8 @@ resource "kubernetes_deployment" "n8n" {
           app = "n8n"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
         }
       }
@@ -155,7 +157,7 @@ resource "kubernetes_deployment" "n8n" {
         service_account_name = kubernetes_service_account.n8n.metadata[0].name
         container {
           name  = "n8n"
-          image = "docker.n8n.io/n8nio/n8n"
+          image = "docker.n8n.io/n8nio/n8n:1.80.0"
           env {
             name  = "DB_TYPE"
             value = "postgresdb"
diff --git a/stacks/networking-toolbox/main.tf b/stacks/networking-toolbox/main.tf
index af7e5f7c..e7387d26 100644
--- a/stacks/networking-toolbox/main.tf
+++ b/stacks/networking-toolbox/main.tf
@@ -41,10 +41,14 @@ resource "kubernetes_deployment" "networking-toolbox" {
         labels = {
           app = "networking-toolbox"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lissy93/networking-toolbox"
+          image = "lissy93/networking-toolbox:1.1.1"
           name  = "networking-toolbox"
           port {
             container_port = 3000
diff --git a/stacks/ollama/main.tf b/stacks/ollama/main.tf
index 70aae332..68da260e 100644
--- a/stacks/ollama/main.tf
+++ b/stacks/ollama/main.tf
@@ -132,6 +132,10 @@ resource "kubernetes_deployment" "ollama" {
         labels = {
           app = "ollama"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         node_selector = {
@@ -143,7 +147,7 @@ resource "kubernetes_deployment" "ollama" {
           effect = "NoSchedule"
         }
         container {
-          image = "ollama/ollama:latest"
+          image = "ollama/ollama:0.6.10"
           name  = "ollama"
           env {
             name  = "OLLAMA_HOST"
diff --git a/stacks/paperless-ngx/main.tf b/stacks/paperless-ngx/main.tf
index e4e4aed2..5a0d971b 100644
--- a/stacks/paperless-ngx/main.tf
+++ b/stacks/paperless-ngx/main.tf
@@ -119,14 +119,14 @@ resource "kubernetes_deployment" "paperless-ngx" {
           app = "paperless-ngx"
         }
         annotations = {
-          "diun.enable"                    = "false"
+          "diun.enable"                    = "true"
           "diun.include_tags"              = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
           "dependency.kyverno.io/wait-for" = "mysql.dbaas:3306,redis.redis:6379"
         }
       }
       spec {
         container {
-          image = "ghcr.io/paperless-ngx/paperless-ngx:latest"
+          image = "ghcr.io/paperless-ngx/paperless-ngx:2.16.4"
           name  = "paperless-ngx"
           env {
             name = "PAPERLESS_REDIS"
diff --git a/stacks/platform/modules/cloudflared/main.tf b/stacks/platform/modules/cloudflared/main.tf
index 8cee6da1..aea53b10 100644
--- a/stacks/platform/modules/cloudflared/main.tf
+++ b/stacks/platform/modules/cloudflared/main.tf
@@ -45,6 +45,10 @@ resource "kubernetes_deployment" "cloudflared" {
         labels = {
           app = "cloudflared"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d{4}\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         topology_spread_constraint {
@@ -59,7 +63,7 @@ resource "kubernetes_deployment" "cloudflared" {
         }
         container {
           # image = "wisdomsky/cloudflared-web:latest"
-          image   = "cloudflare/cloudflared"
+          image   = "cloudflare/cloudflared:2026.3.0"
           name    = "cloudflared"
           command = ["cloudflared", "tunnel", "run"]
           env {
diff --git a/stacks/platform/modules/headscale/main.tf b/stacks/platform/modules/headscale/main.tf
index 4b0562a7..1feea770 100644
--- a/stacks/platform/modules/headscale/main.tf
+++ b/stacks/platform/modules/headscale/main.tf
@@ -64,15 +64,14 @@ resource "kubernetes_deployment" "headscale" {
           app = "headscale"
         }
         annotations = {
-          # "diun.enable"       = "true"
-          "diun.enable"       = "false"
+          "diun.enable"       = "true"
           "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
         }
       }
       spec {
         container {
-          image = "headscale/headscale:0.23.0"
-          # image   = "headscale/headscale:0.23.0-debug" # -debug is for debug images
+          image = "headscale/headscale:0.28.0"
+          # image   = "headscale/headscale:0.28.0-debug" # -debug is for debug images
           name    = "headscale"
           command = ["headscale", "serve"]
 
diff --git a/stacks/platform/modules/monitoring/pve_exporter.tf b/stacks/platform/modules/monitoring/pve_exporter.tf
index 4c103297..196da1f6 100644
--- a/stacks/platform/modules/monitoring/pve_exporter.tf
+++ b/stacks/platform/modules/monitoring/pve_exporter.tf
@@ -38,12 +38,16 @@ resource "kubernetes_deployment" "pve_exporter" {
         labels = {
           app = "proxmox-exporter"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
 
       spec {
         container {
           name  = "proxmox-exporter"
-          image = "prompve/prometheus-pve-exporter:latest"
+          image = "prompve/prometheus-pve-exporter:3.8.2"
 
           port {
             container_port = 9221
diff --git a/stacks/platform/modules/monitoring/snmp_exporter.tf b/stacks/platform/modules/monitoring/snmp_exporter.tf
index 07eaf39a..a4dea38a 100644
--- a/stacks/platform/modules/monitoring/snmp_exporter.tf
+++ b/stacks/platform/modules/monitoring/snmp_exporter.tf
@@ -48,10 +48,14 @@ resource "kubernetes_deployment" "snmp-exporter" {
         labels = {
           app = "snmp-exporter"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "prom/snmp-exporter"
+          image = "prom/snmp-exporter:v0.30.1"
           name  = "snmp-exporter"
           # command = ["/usr/local/bin/redfish_exporter", "--config.file", "/app/config.yml"]
 
diff --git a/stacks/platform/modules/technitium/ha.tf b/stacks/platform/modules/technitium/ha.tf
index 8ad16b95..b50cca5b 100644
--- a/stacks/platform/modules/technitium/ha.tf
+++ b/stacks/platform/modules/technitium/ha.tf
@@ -93,7 +93,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
           }
         }
         container {
-          image = "technitium/dns-server:latest"
+          image = "technitium/dns-server:14.3.0"
           name  = "technitium"
           env {
             name  = "DNS_SERVER_ADMIN_PASSWORD"
diff --git a/stacks/platform/modules/technitium/main.tf b/stacks/platform/modules/technitium/main.tf
index 69f3c76b..ce8240ab 100644
--- a/stacks/platform/modules/technitium/main.tf
+++ b/stacks/platform/modules/technitium/main.tf
@@ -119,9 +119,8 @@ resource "kubernetes_deployment" "technitium" {
     template {
       metadata {
         annotations = {
-          "diun.enable" = "false"
-          # "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
-          "diun.include_tags" = "latest"
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
         }
         labels = {
           app          = "technitium"
@@ -161,7 +160,7 @@ resource "kubernetes_deployment" "technitium" {
           }
         }
         container {
-          image = "technitium/dns-server:latest"
+          image = "technitium/dns-server:14.3.0"
           name  = "technitium"
           resources {
             requests = {
diff --git a/stacks/platform/modules/xray/main.tf b/stacks/platform/modules/xray/main.tf
index ae258875..d3a8ea01 100644
--- a/stacks/platform/modules/xray/main.tf
+++ b/stacks/platform/modules/xray/main.tf
@@ -80,10 +80,14 @@ resource "kubernetes_deployment" "xray" {
         labels = {
           app = "xray"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image             = "teddysun/xray"
+          image             = "teddysun/xray:26.3.27"
           name              = "xray"
           image_pull_policy = "IfNotPresent"
           port {
diff --git a/stacks/rybbit/main.tf b/stacks/rybbit/main.tf
index c0e1cc2a..7902861c 100644
--- a/stacks/rybbit/main.tf
+++ b/stacks/rybbit/main.tf
@@ -316,12 +316,14 @@ resource "kubernetes_deployment" "rybbit" {
           app = "rybbit"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^v?\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,clickhouse.rybbit:8123"
         }
       }
       spec {
         container {
-          image = "ghcr.io/rybbit-io/rybbit-backend:latest"
+          image = "ghcr.io/rybbit-io/rybbit-backend:v1.0.21"
           name  = "rybbit"
 
           env {
@@ -477,7 +479,7 @@ resource "kubernetes_deployment" "rybbit-client" {
       spec {
         container {
           name  = "rybbit-client"
-          image = "ghcr.io/rybbit-io/rybbit-client:latest"
+          image = "ghcr.io/rybbit-io/rybbit-client:v1.0.20"
           env {
             name  = "NODE_ENV"
             value = "production"
diff --git a/stacks/servarr/lidarr/main.tf b/stacks/servarr/lidarr/main.tf
index b50e716b..053b95ea 100644
--- a/stacks/servarr/lidarr/main.tf
+++ b/stacks/servarr/lidarr/main.tf
@@ -43,10 +43,14 @@ resource "kubernetes_deployment" "lidarr" {
         labels = {
           app = "lidarr"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/lidarr:latest"
+          image = "lscr.io/linuxserver/lidarr:2.9.4"
           # image = "youegraillot/lidarr-on-steroids"
           name = "lidarr"
 
diff --git a/stacks/servarr/prowlarr/main.tf b/stacks/servarr/prowlarr/main.tf
index 46b1d865..dfdb9392 100644
--- a/stacks/servarr/prowlarr/main.tf
+++ b/stacks/servarr/prowlarr/main.tf
@@ -72,10 +72,14 @@ resource "kubernetes_deployment" "prowlarr" {
         labels = {
           app = "prowlarr"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/prowlarr:latest"
+          image = "lscr.io/linuxserver/prowlarr:1.31.1"
           name  = "prowlarr"
 
           resources {
diff --git a/stacks/servarr/qbittorrent/main.tf b/stacks/servarr/qbittorrent/main.tf
index 6f75480a..b1e135c3 100644
--- a/stacks/servarr/qbittorrent/main.tf
+++ b/stacks/servarr/qbittorrent/main.tf
@@ -80,10 +80,14 @@ resource "kubernetes_deployment" "qbittorrent" {
         labels = {
           app = "qbittorrent"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/qbittorrent:latest"
+          image = "lscr.io/linuxserver/qbittorrent:5.0.4"
           name  = "qbittorrent"
 
           port {
diff --git a/stacks/shadowsocks/main.tf b/stacks/shadowsocks/main.tf
index b1994053..04cb6905 100644
--- a/stacks/shadowsocks/main.tf
+++ b/stacks/shadowsocks/main.tf
@@ -66,11 +66,15 @@ resource "kubernetes_deployment" "shadowsocks" {
         labels = {
           "app" = "shadowsocks"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
           name              = "shadowsocks"
-          image             = "shadowsocks/shadowsocks-libev"
+          image             = "shadowsocks/shadowsocks-libev:v3.3.5"
           image_pull_policy = "IfNotPresent"
           env {
             name  = "METHOD"
diff --git a/stacks/speedtest/main.tf b/stacks/speedtest/main.tf
index b17cf876..7bc8f0c5 100644
--- a/stacks/speedtest/main.tf
+++ b/stacks/speedtest/main.tf
@@ -111,12 +111,14 @@ resource "kubernetes_deployment" "speedtest" {
           app = "speedtest"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
         }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/speedtest-tracker:latest"
+          image = "lscr.io/linuxserver/speedtest-tracker:0.24.1"
           name  = "speedtest"
           port {
             container_port = 80
diff --git a/stacks/technitium/modules/technitium/ha.tf b/stacks/technitium/modules/technitium/ha.tf
index 0bb5295a..f497326e 100644
--- a/stacks/technitium/modules/technitium/ha.tf
+++ b/stacks/technitium/modules/technitium/ha.tf
@@ -111,7 +111,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
           }
         }
         container {
-          image = "technitium/dns-server:latest"
+          image = "technitium/dns-server:14.3.0"
           name  = "technitium"
           env {
             name  = "DNS_SERVER_ADMIN_PASSWORD"
@@ -262,7 +262,7 @@ resource "kubernetes_deployment" "technitium_tertiary" {
           }
         }
         container {
-          image = "technitium/dns-server:latest"
+          image = "technitium/dns-server:14.3.0"
           name  = "technitium"
           env {
             name  = "DNS_SERVER_ADMIN_PASSWORD"
diff --git a/stacks/technitium/modules/technitium/main.tf b/stacks/technitium/modules/technitium/main.tf
index caba2fef..75ea40be 100644
--- a/stacks/technitium/modules/technitium/main.tf
+++ b/stacks/technitium/modules/technitium/main.tf
@@ -114,9 +114,8 @@ resource "kubernetes_deployment" "technitium" {
     template {
       metadata {
         annotations = {
-          "diun.enable" = "false"
-          # "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
-          "diun.include_tags" = "latest"
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
         }
         labels = {
           app          = "technitium"
@@ -140,7 +139,7 @@ resource "kubernetes_deployment" "technitium" {
           }
         }
         container {
-          image = "technitium/dns-server:latest"
+          image = "technitium/dns-server:14.3.0"
           name  = "technitium"
           resources {
             requests = {
diff --git a/stacks/url/main.tf b/stacks/url/main.tf
index 9dba0b24..4af5387d 100644
--- a/stacks/url/main.tf
+++ b/stacks/url/main.tf
@@ -171,12 +171,14 @@ resource "kubernetes_deployment" "shlink" {
           run = "shlink"
         }
         annotations = {
+          "diun.enable"                    = "true"
+          "diun.include_tags"              = "^\\d+\\.\\d+\\.\\d+$"
           "dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
         }
       }
       spec {
         container {
-          image = "shlinkio/shlink:stable"
+          image = "shlinkio/shlink:4.3.4"
           name  = "shlink"
           env {
             name  = "DEFAULT_DOMAIN"
diff --git a/stacks/wealthfolio/main.tf b/stacks/wealthfolio/main.tf
index ce2dc55a..eed1605f 100644
--- a/stacks/wealthfolio/main.tf
+++ b/stacks/wealthfolio/main.tf
@@ -112,10 +112,14 @@ resource "kubernetes_deployment" "wealthfolio" {
         labels = {
           app = "wealthfolio"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "afadil/wealthfolio:latest"
+          image = "afadil/wealthfolio:v1.1.0"
           name  = "wealthfolio"
           port {
             container_port = 8080