diff --git a/README.md b/README.md
index ef03bfc..69f8258 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ sudo dd if=metal-amd64.iso of=/dev/sdc bs=4M
 2. Start the machine with the USB. Once it has booted **REMOVE** the USB so that it doesn't get selected as an install location.
 3. Apply config to install the OS to disk
 ```sh
-talosctl apply-config [--insecure] -n <ips> controlplane.yaml
+talosctl apply-config [--insecure] -n <ips> -f controlplane.yaml
 ```
 ### Update context
 ```sh
diff --git a/helmfile.d/01-infrastructure.lock b/helmfile.d/01-infrastructure.lock
index bbf2a7e..0b05392 100644
--- a/helmfile.d/01-infrastructure.lock
+++ b/helmfile.d/01-infrastructure.lock
@@ -2,7 +2,7 @@ version: 1.2.3
 dependencies:
   - name: ceph-csi-drivers
     repository: https://ceph.github.io/ceph-csi-operator
-    version: 1.0.5
+    version: 1.1.0
   - name: cert-manager
     repository: https://charts.jetstack.io
     version: v1.21.2
@@ -17,9 +17,9 @@ dependencies:
     version: v1.20.2
   - name: tailscale-operator
     repository: https://pkgs.tailscale.com/helmcharts
-    version: 1.102.3
+    version: 1.102.4
   - name: traefik
     repository: https://traefik.github.io/charts
-    version: 41.5.0
-digest: sha256:e1fec54455c3454c714a255a2527c5be252fa398b664692452cd47f823803b9c
-generated: "2026-09-14T17:19:31.671900496-06:00"
+    version: 41.7.1
+digest: sha256:f2b32956b950d97e4c1b18f02f736def675a976adda2021b84e6d19b1a41a821
+generated: "2026-10-13T09:41:22.617684747-06:00"
diff --git a/helmfile.d/02-datastore.lock b/helmfile.d/02-datastore.lock
index 896a707..f8cfe78 100644
--- a/helmfile.d/02-datastore.lock
+++ b/helmfile.d/02-datastore.lock
@@ -5,12 +5,12 @@ dependencies:
     version: 4.10.0
   - name: mariadb
     repository: https://charts.bitnami.com/bitnami
-    version: 27.3.0
+    version: 28.1.1
   - name: pgo
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.8.1
   - name: postgrescluster
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.7.4
-digest: sha256:0b7bc85461a8607ddce60952c15ec467bed71033befbb146f584e2d913288081
-generated: "2026-09-14T17:19:32.33665197-06:00"
+digest: sha256:c4eff06a2d3ab7a4703bd4c3d0b20437eefcb7e7e513199ad60ceaf2a6a5bed6
+generated: "2026-10-13T09:41:23.770389063-06:00"
diff --git a/helmfile.d/03-apps.lock b/helmfile.d/03-apps.lock
index 9956bba..ebcf2ce 100644
--- a/helmfile.d/03-apps.lock
+++ b/helmfile.d/03-apps.lock
@@ -35,9 +35,9 @@ dependencies:
     version: 0.1.0
   - name: matrix-synapse
     repository: https://ananace.gitlab.io/charts
-    version: 3.12.37
+    version: 3.12.39
   - name: static-site
     repository: git+https://github.com/cfpb/static-site@charts?ref=main
     version: 0.1.1
-digest: sha256:71da637606209d74d9f88d2b9ae48aac03ae8d26a8b314a405726ad75d1d7269
-generated: "2026-09-14T17:19:37.700189741-06:00"
+digest: sha256:3f1c50ab61ff1e1b6391cfb368603ff00befb358b5e40a08c11c38bdd33a256e
+generated: "2026-10-13T09:41:29.121056734-06:00"
diff --git a/immich/values.yaml.gotmpl b/immich/values.yaml.gotmpl
index 0d5538f..4544a6a 100644
--- a/immich/values.yaml.gotmpl
+++ b/immich/values.yaml.gotmpl
@@ -3,7 +3,7 @@ controllers:
     containers:
       main:
         image:
-          tag: v3.2.1
+          tag: v3.3.1
 
         env:
           DB_HOSTNAME: {{ exec "kubectl" (list "-n" "immich" "get" "secrets" "postgres-pguser-immich" "-ogo-template='{{.data.host | base64decode }}'") }}
diff --git a/postgres/values.yaml.gotmpl b/postgres/values.yaml.gotmpl
index 4e47db9..db164ca 100644
--- a/postgres/values.yaml.gotmpl
+++ b/postgres/values.yaml.gotmpl
@@ -3,6 +3,7 @@ instanceMemory: 1Gi
 instanceCPU: 2
 instances:
   - name: instance1
+    replicas: 2
     resources:
       requests:
         cpu: 100m
diff --git a/talos/machine_patch.yaml b/talos/machine_patch.yaml
index fa4579b..6b2c6e5 100644
--- a/talos/machine_patch.yaml
+++ b/talos/machine_patch.yaml
@@ -1,6 +1,6 @@
 machine:
     install:
-        image: ghcr.io/siderolabs/installer:v1.11.1
+        image: ghcr.io/siderolabs/installer:v1.13.0
     kubelet:
         extraArgs:
           rotate-server-certificates: true