diff --git a/Makefile b/Makefile
index 42ffd33..52d919b 100644
--- a/Makefile
+++ b/Makefile
@@ -278,14 +278,14 @@ check-coulomb-social-image-tag: ## Require an explicit coulomb-social image tag
 coulomb-social-dry-run: check-coulomb-social-image-tag ## helm template render for coulomb-social
 	helm template $(COULOMB_SOCIAL_RELEASE) $(COULOMB_SOCIAL_CHART) \
 	  -f $(COULOMB_SOCIAL_VALUES) \
-	  --set image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
+	  --set-string image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
 	  --namespace $(COULOMB_SOCIAL_NAMESPACE)
 
 coulomb-social-deploy: check-production-kubeconfig check-coulomb-social-image-tag ## Deploy / upgrade coulomb-social
 	kubectl create namespace $(COULOMB_SOCIAL_NAMESPACE) --dry-run=client -o yaml | kubectl apply -f -
 	helm upgrade --install $(COULOMB_SOCIAL_RELEASE) $(COULOMB_SOCIAL_CHART) \
 	  -f $(COULOMB_SOCIAL_VALUES) \
-	  --set image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
+	  --set-string image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
 	  --namespace $(COULOMB_SOCIAL_NAMESPACE) \
 	  --wait --timeout 5m
 
diff --git a/helm/coulomb-social-values.yaml b/helm/coulomb-social-values.yaml
index 70a51eb..975357b 100644
--- a/helm/coulomb-social-values.yaml
+++ b/helm/coulomb-social-values.yaml
@@ -3,7 +3,7 @@
 
 image:
   repository: forgejo.coulomb.social/coulomb/coulomb-social
-  tag: "pending"   # pin to git SHA after first image publish
+  tag: "7067145"
 
 env:
   DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
diff --git a/manifests/coulomb-social-ingress.yaml b/manifests/coulomb-social-ingress.yaml
index 518f4dc..d86e55f 100644
--- a/manifests/coulomb-social-ingress.yaml
+++ b/manifests/coulomb-social-ingress.yaml
@@ -7,7 +7,8 @@ metadata:
   namespace: coulomb-social
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
   tls: