diff --git a/README.md b/README.md
index d89e3b3..85c146e 100644
--- a/README.md
+++ b/README.md
@@ -199,7 +199,7 @@ When no SSH flags are provided, no user account is configured in the VMs.
 
 ## OpenShift Deployment
 
-virtwork can run as a pod on the cluster using the provided Kustomize manifests in `deploy/`. The container image is available at `quay.io/opdev/virtwork:latest`.
+virtwork can run as a pod on the cluster using the provided Kustomize manifests in `deploy/`. The deployment manifest uses a semantic version tag (e.g., `v0.0.1`) to pin the image for reproducible deployments. Update the version tag in `deploy/deployment.yaml` when upgrading. For development or testing, you can use `quay.io/opdev/virtwork:latest`.
 
 ### Deploy with Kustomize
 
diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml
index afb7022..91a5227 100644
--- a/deploy/deployment.yaml
+++ b/deploy/deployment.yaml
@@ -29,8 +29,8 @@ spec:
           type: RuntimeDefault
       containers:
         - name: virtwork
-          image: quay.io/opdev/virtwork:latest
-          imagePullPolicy: Always
+          image: quay.io/opdev/virtwork:v0.0.1
+          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: virtwork-config