diff --git a/stacks/priority-pass/main.tf b/stacks/priority-pass/main.tf
index 4b320df7..d02aa651 100644
--- a/stacks/priority-pass/main.tf
+++ b/stacks/priority-pass/main.tf
@@ -1,8 +1,19 @@
+variable "image_tag" {
+  type        = string
+  default     = "7c01448d"
+  description = "priority-pass image tag (applies to both frontend + backend). Use 8-char git SHA in CI; :latest only for local trials."
+}
+
 variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
 
+locals {
+  frontend_image = "docker.io/viktorbarzin/priority-pass-frontend:${var.image_tag}"
+  backend_image  = "docker.io/viktorbarzin/priority-pass-backend:${var.image_tag}"
+}
+
 resource "kubernetes_namespace" "priority-pass" {
   metadata {
     name = "priority-pass"
@@ -80,7 +91,7 @@ resource "kubernetes_deployment" "priority-pass" {
         }
         container {
           name  = "frontend"
-          image = "docker.io/viktorbarzin/priority-pass-frontend:7c01448d"
+          image = local.frontend_image
           port {
             container_port = 3000
           }
@@ -104,7 +115,7 @@ resource "kubernetes_deployment" "priority-pass" {
         }
         container {
           name  = "backend"
-          image = "docker.io/viktorbarzin/priority-pass-backend:7c01448d"
+          image = local.backend_image
           port {
             container_port = 8000
           }
diff --git a/stacks/priority-pass/terragrunt.hcl b/stacks/priority-pass/terragrunt.hcl
deleted file mode 120000
index af58a92e..00000000
--- a/stacks/priority-pass/terragrunt.hcl
+++ /dev/null
@@ -1 +0,0 @@
-../../terragrunt.hcl
\ No newline at end of file
diff --git a/stacks/priority-pass/terragrunt.hcl b/stacks/priority-pass/terragrunt.hcl
new file mode 100644
index 00000000..6cb142d9
--- /dev/null
+++ b/stacks/priority-pass/terragrunt.hcl
@@ -0,0 +1,25 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}
+
+dependency "external-secrets" {
+  config_path  = "../external-secrets"
+  skip_outputs = true
+}
+
+inputs = {
+  # priority-pass repo HEAD — auto-bumped by GHA `build-and-deploy.yml`
+  # on every successful build. Manual edits welcome for local trials,
+  # but CI will overwrite on the next push to main.
+  image_tag = "7c01448d"
+}