diff --git a/apps/sample-app/overlays/dev/kustomization.yaml b/apps/sample-app/overlays/dev/kustomization.yaml
index 593b211..a07e35b 100644
--- a/apps/sample-app/overlays/dev/kustomization.yaml
+++ b/apps/sample-app/overlays/dev/kustomization.yaml
@@ -15,5 +15,9 @@ patches:
         path: /spec/template/spec/containers/0/env/0/value
         value: dev
 images:
+  # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod).
+  # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only
+  # thing that should change this value, via `kustomize edit set image`.
+  # Placeholder below until the first successful CI run pins a real digest.
   - name: ghcr.io/david-uka/sample-app
-    newTag: dev
+    newTag: sha-0000000
diff --git a/apps/sample-app/overlays/prod/kustomization.yaml b/apps/sample-app/overlays/prod/kustomization.yaml
index f57279f..2ea4222 100644
--- a/apps/sample-app/overlays/prod/kustomization.yaml
+++ b/apps/sample-app/overlays/prod/kustomization.yaml
@@ -21,5 +21,9 @@ patches:
         path: /spec/template/spec/containers/0/resources/limits/memory
         value: 256Mi
 images:
+  # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod).
+  # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only
+  # thing that should change this value, via `kustomize edit set image`.
+  # Placeholder below until the first successful CI run pins a real digest.
   - name: ghcr.io/david-uka/sample-app
-    newTag: prod
+    newTag: sha-0000000
diff --git a/apps/sample-app/overlays/staging/kustomization.yaml b/apps/sample-app/overlays/staging/kustomization.yaml
index b055238..a9d8d21 100644
--- a/apps/sample-app/overlays/staging/kustomization.yaml
+++ b/apps/sample-app/overlays/staging/kustomization.yaml
@@ -15,5 +15,9 @@ patches:
         path: /spec/template/spec/containers/0/env/0/value
         value: staging
 images:
+  # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod).
+  # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only
+  # thing that should change this value, via `kustomize edit set image`.
+  # Placeholder below until the first successful CI run pins a real digest.
   - name: ghcr.io/david-uka/sample-app
-    newTag: staging
+    newTag: sha-0000000