diff --git a/deploy/k8s/gitea-mcp-deployment.yaml b/deploy/k8s/gitea-mcp-deployment.yaml
index 92b7cc85..7aa8eace 100644
--- a/deploy/k8s/gitea-mcp-deployment.yaml
+++ b/deploy/k8s/gitea-mcp-deployment.yaml
@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
         - name: gitea-mcp
-          image: gitea/gitea-mcp-server:latest
+          image: docker.io/gitea/gitea-mcp-server@sha256:5fad9c4a1148071fd58ed617f779115f65a13c517c20427a3b39f80cac43e600  # pinned 2026-10-06: a floating tag upgrades on any restart
           command: ["/app/gitea-mcp"]
           args:
             - "-t"
diff --git a/deploy/k8s/manna-volume.yaml b/deploy/k8s/manna-volume.yaml
index 5504c0a8..52d4209b 100644
--- a/deploy/k8s/manna-volume.yaml
+++ b/deploy/k8s/manna-volume.yaml
@@ -19,7 +19,17 @@ metadata:
   name: manna-pvc
   namespace: shorashim
 spec:
-  storageClassName: exoscale-sbs
+  # Since the move to the Starter cluster (2026-10-06) this claim is bound
+  # to a STATIC PersistentVolume, `static-manna-pvc`, which names the
+  # existing Exoscale volume (ch-gva-2/7e6653a2-31c2-4673-a0c1-2cecb3f71910)
+  # with reclaim policy Retain — the day's ledger moved with it. On a fresh
+  # cluster create that PV first (shape:
+  # ~/shorashim-operator-notes/cluster-export-2026-10-06/new-cluster/20-volumes-static.json)
+  # or drop volumeName and use a dynamic class for an empty volume.
+  # The default class `exoscale-sbs` reclaims with DELETE: deleting the
+  # claim destroys the volume.
+  storageClassName: exoscale-bs-retain
+  volumeName: static-manna-pvc
   accessModes:
     - ReadWriteOnce
   resources: