diff --git a/infrastructure/k8s/umami/deployment.yaml b/infrastructure/k8s/umami/deployment.yaml
index dcdb1d64..9aff06c1 100644
--- a/infrastructure/k8s/umami/deployment.yaml
+++ b/infrastructure/k8s/umami/deployment.yaml
@@ -116,7 +116,7 @@ spec:
     spec:
       containers:
       - name: umami
-        image: ghcr.io/umami-software/umami:postgresql-latest
+        image: ghcr.io/umami-software/umami:3.4.1@sha256:e69d1a7932e9dab0fc523edc7be1f3a53f3c261f57856fc2167ae74a8fc022e8  # Node 22.23.4, brotli-libs 1.2.1-r0 (CVE-2026-111497)
         ports:
         - containerPort: 3000
         env: