diff --git a/build/pin-images.py b/build/pin-images.py
index 5f9341b..1c0bde5 100755
--- a/build/pin-images.py
+++ b/build/pin-images.py
@@ -13,13 +13,44 @@
 CONF = cfg.CONF
 
 
+def get_digest(image_ref, token=None):
+    headers = {}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+
+    try:
+        headers["Accept"] = "application/vnd.docker.distribution.manifest.v2+json"
+
+        r = requests.get(
+            f"https://{image_ref.domain()}/v2/{image_ref.path()}/manifests/{image_ref['tag']}",
+            timeout=5,
+            headers=headers,
+        )
+        r.raise_for_status()
+        return r.headers["Docker-Content-Digest"]
+    except requests.exceptions.HTTPError:
+        headers["Accept"] = "application/vnd.oci.image.index.v1+json"
+
+        r = requests.get(
+            f"https://{image_ref.domain()}/v2/{image_ref.path()}/manifests/{image_ref['tag']}",
+            timeout=5,
+            headers=headers,
+        )
+        r.raise_for_status()
+        return r.headers["Docker-Content-Digest"]
+
+
 @functools.cache
 def get_pinned_image(image_src):
     image_ref = reference.Reference.parse(image_src)
 
+    if image_ref.domain() in ("registry.k8s.io", "us-docker.pkg.dev"):
+        digest = get_digest(image_ref)
+
     if image_ref.domain() == "quay.io":
         r = requests.get(
             f"https://quay.io/api/v1/repository/{image_ref.path()}/tag/",
+            timeout=5,
             params={"specificTag": image_ref["tag"]},
         )
         r.raise_for_status()
@@ -29,6 +60,7 @@
         # Get token for docker.io
         r = requests.get(
             "https://auth.docker.io/token",
+            timeout=5,
             params={
                 "service": "registry.docker.io",
                 "scope": f"repository:{image_ref.path()}:pull",
@@ -39,6 +71,7 @@
 
         r = requests.get(
             f"https://registry-1.docker.io/v2/{image_ref.path()}/manifests/{image_ref['tag']}",
+            timeout=5,
             headers={
                 "Accept": "application/vnd.docker.distribution.manifest.v2+json",
                 "Authorization": f"Bearer {token}",
@@ -47,7 +80,22 @@
         r.raise_for_status()
         digest = r.headers["Docker-Content-Digest"]
 
-    return f"{image_ref.domain()}/{image_ref.path()}@{digest}"
+    if image_ref.domain() == "ghcr.io":
+        # Get token for docker.io
+        r = requests.get(
+            "https://ghcr.io/token",
+            timeout=5,
+            params={
+                "service": "ghcr.io",
+                "scope": f"repository:{image_ref.path()}:pull",
+            },
+        )
+        r.raise_for_status()
+        token = r.json()["token"]
+
+        digest = get_digest(image_ref, token=token)
+
+    return f"{image_ref.domain()}/{image_ref.path()}:{image_ref['tag']}@{digest}"
 
 
 def main():
@@ -65,13 +113,8 @@
     yaml = YAML(typ="rt")
     data = yaml.load(args.src)
 
-    for image in data["_atmosphere_images"].ca.items:
-        token = data["_atmosphere_images"].ca.get(image, 2).value
-        if not token.startswith("# image-source: "):
-            LOG.info("Skipping image %s", image)
-            continue
-
-        image_src = token.replace("# image-source: ", "").strip()
+    for image in data["_atmosphere_images"]:
+        image_src = data["_atmosphere_images"][image]
         pinned_image = get_pinned_image(image_src)
 
         LOG.info("Pinning image %s from %s to %s", image, image_src, pinned_image)
diff --git a/roles/defaults/vars/main.yml b/roles/defaults/vars/main.yml
index c6cac2d..7b03b23 100644
--- a/roles/defaults/vars/main.yml
+++ b/roles/defaults/vars/main.yml
@@ -13,16 +13,16 @@
 # under the License.
 
 _atmosphere_images:
-  alertmanager: quay.io/prometheus/alertmanager:v0.26.0
+  alertmanager: quay.io/prometheus/alertmanager:v0.26.0@sha256:361db356b33041437517f1cd298462055580585f26555c317df1a3caf2868552
   barbican_api: quay.io/vexxhost/barbican:zed@sha256:fa04a817738e72cf9cba1582728c5463c7e33acf796aed4b2978af1414701a63
   barbican_db_sync: quay.io/vexxhost/barbican:zed@sha256:fa04a817738e72cf9cba1582728c5463c7e33acf796aed4b2978af1414701a63
   bootstrap: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   ceph_config_helper: quay.io/vexxhost/libvirtd:zed@sha256:480d8736954cdc01c1d6f0c625ba147935ce4e5af25828f6d3fbcd18e6dc283a
-  ceph: quay.io/ceph/ceph:v16.2.11
-  cert_manager_cainjector: quay.io/jetstack/cert-manager-cainjector:v1.7.1
-  cert_manager_cli: quay.io/jetstack/cert-manager-ctl:v1.7.1
-  cert_manager_controller: quay.io/jetstack/cert-manager-controller:v1.7.1
-  cert_manager_webhook: quay.io/jetstack/cert-manager-webhook:v1.7.1
+  ceph: quay.io/ceph/ceph:v16.2.11@sha256:1b9803c8984bef8b82f05e233e8fe8ed8f0bba8e5cc2c57f6efaccbeea682add
+  cert_manager_cainjector: quay.io/jetstack/cert-manager-cainjector:v1.7.1@sha256:985743eeed2b62f68ee06e583f1d5a371e1c35af4b1980a1b2571d29174cce47
+  cert_manager_cli: quay.io/jetstack/cert-manager-ctl:v1.7.1@sha256:af84513925d86d2de456b5d67dbccd2a34d93aa6fd4e1c8fe9f84182fef1b1b1
+  cert_manager_controller: quay.io/jetstack/cert-manager-controller:v1.7.1@sha256:51027a4cc4d30e197e3506daf3a4fa2d2a0bc2826469f8a87848dfd279e031c0
+  cert_manager_webhook: quay.io/jetstack/cert-manager-webhook:v1.7.1@sha256:a926d60b6f23553ca5d11ac9cd66bcc692136e838613c8bc0d60c6c35a3cbcfc
   cilium_node: quay.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314
   cilium_operator: quay.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910
   cinder_api: quay.io/vexxhost/cinder:zed@sha256:39f8d16322fc84a8e9a3084cb35e85450451a33583e121e8a73e38373eb6d582
@@ -33,19 +33,19 @@
   cinder_storage_init: quay.io/vexxhost/cinder:zed@sha256:39f8d16322fc84a8e9a3084cb35e85450451a33583e121e8a73e38373eb6d582
   cinder_volume_usage_audit: quay.io/vexxhost/cinder:zed@sha256:39f8d16322fc84a8e9a3084cb35e85450451a33583e121e8a73e38373eb6d582
   cinder_volume: quay.io/vexxhost/cinder:zed@sha256:39f8d16322fc84a8e9a3084cb35e85450451a33583e121e8a73e38373eb6d582
-  cluster_api_controller: registry.k8s.io/cluster-api/cluster-api-controller:v1.5.1
-  cluster_api_kubeadm_bootstrap_controller: registry.k8s.io/cluster-api/kubeadm-bootstrap-controller:v1.5.1
-  cluster_api_kubeadm_control_plane_controller: registry.k8s.io/cluster-api/kubeadm-control-plane-controller:v1.5.1
-  cluster_api_openstack_controller: ghcr.io/vexxhost/atmosphere/cluster-api-provider-openstack:v0.8.0-1
-  csi_node_driver_registrar: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.4.0
-  csi_rbd_attacher: registry.k8s.io/sig-storage/csi-attacher:v3.4.0
-  csi_rbd_plugin: quay.io/cephcsi/cephcsi:v3.5.1
-  csi_rbd_provisioner: registry.k8s.io/sig-storage/csi-provisioner:v3.1.0
-  csi_rbd_resizer: registry.k8s.io/sig-storage/csi-resizer:v1.3.0
-  csi_rbd_snapshotter: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.0
+  cluster_api_controller: registry.k8s.io/cluster-api/cluster-api-controller:v1.5.1@sha256:5210087161fdc09c98e47f847c07ed3ff93470e774cb1d5a792e2f76eaa5cf12
+  cluster_api_kubeadm_bootstrap_controller: registry.k8s.io/cluster-api/kubeadm-bootstrap-controller:v1.5.1@sha256:6d73f991862d0df9724fab31a4a694681d9181e772c265d2c5b9b0b26b572479
+  cluster_api_kubeadm_control_plane_controller: registry.k8s.io/cluster-api/kubeadm-control-plane-controller:v1.5.1@sha256:8d926bcd3e0ca6be6cb9212f692f0ea6790f83862f4dc02fae0c7e0b35e76907
+  cluster_api_openstack_controller: ghcr.io/vexxhost/atmosphere/cluster-api-provider-openstack:v0.8.0-1@sha256:1d0edaf4a1c3b3663ddf6efd4629cf5ee3075066ba406e0cfa1a068ea9268c56
+  csi_node_driver_registrar: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.4.0@sha256:0174bf20d7ad8e9f131a045802ef1c43b4592a2ebc18ba07972b1ce8858d9cb7
+  csi_rbd_attacher: registry.k8s.io/sig-storage/csi-attacher:v3.4.0@sha256:adc2922c98c539f680c02af99042d968114746f973a49b529785d6b402134bbf
+  csi_rbd_plugin: quay.io/cephcsi/cephcsi:v3.5.1@sha256:28a674af1df2325fea415e32a7f93f083fce1f9c474912c45f025427fdc0aa10
+  csi_rbd_provisioner: registry.k8s.io/sig-storage/csi-provisioner:v3.1.0@sha256:92107bb668a9de58a09247596c337bc5b46a1d145685eb55ef489ae16952f5bd
+  csi_rbd_resizer: registry.k8s.io/sig-storage/csi-resizer:v1.3.0@sha256:35ec0c736ec8266bd4a46f9e942315f148f3139beed99879d0ad8b8e5074d641
+  csi_rbd_snapshotter: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.0@sha256:bd7dafbd0d4fe81f23f01c9a7432de067bdf085f70d61492f5ffddd9c5264358
   db_drop: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   db_init: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
-  dep_check: quay.io/vexxhost/kubernetes-entrypoint:latest
+  dep_check: quay.io/vexxhost/kubernetes-entrypoint:latest@sha256:ad430737657f9e10ae5ac5708cd7f94dcec6630cfbdd158520b99b7285e253da
   designate_api: quay.io/vexxhost/designate:zed@sha256:d65b4d717f81172c63b87bdf85a5db86aedd450f3510b2685ae384c2b114acc8
   designate_central: quay.io/vexxhost/designate:zed@sha256:d65b4d717f81172c63b87bdf85a5db86aedd450f3510b2685ae384c2b114acc8
   designate_db_sync: quay.io/vexxhost/designate:zed@sha256:d65b4d717f81172c63b87bdf85a5db86aedd450f3510b2685ae384c2b114acc8
@@ -58,9 +58,9 @@
   glance_metadefs_load: quay.io/vexxhost/glance:zed@sha256:13024c9989fc27a63d17e467ca96ea6ec62fc34abaaccdfe05dd0445f10e0445
   glance_registry: quay.io/vexxhost/glance:zed@sha256:13024c9989fc27a63d17e467ca96ea6ec62fc34abaaccdfe05dd0445f10e0445
   glance_storage_init: quay.io/vexxhost/glance:zed@sha256:13024c9989fc27a63d17e467ca96ea6ec62fc34abaaccdfe05dd0445f10e0445
-  grafana_sidecar: quay.io/kiwigrid/k8s-sidecar:1.24.6
-  grafana: docker.io/grafana/grafana:10.1.0
-  haproxy: docker.io/library/haproxy:2.5
+  grafana_sidecar: quay.io/kiwigrid/k8s-sidecar:1.24.6@sha256:3b70b9f1a81e67c97e4cd32c9a918fa44fd2c9f66bdd0d28d8b82d7b502cb5e4
+  grafana: docker.io/grafana/grafana:10.1.0@sha256:d04d48ecbe41e513dc934e57ccb4947034cd5005fa17fdf1331a8997e314beda
+  haproxy: docker.io/library/haproxy:2.5@sha256:489dcc4385fd45813f3e9252b2f1f440db5749e4845d560250ce5083cc45eeb0
   heat_api: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   heat_cfn: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   heat_cloudwatch: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
@@ -70,11 +70,11 @@
   heat_purge_deleted: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   horizon_db_sync: quay.io/vexxhost/horizon:2023.2@sha256:627d62e5b1675b9c129347da59916836aa7d34c02cff9f066944b687993aea1b
   horizon: quay.io/vexxhost/horizon:2023.2@sha256:627d62e5b1675b9c129347da59916836aa7d34c02cff9f066944b687993aea1b
-  ingress_nginx_controller: registry.k8s.io/ingress-nginx/controller:v1.1.1@sha256:0bc88eb15f9e7f84e8e56c14fa5735aaa488b840983f87bd79b1054190e660de
-  ingress_nginx_default_backend: registry.k8s.io/defaultbackend-amd64:1.5
-  ingress_nginx_kube_webhook_certgen: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660 # noqa: yaml[line-length]
-  keepalived: us-docker.pkg.dev/vexxhost-infra/openstack/keepalived:2.0.19
-  keycloak: quay.io/keycloak/keycloak:22.0.1-0
+  ingress_nginx_controller: registry.k8s.io/ingress-nginx/controller:v1.1.1@sha256:e16123f3932f44a2bba8bc3cf1c109cea4495ee271d6d16ab99228b58766d3ab
+  ingress_nginx_default_backend: registry.k8s.io/defaultbackend-amd64:1.5@sha256:4dc5e07c8ca4e23bddb3153737d7b8c556e5fb2f29c4558b7cd6e6df99c512c7
+  ingress_nginx_kube_webhook_certgen: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:23a03c9c381fba54043d0f6148efeaf4c1ca2ed176e43455178b5c5ebf15ad70 # noqa: yaml[line-length]
+  keepalived: us-docker.pkg.dev/vexxhost-infra/openstack/keepalived:2.0.19@sha256:4fe20cd5c200e301e1a790c9aca8c3fc651c8461afea9d37c56a462d3bfa48bb
+  keycloak: quay.io/keycloak/keycloak:22.0.1-0@sha256:5b872e841ea9e394d89bdf250146434532d9c2001404540d46621d60f87494e7
   keystone_api: quay.io/vexxhost/keystone:zed@sha256:408b84f8e1bb237dfe8b84d52b5d77fd1c307b2538e77d7e2ab69ecb74385886
   keystone_credential_cleanup: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   keystone_credential_rotate: quay.io/vexxhost/keystone:zed@sha256:408b84f8e1bb237dfe8b84d52b5d77fd1c307b2538e77d7e2ab69ecb74385886
@@ -86,20 +86,20 @@
   ks_endpoints: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   ks_service: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   ks_user: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
-  kube_apiserver: registry.k8s.io/kube-apiserver:v1.22.17
-  kube_controller_manager: registry.k8s.io/kube-controller-manager:v1.22.17
-  kube_coredns: registry.k8s.io/coredns/coredns:v1.8.4
-  kube_etcd: registry.k8s.io/etcd:3.5.6-0
-  kube_proxy: registry.k8s.io/kube-proxy:v1.22.17
-  kube_scheduler: registry.k8s.io/kube-scheduler:v1.22.17
-  kube_state_metrics: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.9.2
-  kubectl: docker.io/bitnami/kubectl:1.27.3
+  kube_apiserver: registry.k8s.io/kube-apiserver:v1.22.17@sha256:d88d1c8f972e10ff4b4176f3185434e2832d3805c457fa9e8816f1da2fdf3b93
+  kube_controller_manager: registry.k8s.io/kube-controller-manager:v1.22.17@sha256:c3e041c8c8c9ffd33d421c8c1de1f42da52b616bfcf61880498e9efc9ec88005
+  kube_coredns: registry.k8s.io/coredns/coredns:v1.8.4@sha256:10683d82b024a58cc248c468c2632f9d1b260500f7cd9bb8e73f751048d7d6d4
+  kube_etcd: registry.k8s.io/etcd:3.5.6-0@sha256:b0fdb657c0bd10d8c96ed2ce762842384709a9fc54d532220d5252f1f99b4d1d
+  kube_proxy: registry.k8s.io/kube-proxy:v1.22.17@sha256:614ec43f14e16e077173afa61ee355f8a5d1cc5b1c5e8030766781dc5ccde171
+  kube_scheduler: registry.k8s.io/kube-scheduler:v1.22.17@sha256:f85dda445b7c8da197b8e39b0ca2b125b1e97a4a365d45c04d2759aefe935974
+  kube_state_metrics: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.9.2@sha256:c30cae7072ffb03f3e7934516db89b3be6c9e5521c0d04d5bbc6e115c9bfa3a7
+  kubectl: docker.io/bitnami/kubectl:1.27.3@sha256:876cebc2d9272d9eb42c2128c9a08c7e7715dbfe4f2eb2f0b3612df977fdd6b7
   libvirt: quay.io/vexxhost/libvirtd:zed@sha256:480d8736954cdc01c1d6f0c625ba147935ce4e5af25828f6d3fbcd18e6dc283a
-  libvirt_exporter: docker.io/vexxhost/libvirtd-exporter:latest
-  local_path_provisioner_helper: docker.io/library/busybox:1.36.0
-  local_path_provisioner: docker.io/rancher/local-path-provisioner:v0.0.24
-  loki_gateway: docker.io/nginxinc/nginx-unprivileged:1.19-alpine
-  loki: docker.io/grafana/loki:2.7.3
+  libvirt_exporter: docker.io/vexxhost/libvirtd-exporter:latest@sha256:1a0fdf89f80060bfdbb8cf45213295c5d9fb1f7ea7dbfe2b331f0649cc98df8e
+  local_path_provisioner_helper: docker.io/library/busybox:1.36.0@sha256:086417a48026173aaadca4ce43a1e4b385e8e62cc738ba79fc6637049674cac0
+  local_path_provisioner: docker.io/rancher/local-path-provisioner:v0.0.24@sha256:b7dea5221f06f6feed7788db0ad6b024a433c8f55533bd6cc792dc2079ff9ad2
+  loki_gateway: docker.io/nginxinc/nginx-unprivileged:1.19-alpine@sha256:bbd46452aae30a7cc7bc438f267af812c7a2b0f3b5bcd4cc55eb99669cea3f28
+  loki: docker.io/grafana/loki:2.7.3@sha256:8e3abbd89173066721fa07bddfee1c1a7a8fe59bed5b00a2fa09d2b3cef8758c
   magnum_api: quay.io/vexxhost/magnum-cluster-api:zed@sha256:6bfe28acf3648a2415658f2ea1e82ad5e08f66bc3620abd592e70e6aaebc0f73
   magnum_cluster_api_proxy: quay.io/vexxhost/magnum-cluster-api:zed@sha256:6bfe28acf3648a2415658f2ea1e82ad5e08f66bc3620abd592e70e6aaebc0f73
   magnum_conductor: quay.io/vexxhost/magnum-cluster-api:zed@sha256:6bfe28acf3648a2415658f2ea1e82ad5e08f66bc3620abd592e70e6aaebc0f73
@@ -110,11 +110,11 @@
   manila_db_sync: quay.io/vexxhost/manila:zed@sha256:59c3bc27b6cf0740a4c87cbbd23b883bf7fa536659ac90f5aa765ad931e53e9e
   manila_scheduler: quay.io/vexxhost/manila:zed@sha256:59c3bc27b6cf0740a4c87cbbd23b883bf7fa536659ac90f5aa765ad931e53e9e
   manila_share: quay.io/vexxhost/manila:zed@sha256:59c3bc27b6cf0740a4c87cbbd23b883bf7fa536659ac90f5aa765ad931e53e9e
-  memcached: docker.io/library/memcached:1.6.17
-  netoffload: ghcr.io/vexxhost/netoffload:v1.0.1
+  memcached: docker.io/library/memcached:1.6.17@sha256:db45886d2d48f143be64f2d46407e224b0b61df3b0056b9d5b03e8bc6a7cd74e
+  netoffload: ghcr.io/vexxhost/netoffload:v1.0.1@sha256:60f092e5d5f156c2f933c199ea72274f80eb758d3e0dc2f2b1be62174c3f7183
   neutron_bagpipe_bgp: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
   neutron_bgp_dragent: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
-  neutron_coredns: docker.io/coredns/coredns:1.9.3
+  neutron_coredns: docker.io/coredns/coredns:1.9.3@sha256:bdb36ee882c13135669cfc2bb91c808a33926ad1a411fee07bd2dc344bb8f782
   neutron_db_sync: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
   neutron_dhcp: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
   neutron_ironic_agent: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
@@ -128,13 +128,13 @@
   neutron_server: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
   neutron_sriov_agent_init: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
   neutron_sriov_agent: quay.io/vexxhost/neutron:zed@sha256:4eec4493d3026abe2847d4c9efde292e4bb703bd04a1b4dc789cb008a3de68a9
-  node_feature_discovery: registry.k8s.io/nfd/node-feature-discovery:v0.11.2
+  node_feature_discovery: registry.k8s.io/nfd/node-feature-discovery:v0.11.2@sha256:24b2abfb5956b6a2a9a0f4248232838d02235d65044078c43d8bdcf29344f141
   nova_api: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_archive_deleted_rows: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_cell_setup_init: quay.io/vexxhost/heat:zed@sha256:2413e1d669a899685d0cc89c3333222ad004c567be0d5ca605dcc6a59c12af64
   nova_cell_setup: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
-  nova_compute_ironic: quay.io/openstack.kolla/nova-compute-ironic:zed-ubuntu-jammy
-  nova_compute_ssh: quay.io/vexxhost/nova-ssh:latest
+  nova_compute_ironic: quay.io/openstack.kolla/nova-compute-ironic:zed-ubuntu-jammy@sha256:01c6730107e7eaa40b85b91ca47ca43912703977a02ba4dc784b18b985740a87
+  nova_compute_ssh: quay.io/vexxhost/nova-ssh:latest@sha256:70e2bfc6dc60c8901deb039e82b842eea4894a8e1f662e1fe7df80c46a6366e4
   nova_compute: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_conductor: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_consoleauth: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
@@ -143,7 +143,7 @@
   nova_novncproxy: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_placement: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_scheduler: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
-  nova_service_cleaner: quay.io/vexxhost/cli:latest
+  nova_service_cleaner: quay.io/vexxhost/cli:latest@sha256:d4c46e58abe61576658cb9b362c9d2f8775dba17a9ad062da8a5b9a12402ffd4
   nova_spiceproxy_assets: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   nova_spiceproxy: quay.io/vexxhost/nova:zed@sha256:b9299a89cfe97b692038ca569258df753d1bdf8540dadb0766afbfb1ca871e24
   octavia_api: quay.io/vexxhost/octavia:zed@sha256:7f054aca88ea461e9ccc32d994936d76c32add09aeca35912cf9dd6da61ccd10
@@ -152,47 +152,47 @@
   octavia_health_manager: quay.io/vexxhost/octavia:zed@sha256:7f054aca88ea461e9ccc32d994936d76c32add09aeca35912cf9dd6da61ccd10
   octavia_housekeeping: quay.io/vexxhost/octavia:zed@sha256:7f054aca88ea461e9ccc32d994936d76c32add09aeca35912cf9dd6da61ccd10
   octavia_worker: quay.io/vexxhost/octavia:zed@sha256:7f054aca88ea461e9ccc32d994936d76c32add09aeca35912cf9dd6da61ccd10
-  openvswitch_db_server: quay.io/vexxhost/openvswitch:3.1.0-55atmosphere1
-  openvswitch_vswitchd: quay.io/vexxhost/openvswitch:3.1.0-55atmosphere1
-  ovn_controller: quay.io/vexxhost/ovn-host:23.03.0
-  ovn_northd: quay.io/vexxhost/ovn-central:23.03.0
-  ovn_ovsdb_nb: quay.io/vexxhost/ovn-central:23.03.0
-  ovn_ovsdb_sb: quay.io/vexxhost/ovn-central:23.03.0
-  pause: registry.k8s.io/pause:3.8
-  percona_xtradb_cluster_haproxy: docker.io/percona/percona-xtradb-cluster-operator:1.13.0-haproxy
-  percona_xtradb_cluster_operator: docker.io/percona/percona-xtradb-cluster-operator:1.13.0
-  percona_xtradb_cluster: docker.io/percona/percona-xtradb-cluster:8.0.32-24.2
-  percona_version_service: docker.io/perconalab/version-service:main-3325140
+  openvswitch_db_server: quay.io/vexxhost/openvswitch:3.1.0-55atmosphere1@sha256:b56cbb97d9216fdc14e4ce223c1a511c624f92eb463672620e86906c2f866bd9
+  openvswitch_vswitchd: quay.io/vexxhost/openvswitch:3.1.0-55atmosphere1@sha256:b56cbb97d9216fdc14e4ce223c1a511c624f92eb463672620e86906c2f866bd9
+  ovn_controller: quay.io/vexxhost/ovn-host:23.03.0@sha256:aa0e91ff1d7224e3aa7ae0e8b7b770410f9abdb15b7421cf060d3c231fbe23e5
+  ovn_northd: quay.io/vexxhost/ovn-central:23.03.0@sha256:2061a2b8a5128c7c01cc005a15122ec0c1a83a270a23e2cf74f71ac46b9d103e
+  ovn_ovsdb_nb: quay.io/vexxhost/ovn-central:23.03.0@sha256:2061a2b8a5128c7c01cc005a15122ec0c1a83a270a23e2cf74f71ac46b9d103e
+  ovn_ovsdb_sb: quay.io/vexxhost/ovn-central:23.03.0@sha256:2061a2b8a5128c7c01cc005a15122ec0c1a83a270a23e2cf74f71ac46b9d103e
+  pause: registry.k8s.io/pause:3.8@sha256:f5944f2d1daf66463768a1503d0c8c5e8dde7c1674d3f85abc70cef9c7e32e95
+  percona_xtradb_cluster_haproxy: docker.io/percona/percona-xtradb-cluster-operator:1.13.0-haproxy@sha256:f04e4fea548bfc7cb0bfc73c75c7f2c64d299cf04125a07a8101a55f0f734fed
+  percona_xtradb_cluster_operator: docker.io/percona/percona-xtradb-cluster-operator:1.13.0@sha256:c674d63242f1af521edfbaffae2ae02fb8d010c0557a67a9c42d2b4a50db5243
+  percona_xtradb_cluster: docker.io/percona/percona-xtradb-cluster:8.0.32-24.2@sha256:1f978ab8912e1b5fc66570529cb7e7a4ec6a38adbfce1ece78159b0fcfa7d47a
+  percona_version_service: docker.io/perconalab/version-service:main-3325140@sha256:b7928130fca1e35ce7feaeec326fef836229a8b4de2f6f6ea5b6d2c7a48cd071
   placement_db_sync: quay.io/vexxhost/placement:zed@sha256:ae9a7567e3619440b3a7a58b5ab407c5efad372627c06fb0ab0193a85c9d1c70
   placement: quay.io/vexxhost/placement:zed@sha256:ae9a7567e3619440b3a7a58b5ab407c5efad372627c06fb0ab0193a85c9d1c70
-  prometheus_config_reloader: quay.io/prometheus-operator/prometheus-config-reloader:v0.67.1
-  prometheus_ipmi_exporter: us-docker.pkg.dev/vexxhost-infra/openstack/ipmi-exporter:1.4.0
-  prometheus_memcached_exporter: quay.io/prometheus/memcached-exporter:v0.10.0
-  prometheus_mysqld_exporter: quay.io/prometheus/mysqld-exporter:v0.14.0
-  prometheus_node_exporter: quay.io/prometheus/node-exporter:v1.6.1
-  prometheus_openstack_exporter: ghcr.io/openstack-exporter/openstack-exporter:1.6.0
-  prometheus_operator_kube_webhook_certgen: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6
-  prometheus_operator: quay.io/prometheus-operator/prometheus-operator:v0.67.1
-  prometheus_pushgateway: docker.io/prom/pushgateway:v1.4.2
-  prometheus: quay.io/prometheus/prometheus:v2.46.0
-  rabbit_init: docker.io/library/rabbitmq:3.10.2-management
-  rabbitmq_cluster_operator: docker.io/rabbitmqoperator/cluster-operator:1.13.1
-  rabbitmq_credential_updater: docker.io/rabbitmqoperator/default-user-credential-updater:1.0.2
-  rabbitmq_server: docker.io/library/rabbitmq:3.10.2-management
-  rabbitmq_topology_operator: docker.io/rabbitmqoperator/messaging-topology-operator:1.6.0
-  rook_ceph: docker.io/rook/ceph:v1.10.10
+  prometheus_config_reloader: quay.io/prometheus-operator/prometheus-config-reloader:v0.67.1@sha256:0fe3cf36985e0e524801a0393f88fa4b5dd5ffdf0f091ff78ee02f2d281631b5
+  prometheus_ipmi_exporter: us-docker.pkg.dev/vexxhost-infra/openstack/ipmi-exporter:1.4.0@sha256:4898da9cc11961a56363e8b3f3437d0f45b46585b20c79e33e97fbe7232e05d2
+  prometheus_memcached_exporter: quay.io/prometheus/memcached-exporter:v0.10.0@sha256:fa5a2de1a4744da66fb369bee81232f5ea52208bc643e409a60f66d699ac27b2
+  prometheus_mysqld_exporter: quay.io/prometheus/mysqld-exporter:v0.14.0@sha256:eb6fe170738bf9181c51f5bc89f93adb26672ec49ffdcb22f55c24834003b45d
+  prometheus_node_exporter: quay.io/prometheus/node-exporter:v1.6.1@sha256:81f94e50ea37a88dfee849d0f4acad25b96b397061f59e5095905f6bc5829637
+  prometheus_openstack_exporter: ghcr.io/openstack-exporter/openstack-exporter:1.6.0@sha256:bae162b4ad50c7662b03547f27b072303268218af1fc8d9745001357f912937d
+  prometheus_operator_kube_webhook_certgen: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6@sha256:5e6fdb9b2c74ad2576dd835b389d00d18ccfee21b547d1a79efb881009664099
+  prometheus_operator: quay.io/prometheus-operator/prometheus-operator:v0.67.1@sha256:e68bff5dd72a5d1be98ec66ef1383a7d7a338f3ffbef8603d551f70dafc8d978
+  prometheus_pushgateway: docker.io/prom/pushgateway:v1.4.2@sha256:f74ff5b7ad0b8fb60c24b77eaeab025d659e46ec15f32430adb976544305c01f
+  prometheus: quay.io/prometheus/prometheus:v2.46.0@sha256:d6ead9daf2355b9923479e24d7e93f246253ee6a5eb18a61b0f607219f341a80
+  rabbit_init: docker.io/library/rabbitmq:3.10.2-management@sha256:350ab6d773e3af45183466488fe3259df36cd6ade437b4366a59e8052458cc3a
+  rabbitmq_cluster_operator: docker.io/rabbitmqoperator/cluster-operator:1.13.1@sha256:84ce21e9e2d6ceb8b93d9daf0b7cc1550b6ed86be5b3acd8b0816eddc1b87dc2
+  rabbitmq_credential_updater: docker.io/rabbitmqoperator/default-user-credential-updater:1.0.2@sha256:563908dd8d6b6ce768e463a2d9d7a9b9b4adbcd258fed02c0a8746395cfa3f0d
+  rabbitmq_server: docker.io/library/rabbitmq:3.10.2-management@sha256:350ab6d773e3af45183466488fe3259df36cd6ade437b4366a59e8052458cc3a
+  rabbitmq_topology_operator: docker.io/rabbitmqoperator/messaging-topology-operator:1.6.0@sha256:5052e8bdb26996c62315f0707c6fb291fd84492e360cca7351e2c3fdf659be43
+  rook_ceph: docker.io/rook/ceph:v1.10.10@sha256:2a65f6678c3f4e368046ee10695dce2c265cc81cd6bfd6258fc670dd18fbad5b
   senlin_api: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
   senlin_conductor: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
   senlin_db_sync: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
   senlin_engine_cleaner: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
   senlin_engine: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
   senlin_health_manager: quay.io/vexxhost/senlin:zed@sha256:5cb3108dfdeb02a8d910aa2666d8865c772774e431ceaf69391959d87e2b0674
-  skopeo: quay.io/skopeo/stable:latest
-  staffeln_db_sync: ghcr.io/vexxhost/staffeln:v2.2.3
-  staffeln_conductor: ghcr.io/vexxhost/staffeln:v2.2.3
-  staffeln_api: ghcr.io/vexxhost/staffeln:v2.2.3
-  tempest_run_tests: us-docker.pkg.dev/vexxhost-infra/openstack/tempest:30.1.0-4
-  vector: docker.io/timberio/vector:0.27.0-debian
+  skopeo: quay.io/skopeo/stable:latest@sha256:7bfd9719a3b5dbf059d148bc89305800f6128595e3e54263fc9bf8e30f3d109a
+  staffeln_db_sync: ghcr.io/vexxhost/staffeln:v2.2.3@sha256:ee3d8ab2c17d21b4a64a48abfb089df98700b6bc7cee5db36b5ef9c357317736
+  staffeln_conductor: ghcr.io/vexxhost/staffeln:v2.2.3@sha256:ee3d8ab2c17d21b4a64a48abfb089df98700b6bc7cee5db36b5ef9c357317736
+  staffeln_api: ghcr.io/vexxhost/staffeln:v2.2.3@sha256:ee3d8ab2c17d21b4a64a48abfb089df98700b6bc7cee5db36b5ef9c357317736
+  tempest_run_tests: us-docker.pkg.dev/vexxhost-infra/openstack/tempest:30.1.0-4@sha256:330c5291bb6a52261b5842e8e3a0447cc6cfeae233cd6fa214464197340bb1a5
+  vector: docker.io/timberio/vector:0.27.0-debian@sha256:29f23dab76fa306b67b10eac3e9decdb01c906f8aa3b00a2f5b2e8ae088b84e0
 
 atmosphere_images: '{{ _atmosphere_images | combine(atmosphere_image_overrides, recursive=True)
   }}'