diff --git a/admin-system/renovate.yaml b/admin-system/renovate.yaml
index e6386bc..687377a 100644
--- a/admin-system/renovate.yaml
+++ b/admin-system/renovate.yaml
@@ -73,6 +73,16 @@ data:
           "datasourceTemplate": "docker",
           "packageNameTemplate": "linuxserver/{{depName}}",
           "versioningTemplate": "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$"
+        },
+        {
+          "description": "umami: the docker image tag is `postgresql-vX.Y.Z` (the PostgreSQL-flavored variant). Default docker versioning rejects the prefix. Same fix as termix/servarr: regex versioning parses the prefixed value; ghcr.io tag list is filtered to the postgresql-v* track only.",
+          "customType": "regex",
+          "managerFilePatterns": ["/felhom-system/umami\\.ya?ml$/"],
+          "matchStrings": [
+            "image:\\s+(?<depName>ghcr\\.io/umami-software/umami):(?<currentValue>postgresql-v\\d+\\.\\d+\\.\\d+)"
+          ],
+          "datasourceTemplate": "docker",
+          "versioningTemplate": "regex:^postgresql-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
         }
       ],
       "packageRules": [
@@ -149,6 +159,12 @@ data:
             "linuxserver/sonarr"
           ],
           "enabled": false
+        },
+        {
+          "description": "umami: same disable pattern. customManager handles extraction; kubernetes-manager would silently skip `postgresql-vX.Y.Z`.",
+          "matchManagers": ["kubernetes"],
+          "matchPackageNames": ["ghcr.io/umami-software/umami"],
+          "enabled": false
         }
       ],
       "labels": ["renovate"]
diff --git a/felhom-system/umami.yaml b/felhom-system/umami.yaml
index 798419f..31fb72b 100644
--- a/felhom-system/umami.yaml
+++ b/felhom-system/umami.yaml
@@ -187,7 +187,7 @@ spec:
               cpu: "50m"
       containers:
         - name: umami
-          image: ghcr.io/umami-software/umami:postgresql-latest
+          image: ghcr.io/umami-software/umami:postgresql-v1.38.0
           ports:
             - containerPort: 3000
           env:
diff --git a/felhom-system/webpage.yaml b/felhom-system/webpage.yaml
index fb37c32..f3bf906 100644
--- a/felhom-system/webpage.yaml
+++ b/felhom-system/webpage.yaml
@@ -100,7 +100,7 @@ spec:
     spec:
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2-alpine
+          image: filebrowser/filebrowser:v2.63.13
           ports:
             - containerPort: 8080
           volumeMounts:
diff --git a/tandoor-system/tandoor.yaml b/tandoor-system/tandoor.yaml
index d7d243d..d55bcf8 100644
--- a/tandoor-system/tandoor.yaml
+++ b/tandoor-system/tandoor.yaml
@@ -30,7 +30,7 @@ spec:
     spec:
       initContainers:
         - name: create-superuser
-          image: vabene1111/recipes:2.6
+          image: vabene1111/recipes:2.6.9
           workingDir: /opt/recipes
           command:
             - /bin/sh
@@ -106,7 +106,7 @@ spec:
                   key: email
       containers:
         - name: tandoor
-          image: vabene1111/recipes:2.6
+          image: vabene1111/recipes:2.6.9
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ