diff --git a/platform/pm-agent/configmap.yaml b/platform/pm-agent/configmap.yaml
index 61104a1..7dda08a 100644
--- a/platform/pm-agent/configmap.yaml
+++ b/platform/pm-agent/configmap.yaml
@@ -59,7 +59,7 @@ data:
   # Until the first publish the dispatcher starts, fails to pull, and says so — which is the
   # visible failure, not a silent one.
   # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:c4eba5b3c508bf456a03391ac76f8275e7ea28a829da1450d99f6f6f25c6eb42"
 
   # --- the model -------------------------------------------------------------
   # The PM only reads a thread and answers with one JSON object, so it holds no tools and
diff --git a/platform/pm-agent/deployment.yaml b/platform/pm-agent/deployment.yaml
index fdd4adb..a6a665c 100644
--- a/platform/pm-agent/deployment.yaml
+++ b/platform/pm-agent/deployment.yaml
@@ -72,7 +72,7 @@ spec:
           # of agent-runner's `main` tag (.gitea/workflows/images.yaml) — the all-zero
           # placeholder below is impossible on purpose (see configmap.yaml PM_WORKER_IMAGE).
           # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:0000000000000000000000000000000000000000000000000000000000000000
+          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:c4eba5b3c508bf456a03391ac76f8275e7ea28a829da1450d99f6f6f25c6eb42
           imagePullPolicy: IfNotPresent
           command:
             - /usr/local/bin/pm-dispatch