diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15e0e28..e610dea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ versioning for public release policy decisions.
 ## [Unreleased]
 
 <!-- core-ops-release:start -->
+### Changed
+
+- Wire `immich-db-password` Podman secret + `DB_PASSWORD_FILE` env var into `examples/03-immich/services/immich-server/quadlet/immich-server.container`; without these, `immich-server` could never authenticate to the Postgres database started by `immich-database.container` and entered a restart loop with `password authentication failed for user "immich"`.
 <!-- core-ops-release:end -->
 
 ## [2.2.1] - 2026-05-07
diff --git a/Cargo.lock b/Cargo.lock
index 32a352c..3404b3f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,7 +157,7 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "core-ops"
-version = "2.2.1"
+version = "2.2.2"
 dependencies = [
  "clap",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 4342c47..1886bcb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "core-ops"
-version = "2.2.1"
+version = "2.2.2"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 
diff --git a/changes/fix-immich-server-db-password.md b/changes/fix-immich-server-db-password.md
new file mode 100644
index 0000000..1988e84
--- /dev/null
+++ b/changes/fix-immich-server-db-password.md
@@ -0,0 +1,7 @@
+---
+change_id: fix-immich-server-db-password
+release_intent: patch
+summary: Wire `immich-db-password` Podman secret + `DB_PASSWORD_FILE` env var into `examples/03-immich/services/immich-server/quadlet/immich-server.container`; without these, `immich-server` could never authenticate to the Postgres database started by `immich-database.container` and entered a restart loop with `password authentication failed for user "immich"`.
+scope: examples
+release_preparation: false
+---
diff --git a/examples/03-immich/services/immich-server/quadlet/immich-server.container b/examples/03-immich/services/immich-server/quadlet/immich-server.container
index 7dc128b..c9b08d3 100644
--- a/examples/03-immich/services/immich-server/quadlet/immich-server.container
+++ b/examples/03-immich/services/immich-server/quadlet/immich-server.container
@@ -14,8 +14,10 @@ Environment=DB_HOSTNAME=immich-database
 Environment=DB_PORT=5432
 Environment=DB_USERNAME=immich
 Environment=DB_DATABASE_NAME=immich
+Environment=DB_PASSWORD_FILE=/run/secrets/immich-db-password
 Environment=REDIS_HOSTNAME=immich-redis
 Environment=IMMICH_MACHINE_LEARNING_URL=http://immich-ml:3003
+Secret=immich-db-password,target=/run/secrets/immich-db-password
 
 [Service]
 Restart=always
diff --git a/tests/fixtures/provenance_state/valid-success.json b/tests/fixtures/provenance_state/valid-success.json
index e28c547..260358b 100644
--- a/tests/fixtures/provenance_state/valid-success.json
+++ b/tests/fixtures/provenance_state/valid-success.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "controller": {
-    "version": "2.2.1",
+    "version": "2.2.2",
     "revision": "8f3c2ab",
     "build_time": "2026-03-23T10:00:00Z",
     "tree_state": "clean"