diff --git a/SPECS.md b/SPECS.md
index 348eef3..1f77b4e 100644
--- a/SPECS.md
+++ b/SPECS.md
@@ -37,7 +37,8 @@ car ──live telemetry───▶ car.stinnesbeck.com (Go) ──▶ ABRP  ap
       idempotency, all 25 dashboard queries return data, dashboards rendered and checked.
 - [x] Manifests validated offline (including Traefik CRDs). **Not applied.**
 - [x] Car app 2.3.0: unit tests and lint pass; **not yet tried on the car**.
-- [ ] Push the image (`mg4-server:2.0.0`) to git.stinnesbeck.com (needs a registry login here).
+- [x] Image `mg4-server:2.0.0` pushed to git.stinnesbeck.com (public; pinned by digest
+      `sha256:6feea777…` in `k8s/kustomization.yaml`).
 - [ ] Check in `k8s/ingress.yaml`: the Traefik ingress class (placeholder `traefik-external`) and
       Grafana's host (placeholder `car-grafana.stinnesbeck.com`).
 - [ ] First drive with 2.3.0: telemetry arrives in InfluxDB, Grafana and ABRP.
diff --git a/k8s/README.md b/k8s/README.md
index db45c48..83bd3a7 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -22,9 +22,8 @@ is applied automatically. Apply them yourself.
 2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
    `CHANGE-ME` (`openssl rand -hex 32`), then apply the copy: `influxdb-auth`, `mg4-server`
    (ingest token, your ABRP API key and user token) and `grafana-admin`.
-3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create the
-   `git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is public,
-   delete `imagePullSecrets` from `server.yaml`.
+3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
+   secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
 
 ## Apply
 
@@ -42,4 +41,5 @@ kubectl apply -k k8s/
   for Grafana, read/write for the server) can replace it later.
 - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
   ConfigMap name changes with its content, which rolls Grafana.
-- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.
+- The server image is pinned by digest in `kustomization.yaml`. To upgrade, push a new tag and
+  put its digest there (`skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>`).
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 0a643ee..61be4c7 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -10,7 +10,8 @@ resources:
   - ingress.yaml
 images:
   - name: git.stinnesbeck.com/nils/mg4-server
-    newTag: "2.0.0"
+    # 2.0.0, pinned by digest so a re-pushed tag cannot change what runs.
+    digest: sha256:6feea777c514b9488ffb0b49fad7c15423ee06f0e0e8d609cf31eb85755da815
 generatorOptions:
   labels:
     app.kubernetes.io/part-of: mg4
diff --git a/k8s/secrets.example.yaml b/k8s/secrets.example.yaml
index cc316cd..a60b124 100644
--- a/k8s/secrets.example.yaml
+++ b/k8s/secrets.example.yaml
@@ -37,8 +37,3 @@ stringData:
   # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
   # afterwards, or reset it with grafana cli.
   admin-password: CHANGE-ME
----
-# Pull secret for a private image on git.stinnesbeck.com. Easier to create with:
-#   kubectl -n mg4 create secret docker-registry git-stinnesbeck-registry \
-#     --docker-server=git.stinnesbeck.com --docker-username=<user> --docker-password=<token>
-# If the package is public, remove imagePullSecrets from server.yaml instead.
diff --git a/k8s/server.yaml b/k8s/server.yaml
index e004ef8..1f20507 100644
--- a/k8s/server.yaml
+++ b/k8s/server.yaml
@@ -21,9 +21,6 @@ spec:
         app.kubernetes.io/name: mg4-server
         app.kubernetes.io/part-of: mg4
     spec:
-      # Needed only if the image is private on git.stinnesbeck.com; see secrets.example.yaml.
-      imagePullSecrets:
-        - name: git-stinnesbeck-registry
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532