diff --git a/charts/helm/checkmate/INSTALLATION.md b/charts/helm/checkmate/INSTALLATION.md
index 7177da86a..6bc1f3ecd 100644
--- a/charts/helm/checkmate/INSTALLATION.md
+++ b/charts/helm/checkmate/INSTALLATION.md
@@ -87,6 +87,27 @@ keys in your values file are harmless (ignored).
 block and merge into your install unless you override them. Set them explicitly if you relied on
 different values (e.g. a non-production `NODE_ENV`).
 
+### Image tags follow the chart's `appVersion`
+
+Each tier's `image` value is now the repository **without a tag**; the tag defaults to the chart's
+`appVersion`, so the client, api, worker, and mongodb images all move together when you upgrade the
+chart. You can still pin per tier:
+
+```yaml
+api:
+  image: ghcr.io/bluewave-labs/checkmate-backend   # repo only
+  tag: ""            # empty → Chart.appVersion; set e.g. "v3.1.0" to pin, or "latest" for a dev tag
+```
+
+- `<tier>.tag` overrides the version for that tier. The `worker` tier inherits `api.tag` (and
+  `api.image`) unless you set `worker.tag` / `worker.image`.
+- If you put a **full `repo:tag`** in `image` (e.g. a legacy `server.image: …:v3.2.0` override), it is
+  used verbatim and the `tag` field is ignored — so existing pinned values keep working unchanged.
+
+**Prefer a pinned tag over `latest`.** With the default `imagePullPolicy: IfNotPresent`, `latest` is
+cached per node and never refreshed, and `helm rollback` can't move a floating tag — pin a version (or
+let it default to `appVersion`) for reproducible, rollback-able deploys.
+
 ## Scaling: the worker tier & autoscaling
 
 By default the chart runs a single all-in-one API pod that both schedules **and** processes monitoring
diff --git a/charts/helm/checkmate/templates/_helpers.tpl b/charts/helm/checkmate/templates/_helpers.tpl
index a65766ab8..69a1b259b 100644
--- a/charts/helm/checkmate/templates/_helpers.tpl
+++ b/charts/helm/checkmate/templates/_helpers.tpl
@@ -14,3 +14,22 @@ then reference `$api.*` instead of `.Values.api.*`.
 {{- end -}}
 {{- $api | toYaml -}}
 {{- end -}}
+
+{{- /*
+Resolve a full image reference from a repo + optional tag. `appVersion` is the single source of
+truth for tags: bumping Chart.appVersion moves every tier at once. Call as:
+  {{ include "checkmate.image" (dict "image" $repo "tag" $tag "root" $) }}
+
+If `image` already carries a tag (a ":" in its final path segment) it is used verbatim — this keeps
+legacy `server.image: repo:tag` overrides working and lets anyone pin a full ref (e.g. tag "latest").
+A ":" only in the registry segment (a registry port like "reg:5000/x") is ignored, so a tag is still
+appended. Otherwise the tag is `tag` if set, else the chart's appVersion.
+*/}}
+{{- define "checkmate.image" -}}
+{{- $lastSegment := .image | splitList "/" | last -}}
+{{- if contains ":" $lastSegment -}}
+{{- .image -}}
+{{- else -}}
+{{- printf "%s:%s" .image (.tag | default .root.Chart.AppVersion) -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/helm/checkmate/templates/api/deployment.yaml b/charts/helm/checkmate/templates/api/deployment.yaml
index 542c6d0af..6469d3bdd 100644
--- a/charts/helm/checkmate/templates/api/deployment.yaml
+++ b/charts/helm/checkmate/templates/api/deployment.yaml
@@ -23,7 +23,7 @@ spec:
     {{- end }}
       containers:
         - name: api
-          image: {{ $api.image }}
+          image: {{ include "checkmate.image" (dict "image" $api.image "tag" $api.tag "root" $) }}
           imagePullPolicy: {{ $api.imagePullPolicy }}
           ports:
             - name: http
diff --git a/charts/helm/checkmate/templates/client/deployment.yaml b/charts/helm/checkmate/templates/client/deployment.yaml
index 006ccfaa1..a98e6a648 100644
--- a/charts/helm/checkmate/templates/client/deployment.yaml
+++ b/charts/helm/checkmate/templates/client/deployment.yaml
@@ -23,7 +23,7 @@ spec:
     {{- end }}
       containers:
         - name: client
-          image: {{ .Values.client.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.client.image "tag" .Values.client.tag "root" $) }}
           imagePullPolicy: {{ .Values.client.imagePullPolicy }}
           ports:
             - containerPort: {{ .Values.client.port }}
diff --git a/charts/helm/checkmate/templates/db/mongodb-statefulsets.yaml b/charts/helm/checkmate/templates/db/mongodb-statefulsets.yaml
index d4e048ee7..16c228c2b 100644
--- a/charts/helm/checkmate/templates/db/mongodb-statefulsets.yaml
+++ b/charts/helm/checkmate/templates/db/mongodb-statefulsets.yaml
@@ -22,7 +22,7 @@ spec:
     {{- end }}
       containers:
         - name: mongodb
-          image: {{ .Values.mongodb.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.mongodb.image "tag" .Values.mongodb.tag "root" $) }}
           imagePullPolicy: {{ .Values.mongodb.imagePullPolicy }}
           ports:
             - containerPort: {{ .Values.mongodb.port }}
diff --git a/charts/helm/checkmate/templates/worker/deployment.yaml b/charts/helm/checkmate/templates/worker/deployment.yaml
index 1252ee8ea..0b0849455 100644
--- a/charts/helm/checkmate/templates/worker/deployment.yaml
+++ b/charts/helm/checkmate/templates/worker/deployment.yaml
@@ -27,7 +27,7 @@ spec:
     {{- end }}
       containers:
         - name: worker
-          image: {{ .Values.worker.image | default $api.image }}
+          image: {{ include "checkmate.image" (dict "image" (.Values.worker.image | default $api.image) "tag" (.Values.worker.tag | default $api.tag) "root" $) }}
           imagePullPolicy: {{ .Values.worker.imagePullPolicy | default $api.imagePullPolicy }}
           ports:
             - name: health
diff --git a/charts/helm/checkmate/values.yaml b/charts/helm/checkmate/values.yaml
index 7f8fbc65d..b2126fe20 100644
--- a/charts/helm/checkmate/values.yaml
+++ b/charts/helm/checkmate/values.yaml
@@ -1,5 +1,6 @@
 client:
-  image: ghcr.io/bluewave-labs/checkmate-client:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-client
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
   imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 80
   protocol: http
@@ -19,7 +20,8 @@ client:
       # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation
 
 api:
-  image: ghcr.io/bluewave-labs/checkmate-backend:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-backend
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
   imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 52345
   protocol: http
@@ -51,7 +53,8 @@ api:
       # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation
 
 mongodb:
-  image: ghcr.io/bluewave-labs/checkmate-mongo:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-mongo
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin
   imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 27017
 
@@ -61,6 +64,7 @@ worker:
   # API is all-in-one and processes jobs itself.
   enabled: false
   image: "" # defaults to api.image when empty, same as API image
+  tag: "" # defaults to api.tag (-> Chart.appVersion) when empty
   imagePullPolicy: "" # defaults to api.imagePullPolicy when empty
   replicas: 1 # used only when autoscaling.enabled = false
   healthPort: 52346 # HEALTH_PORT; serves /livez /readyz /metrics