diff --git a/.drone.yml b/.drone.yml
index 4d0529f..5f470a4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -33,7 +33,9 @@ steps:
         from_secret: GITHUB_USERNAME
       password:
         from_secret: GITHUB_PASSWORD
-      tags: latest
+      tags:
+        - latest
+        - ${DRONE_COMMIT_SHA}
     when:
       event:
         include:
@@ -58,7 +60,10 @@ steps:
     commands:
       - mkdir -p /root/.kube
       - echo $KUBE_CONFIG | base64 -di > /root/.kube/config
-      - kubectl --kubeconfig=/root/.kube/config apply -f .kubernetes
+      - export IMAGE=ghcr.io/kevinmidboe/k9e.no:${DRONE_COMMIT_SHA}
+      - cat .kubernetes/*.yml
+        | envsubst -
+        | kubectl --kubeconfig=/root/.kube/config apply -f -
     environment:
       KUBE_CONFIG:
         from_secret: KUBE_CONFIG
@@ -73,3 +78,6 @@ steps:
 
 depends_on:
   - Build
+---
+kind: signature
+hmac: 996f43df0a29df7c3669a4f7c45e1514a205e0d7d15ebff6a59fc987947a3080
diff --git a/.kubernetes/deployment.yml b/.kubernetes/deployment.yml
index 29c2875..408e1d4 100644
--- a/.kubernetes/deployment.yml
+++ b/.kubernetes/deployment.yml
@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -26,7 +27,7 @@ spec:
         app: k9e
     spec:
       containers:
-        - image: ghcr.io/kevinmidboe/k9e.no:latest
+        - image: ${IMAGE}
           imagePullPolicy: IfNotPresent
           name: k9e
           resources: {}
diff --git a/.kubernetes/service.yml b/.kubernetes/service.yml
index 5986f38..ca6ebeb 100644
--- a/.kubernetes/service.yml
+++ b/.kubernetes/service.yml
@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Service
 metadata: