@@ -215,6 +215,12 @@ func resolveTapTarget(arg, indexRef string) (string, error) {
 	if !ok {
 		return "", fmt.Errorf("no index entry named %q", arg)
 	}
+	// Pin to the entry's recorded version: the CI gate validated and
+	// cosign-verified <ociRef>:<version>, so tapping must consume that exact
+	// tag rather than defaulting to latest.
+	if entry.Version != "" {
+		return entry.OCIRef + ":" + entry.Version, nil
+	}
 	return entry.OCIRef, nil
 }
 
 
@@ -106,8 +106,14 @@ func TestResolveTapTarget(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolveTapTarget: %v", err)
 	}
-	if got != "oci://ghcr.io/foo/bar" {
-		t.Fatalf("resolved ref = %q", got)
+	// Must pin to the entry's recorded version, not default to latest.
+	if got != "oci://ghcr.io/foo/bar:v1.2.3" {
+		t.Fatalf("resolved ref = %q, want the version-pinned ref", got)
+	}
+
+	// An entry without a version resolves to the bare ref (tap defaults to latest).
+	if got, err := resolveTapTarget("baz.qux", dir); err != nil || got != "oci://ghcr.io/baz/qux" {
+		t.Fatalf("versionless resolve = %q err %v", got, err)
 	}
 
 	if _, err := resolveTapTarget("does.not.exist", dir); err == nil {
 
@@ -0,0 +1,8 @@
+# Every index entry requires maintainer review before merge (the auto-merge
+# lane in validate.yaml only fires for an owner version bump signed by the
+# entry's recorded identity; everything else lands here).
+/entries/  @cozystack/maintainers
+
+# The gate itself and the workflow are maintainer-owned.
+/scripts/            @cozystack/maintainers
+/github-workflows/   @cozystack/maintainers
@@ -48,6 +48,11 @@ jobs:
         with:
           cosign-release: v2.4.3
 
+      # helm is needed for `cozypkg validate --helm-lint` in the gate.
+      - uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
+        with:
+          version: v3.16.4
+
       - name: Validate changed entries
         id: gate
         env:
 
@@ -72,8 +72,10 @@ while IFS= read -r file; do
     lane="review"
   fi
 
-  # Mandatory validation plus cosign verification against the RECORDED identity.
+  # Mandatory validation (including helm lint of every component chart) plus
+  # cosign verification against the RECORDED identity.
   cozypkg validate "${ociRef}:${version}" \
+    --helm-lint \
     --require-signature \
     --certificate-identity "$identity" \
     --certificate-oidc-issuer "$issuer"
Original file line number	Diff line number	Diff line change
`@@ -215,6 +215,12 @@ func resolveTapTarget(arg, indexRef string) (string, error) {`
`215`	`215`	`if !ok {`
`216`	`216`	`return "", fmt.Errorf("no index entry named %q", arg)`
`217`	`217`	`}`
	`218`	`+ // Pin to the entry's recorded version: the CI gate validated and`
	`219`	`+ // cosign-verified <ociRef>:<version>, so tapping must consume that exact`
	`220`	`+ // tag rather than defaulting to latest.`
	`221`	`+ if entry.Version != "" {`
	`222`	`+ return entry.OCIRef + ":" + entry.Version, nil`
	`223`	`+ }`
`218`	`224`	`return entry.OCIRef, nil`
`219`	`225`	`}`
`220`	`226`