diff --git a/helmfile.d/01-infrastructure.lock b/helmfile.d/01-infrastructure.lock
index 69133aa..c9051ca 100644
--- a/helmfile.d/01-infrastructure.lock
+++ b/helmfile.d/01-infrastructure.lock
@@ -8,9 +8,9 @@ dependencies:
   version: v1.17.2
 - name: tailscale-operator
   repository: https://pkgs.tailscale.com/helmcharts
-  version: 1.82.5
+  version: 1.84.0
 - name: traefik
   repository: https://traefik.github.io/charts
-  version: 35.3.0
-digest: sha256:1fe18468c11b0b7f61b8a59e57288739b07a6a193ebbeb502bbcc48b52d06308
-generated: "2025-05-19T17:06:00.01956869-06:00"
+  version: 35.4.0
+digest: sha256:79910c4ff48627441b4c27b62898f282d1b600c380382f60bd3eabbea470cbad
+generated: "2025-05-29T20:59:45.8253791-06:00"
diff --git a/helmfile.d/02-datastore.lock b/helmfile.d/02-datastore.lock
index 5a81976..b7b865d 100644
--- a/helmfile.d/02-datastore.lock
+++ b/helmfile.d/02-datastore.lock
@@ -5,12 +5,12 @@ dependencies:
   version: 4.8.4
 - name: mariadb
   repository: https://charts.bitnami.com/bitnami
-  version: 20.5.5
+  version: 20.5.6
 - name: pgo
   repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
   version: 5.8.1
 - name: postgrescluster
   repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
   version: 5.7.4
-digest: sha256:a4344de14b40813a0a196ced5b9ef8d96ef0b1d2ac08b772f7b1b4400cd645c6
-generated: "2025-05-19T17:18:09.794704676-06:00"
+digest: sha256:182eee20b908cc0af46c1b94269d4b1bae8a4c4269a32f8a6bba34b15cf59484
+generated: "2025-05-29T20:59:59.254676964-06:00"
diff --git a/helmfile.d/03-apps.lock b/helmfile.d/03-apps.lock
index 31fa261..82f9922 100644
--- a/helmfile.d/03-apps.lock
+++ b/helmfile.d/03-apps.lock
@@ -2,13 +2,10 @@ version: 0.170.1
 dependencies:
 - name: ghost
   repository: https://charts.bitnami.com/bitnami
-  version: 23.0.3
+  version: 23.0.9
 - name: ghost
   repository: https://charts.bitnami.com/bitnami
-  version: 23.0.3
-- name: gitea
-  repository: https://dl.gitea.io/charts
-  version: 12.0.0
+  version: 23.0.9
 - name: immich
   repository: https://immich-app.github.io/immich-charts
   version: 0.9.3
@@ -33,5 +30,5 @@ dependencies:
 - name: static-site
   repository: git+https://github.com/cfpb/static-site@charts?ref=main
   version: 0.1.1
-digest: sha256:4a6ff3f8b347e887e7879356dcb47c38097d1c11423bdac15a7e2ff0a635937f
-generated: "2025-05-19T17:18:26.189020859-06:00"
+digest: sha256:c78dadea873029f1b6fca369e84fc27b831060bb268eeb89cde168a966d73416
+generated: "2025-05-29T21:00:19.279226635-06:00"
diff --git a/helmfile.d/03-apps.yaml b/helmfile.d/03-apps.yaml
index 22de7c6..73a7502 100644
--- a/helmfile.d/03-apps.yaml
+++ b/helmfile.d/03-apps.yaml
@@ -11,6 +11,7 @@ repositories:
     url: git+https://github.com/cfpb/static-site@charts?ref=main
   - name: incngrnt
     url: git+https://git.incngrnt.ca/grant/charts@charts?ref=main
+
 releases:
   # goatchat matrix
   - name: goatchat
@@ -18,25 +19,13 @@ releases:
     createNamespace: true
     chart: ananace-charts/matrix-synapse
     values:
-      - ../synapse/values.yaml
-    setString:
-      - name: config.macaroonSecretKey
-        value: {{ requiredEnv "GOATCHAT_SYNAPSE_MACAROON_SECRET_KEY" }}
-      - name: config.registrationSharedSecret
-        value: {{ requiredEnv "GOATCHAT_REGISTRATION_SHARED_SECRET" }}
-      - name: extraConfig.email.smtp_pass
-        value: {{ requiredEnv "GOATCHAT_SMTP_PASSWORD" }}
+      - ../synapse/values.yaml.gotmpl
   - name: gate
     namespace: goatchat
     createNamespace: true
     chart: incngrnt/matrix-registration
     values:
-      - ../matrix-registration/values.yaml
-    setString:
-      - name: registrationSharedSecret
-        value: {{ requiredEnv "GOATCHAT_REGISTRATION_SHARED_SECRET"}}
-      - name: adminApiSharedSecret
-        value: {{ requiredEnv "GOATCHAT_REGISTRATION_ADMIN_API_SHARE_SECRET"}}
+      - ../matrix-registration/values.yaml.gotmpl
 
   - name: immich
     namespace: immich
@@ -58,30 +47,21 @@ releases:
     createNamespace: true
     chart: bitnami/ghost
     values:
-      - ../kgnot/values.yaml
-    setString:
-      - name: ghostUsername
-        value: {{ requiredEnv "KGNOT_GHOST_USER_NAME" }}
+      - ../kgnot/values.yaml.gotmpl
   - name: ghost-53ll
     namespace: ghost
     createNamespace: true
     chart: bitnami/ghost
     values:
-      - ../53ll/values.yaml
-    setString:
-      - name: ghostUsername
-        value: {{ requiredEnv "GHOST_53LL_USER_NAME" }}
+      - ../53ll/values.yaml.gotmpl
 
   # dev tools
-  - name: gitea
-    namespace: gitea
-    createNamespace: true
-    chart: gitea/gitea
-    values:
-      - ../gitea/values.yaml
-    setString:
-      - name: gitea.admin.password
-        value: {{ requiredEnv "GITEA_ADMIN_PASSWORD" }}
+  # - name: gitea
+  #   namespace: gitea
+  #   createNamespace: true
+  #   chart: gitea/gitea
+  #   values:
+  #     - ../gitea/values.yaml.gotmpl
 
   # backups
   - name: ghost-backup
@@ -101,7 +81,7 @@ releases:
     chart: incngrnt/k8up-backup
     createNamespace: true    
     values:
-      - ../k8up-backup/values.yaml.gotmpl 
+      - ../k8up-backup/values.yaml.gotmpl
   - name: immich-backup
     namespace: immich
     chart: incngrnt/k8up-backup
diff --git a/helmfile.d/04-monitoring.lock b/helmfile.d/04-monitoring.lock
index 58282c6..5badaf3 100644
--- a/helmfile.d/04-monitoring.lock
+++ b/helmfile.d/04-monitoring.lock
@@ -3,8 +3,11 @@ dependencies:
 - name: alloy
   repository: https://grafana.github.io/helm-charts
   version: 1.0.3
+- name: kube-state-metrics
+  repository: https://prometheus-community.github.io/helm-charts
+  version: 5.33.2
 - name: lgtm-distributed
   repository: https://grafana.github.io/helm-charts
   version: 2.1.0
-digest: sha256:b762680c9b1e855da8da6bdbb1d79216d2d9352b59d3259c554a7e23b9177cb2
-generated: "2025-05-19T17:18:43.394774206-06:00"
+digest: sha256:e1c994ff73cbf51ec94c52aa15a110c8a6917c27918a4989545e313b950f2008
+generated: "2025-05-29T21:00:38.677681755-06:00"
diff --git a/immich/values.yaml.gotmpl b/immich/values.yaml.gotmpl
index 001499a..bfba8d1 100644
--- a/immich/values.yaml.gotmpl
+++ b/immich/values.yaml.gotmpl
@@ -1,5 +1,5 @@
 image:
-  tag: v1.131.3
+  tag: v1.134.0
   
 env:
   DB_HOSTNAME: {{ exec "kubectl" (list "-n" "immich" "get" "secrets" "postgres-pguser-immich" "-ogo-template='{{.data.host | base64decode }}'") }}