@@ -21,11 +21,11 @@ jobs:
   actionlint:
     name: 🧹 Actionlint
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # The pinned release binary, checked against the SHA-256 the release
       # publishes, instead of compiling actionlint@latest with Go on every run.
       # Update ACTIONLINT_SHA256 together with ACTIONLINT_VERSION (from the
 
@@ -31,7 +31,7 @@ jobs:
   go:
     name: 🧪 Go CI (fmt, vet, lint, build, test)
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     services:
       postgres:
@@ -50,10 +50,10 @@ jobs:
       MANAGER_TEST_DATABASE_URL: postgres://postgres:test@localhost:5432/postgres?sslmode=disable
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: 🐹 Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
@@ -32,29 +32,29 @@ jobs:
   image:
     name: 🐳 Image CI (build, run read-only, health)
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
       IMAGE: manager:ci
       NET: fleet-ci
     steps:
       - name: 📥 Checkout manager
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: manager
 
       - name: 📥 Checkout web
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: CryptOS-PKI/cryptos-web
           ref: ${{ vars.WEB_RELEASE_REF || 'main' }}
           path: web
 
       - name: 🛠️ Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       - name: 🏗️ Build (not pushed)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: manager/Dockerfile
 
@@ -25,7 +25,7 @@ jobs:
   dco:
     name: ✍️ DCO sign-off
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: ✍️ Check every commit is signed off by its author
 
@@ -20,17 +20,17 @@ jobs:
   golic:
     name: 🔏 License headers
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version: 'stable'
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52  # v3.0.0
         with:
           version: 3.x
           # setup-task reads its token from this input, not env. Without it
 
@@ -42,7 +42,7 @@ jobs:
       github.event.pull_request.draft == false &&
       github.event.action != 'labeled' && github.event.action != 'unlabeled' &&
       github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       # Map the conventional-commit prefix in the PR title to a categorizing
@@ -80,7 +80,7 @@ jobs:
     # Run even if autolabel was skipped/failed; the label may already be present
     # from the PR title or a maintainer. Drafts are still skipped.
     if: always() && github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       pull-requests: read
 
@@ -13,11 +13,11 @@ permissions:
 jobs:
   labeler:
     name: 🏷️ Sync labels
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-github-labeler@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d  # v6.0.0
         with:
           yaml-file: .github/labels.yml
           skip-delete: false
 
@@ -22,14 +22,14 @@ jobs:
   go:
     name: ⚖️ Dependency licenses (Go)
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: 'stable'
 
 
@@ -40,11 +40,11 @@ jobs:
   checks:
     name: ✅ PR Checks
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: 📝 PR Title
-        uses: amannn/action-semantic-pull-request@v5
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50  # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -72,7 +72,7 @@ jobs:
       - name: Checkout
         id: checkout
         if: ${{ !cancelled() }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           # Full history: hygiene diffs base..head and gitleaks scans the PR's
           # commits, base..head.
 
@@ -1,21 +1,28 @@
 name: "🚀 Release image"
 
+# Releases are source only: a v* tag proves the manager image builds from the
+# pinned web ref and passes the read-only health check. Nothing is pushed —
+# no registry login, no image or chart publish, no `latest`. Adopters build
+# and push their own image (see README.md#-deploying).
+
 on:
   push:
     tags:
       - "v*"
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   image:
-    name: "Build and push the manager image"
-    runs-on: ubuntu-latest
+    name: "Build the manager image and prove it boots"
+    runs-on: ubuntu-24.04
     # The image build compiles the web UI and the Go binary; the gha layer
     # cache keeps repeat builds well under this.
     timeout-minutes: 45
+    env:
+      IMAGE: manager:release-check
+      NET: fleet-release-check
     steps:
       # A tagged image has to be rebuildable from the tag. Falling back to
       # web's main would embed whatever web happened to be at build time, so
@@ -31,12 +38,12 @@ jobs:
           echo "web ref: $WEB_RELEASE_REF"
 
       - name: Checkout manager
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: manager
 
       - name: Checkout web (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: CryptOS-PKI/cryptos-web
           ref: ${{ vars.WEB_RELEASE_REF }}
@@ -56,61 +63,84 @@ jobs:
           echo "date=$(date -u -d "@$epoch" +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Image metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/cryptos-pki/cryptos-manager
-          tags: |
-            type=semver,pattern={{version}}
-            type=raw,value=latest
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Build (not pushed)
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         env:
           SOURCE_DATE_EPOCH: ${{ steps.build.outputs.epoch }}
         with:
           context: .
           file: manager/Dockerfile
-          push: true
+          push: false
+          load: true
+          tags: ${{ env.IMAGE }}
           build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
+            VERSION=${{ github.ref_name }}
             COMMIT=${{ github.sha }}
             BUILD_DATE=${{ steps.build.outputs.date }}
             WEB_REF=${{ steps.build.outputs.web_sha }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  chart:
-    name: "Package and push the Helm chart"
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Image runs as nonroot with a health check
+        run: |
+          set -euo pipefail
+          user="$(docker image inspect -f '{{.Config.User}}' "$IMAGE")"
+          echo "user=$user"
+          [ "$user" = "65532:65532" ]
+          docker image inspect -f '{{json .Config.Healthcheck}}' "$IMAGE" | tee /dev/stderr | grep -q -- '-healthcheck'
 
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
+      - name: Start Postgres
+        run: |
+          set -euo pipefail
+          docker network create "$NET"
+          docker run -d --name pg --network "$NET" \
+            -e POSTGRES_DB=manager -e POSTGRES_USER=manager -e POSTGRES_PASSWORD=release \
+            postgres:18-alpine
+          for _ in $(seq 1 30); do
+            docker exec pg pg_isready -U manager -d manager && exit 0
+            sleep 2
+          done
+          exit 1
 
-      - name: Log in to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
+      # No tlsCert/tlsKey or operator CA: the manager serves its self-signed
+      # bootstrap certificate, which is enough to exercise the TLS listener the
+      # health probe talks to.
+      - name: Run the image read-only
+        run: |
+          set -euo pipefail
+          cfg="$RUNNER_TEMP/fleet"
+          mkdir -p "$cfg"
+          cat > "$cfg/config.yaml" <<'EOF'
+          listen: "0.0.0.0:8443"
+          httpRedirectListen: ""
+          database_url: "postgres://manager:release@pg:5432/manager?sslmode=disable"
+          nodes: []
+          EOF
+          sudo chown -R 65532:65532 "$cfg"
+          docker run -d --name manager --network "$NET" \
+            --read-only --cap-drop ALL --security-opt no-new-privileges:true \
+            --health-interval 2s --health-start-period 5s \
+            -p 8443:8443 \
+            -v "$cfg/config.yaml:/etc/cryptos/fleet/config.yaml:ro" \
+            -v node-creds:/var/lib/cryptos-manager/node-creds \
+            "$IMAGE"
 
-      - name: Package and push
+      - name: Becomes healthy
         run: |
-          version="${GITHUB_REF_NAME#v}"
-          helm package chart/fleet-manager --version "$version" --app-version "$version"
-          helm push "fleet-manager-${version}.tgz" oci://ghcr.io/cryptos-pki/charts
+          set -euo pipefail
+          for _ in $(seq 1 60); do
+            state="$(docker inspect -f '{{.State.Health.Status}}' manager)"
+            echo "health=$state"
+            [ "$state" = healthy ] && break
+            [ "$(docker inspect -f '{{.State.Running}}' manager)" = true ] || break
+            sleep 2
+          done
+          [ "$state" = healthy ]
+          curl -sSk https://127.0.0.1:8443/healthz | tee /dev/stderr | grep -q '"status":"ok"'
+          curl -sSk https://127.0.0.1:8443/version | tee /dev/stderr | grep -q "\"version\":\"${GITHUB_REF_NAME}\""
+
+      - name: Manager log
+        if: ${{ always() }}
+        run: docker logs manager || true