diff --git a/.taskfiles/VolSync/templates/list.tmpl.yaml b/.taskfiles/VolSync/templates/list.tmpl.yaml
index 34daff21b..3d2798013 100644
--- a/.taskfiles/VolSync/templates/list.tmpl.yaml
+++ b/.taskfiles/VolSync/templates/list.tmpl.yaml
@@ -12,7 +12,7 @@ spec:
       restartPolicy: OnFailure
       containers:
         - name: list
-          image: docker.io/restic/restic:0.16.3
+          image: docker.io/restic/restic:0.16.4@sha256:dad38b8042cfb1a759a958ed0061b888ebd05b1e780125a1fb4e2d687c6c0556
           args: ["snapshots"]
           envFrom:
             - secretRef:
diff --git a/.taskfiles/VolSync/templates/unlock.tmpl.yaml b/.taskfiles/VolSync/templates/unlock.tmpl.yaml
index 5a09679c6..b840b08e7 100644
--- a/.taskfiles/VolSync/templates/unlock.tmpl.yaml
+++ b/.taskfiles/VolSync/templates/unlock.tmpl.yaml
@@ -12,13 +12,13 @@ spec:
       restartPolicy: OnFailure
       containers:
         - name: unlock-minio
-          image: docker.io/restic/restic:0.16.3
+          image: docker.io/restic/restic:0.16.4@sha256:dad38b8042cfb1a759a958ed0061b888ebd05b1e780125a1fb4e2d687c6c0556
           args: ["unlock", "--remove-all"]
           envFrom:
             - secretRef:
                 name: "${app}-volsync-secret"
         - name: unlock-r2
-          image: docker.io/restic/restic:0.16.3
+          image: docker.io/restic/restic:0.16.4@sha256:dad38b8042cfb1a759a958ed0061b888ebd05b1e780125a1fb4e2d687c6c0556
           args: ["unlock", "--remove-all"]
           envFrom:
             - secretRef: