diff --git a/apps/wave-1/semaphore.yaml b/apps/wave-1/semaphore.yaml
index d5b0722..72942dc 100644
--- a/apps/wave-1/semaphore.yaml
+++ b/apps/wave-1/semaphore.yaml
@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: semaphore
-        image: semaphoreui/semaphore:v2.19.10
+        image: semaphoreui/semaphore:v2.19.17
         ports:
         - containerPort: 3000
         env:
diff --git a/catalog/semaphore.yaml b/catalog/semaphore.yaml
index a20855b..aca22f0 100644
--- a/catalog/semaphore.yaml
+++ b/catalog/semaphore.yaml
@@ -22,7 +22,7 @@
 name: semaphore
 kind: container
 source:
-  image: semaphoreui/semaphore:v2.19.10   # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: semaphoreui/semaphore:v2.19.17   # pinned recent stable tag (R-UPD-01); update.range governs advancement
 env:
   # --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
   #     sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,