Use the oci prefix with the chart path and add the digest after an at sign, for example oci://registry/charts/mychart@sha256:DIGEST. The Helm docs say installing by digest is more secure than by tag because digests are immutable.
Why digest beats tag
A tag such as 1.2.0 is a label that a registry user with push rights can move. A digest is derived from the content. If the content changes, the digest changes. When you install by digest, the chart you reviewed is the chart you run.
Steps
- Pull the chart you intend to review.
helm pull oci://registry.example.com/charts/mychart --version 1.2.0
- Review it: render with helm template, read the RBAC, hooks and images.
- Record the digest your registry reports for that version. Most registries and tools such as crane or skopeo can show it.
- Install using the digest.
helm install myrelease oci://registry.example.com/charts/mychart@sha256:DIGEST
- Store the digest in version control next to your values, so upgrades are explicit changes.
What about provenance
The Helm registry docs say that if a .prov file sits next to the chart archive, it is uploaded to the registry when you push. They also point to the helm-sigstore plugin as a way to sign charts with the same tools used for container images. The page notes it has not been fully updated for Helm 4, so confirm details for your version.
| Control | What it gives you |
|---|---|
| Pin to a digest | You run exactly the bytes you reviewed |
| Provenance file or signature | Evidence of who published it |
| Template review | Knowledge of what it will do |
Use all three where you can. A digest alone proves sameness, not trust.
Common mistakes
- Pinning the chart but leaving image tags floating inside its values. Pin image digests too.
- Copying a digest from a chat message. Take it from your own pull.
- Forgetting that mirrored copies can have different digests if they were repackaged.
For broader chart hygiene see Helm chart security best practices.
Keeping pinned charts current
Pinning means you must also update on purpose. Add a calendar item or an automated check that compares your pinned digest with the newest chart version, and route the change through the same review as a first install. Diff the rendered output between the two versions, including RBAC, hooks and CRDs, before you bump the digest.
Try it yourself
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an inventory records exact versions, which is the same idea as pinning a chart to one digest.
Quick check
Can I pin a chart digest in a values file?
The digest goes in the install reference, so keep it in your deployment config or GitOps manifest where that reference lives.
Do I still need to scan after pinning?
Yes. Pinning fixes what you run. Scanning tells you what is wrong with it.
Safeguard SBOM and dependency scanning records exact versions, and a free scan is at https://gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
