diff --git a/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md b/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
index 41cabc6..61349e8 100644
--- a/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
+++ b/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
@@ -32,7 +32,7 @@ mkdir -p -m 700 ~/nk54
 
 1. **Restore drill on the current backup** (NK-WP-0053-T02/T04) has passed. It proves today's backup
    before the change.
-2. **Pin LLDAP to what runs.** Read the running digest (no Secret is read):
+2. **Pin LLDAP to what runs.** Done 2026-10-29: the running digest is v0.6.2 and `deployment.yaml` is pinned. Read the running digest (no Secret is read):
    ```bash
    $K -n sso get pod -l app.kubernetes.io/name=lldap -o jsonpath='{.items[0].status.containerStatuses[0].imageID}'; echo
    ```
diff --git a/sso-mfa/k8s/lldap/deployment.yaml b/sso-mfa/k8s/lldap/deployment.yaml
index b645965..340ba4e 100644
--- a/sso-mfa/k8s/lldap/deployment.yaml
+++ b/sso-mfa/k8s/lldap/deployment.yaml
@@ -43,9 +43,9 @@ spec:
 
       containers:
         - name: lldap
-          # Pin to the running digest before the bind split (NK-WP-0054-T05 runbook); the restore
-          # tools and the rehearsal use v0.6.2 (sha256:9e605a66...). Never pin to an older version.
-          image: lldap/lldap:stable
+          # v0.6.2, the running digest read 2026-10-29 and the version the restore tools and the
+          # NK-WP-0054-T05 rehearsals use. Never pin to an older version.
+          image: docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d
           imagePullPolicy: IfNotPresent
 
           ports: