diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index 0bd8bfac..53a19998 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -60,7 +60,7 @@ spec:
         # repo's configuration.yaml reads this key, so HA does not start
         # without it. Removing this init container takes the recorder down.
         - name: render-db-url
-          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
           command:
             - sh
             - -c
@@ -97,7 +97,7 @@ spec:
         # (homeassistant repo packages/matrix_assist.yaml), same filter-then-append
         # render as recorder_db_url above. Value is hex, nothing to escape.
         - name: render-matrix-password
-          image: busybox:1.38@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+          image: busybox:1.38@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
           command:
             - sh
             - -c
@@ -275,7 +275,7 @@ spec:
         # any LAN client can edit, matching the user's trust-the-network
         # model. Runs as root so its writes match HA's root-owned files.
         - name: code-server
-          image: codercom/code-server:4.143.1@sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97
+          image: codercom/code-server:4.144.0@sha256:b9e8056bb74bd0c4f90284c7559eddeccd38400cfedc28e64c9d3ca50fef1f83
           args:
             - "--auth=none"
             - "--bind-addr=0.0.0.0:8080"
@@ -337,7 +337,7 @@ spec:
         # dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0@sha256:e8ceedc73bd80992ae8d58a7d24c58b8322146c354f1d2e81a97db4452068ec0
+          image: alpine/git:2.54.0@sha256:ac6c828f15d82775d204d3d75112e1d34af8945da80ccf922713c9891ba68e7a
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH
diff --git a/kubernetes/apps/home-assistant/esphome-deployment.yaml b/kubernetes/apps/home-assistant/esphome-deployment.yaml
index e96181c7..d9f3e340 100644
--- a/kubernetes/apps/home-assistant/esphome-deployment.yaml
+++ b/kubernetes/apps/home-assistant/esphome-deployment.yaml
@@ -36,7 +36,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: esphome
-          image: ghcr.io/esphome/esphome:2026.10.0@sha256:1dff19a59070cdb523b76576cdc74d200f862d43c1407809088855920cf57145
+          image: ghcr.io/esphome/esphome:2026.10.1@sha256:eab8cd6b4f51077c3883af4cedc058280ddc34a94f3b2ffee23e9d2cd5f1db64
           imagePullPolicy: IfNotPresent
           # Default entrypoint runs the dashboard (Device Builder) against the
           # mounted /config — no command override needed.
diff --git a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
index 2c8e95e9..2bd6876e 100644
--- a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
+++ b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
@@ -163,7 +163,7 @@ spec:
           # Pinned tag. No Flux image-automation marker yet (unlike mosquitto) —
           # add an infrastructure/image-automation/zigbee2mqtt.yaml policy as a
           # follow-up if desired; pinned-and-manual is fine for the initial cutover.
-          image: ghcr.io/koenkk/zigbee2mqtt:2.14.2@sha256:addbfb08fcef2e4477de1535636118241e10d13e898fbe4d9faba8a4d7396311
+          image: ghcr.io/koenkk/zigbee2mqtt:2.14.3@sha256:fb4a6b0f6868ad1cd6a9996479802b2420e599c3463b62bbff8c8cd9a908f43a
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ