diff --git a/vault/helm-vault.yaml b/vault/helm-vault.yaml
index 8b9ef9c..10906d1 100644
--- a/vault/helm-vault.yaml
+++ b/vault/helm-vault.yaml
@@ -16,7 +16,7 @@ spec:
   sources:
     - chart: vault
       repoURL: https://helm.releases.hashicorp.com
-      targetRevision: 0.28.1
+      targetRevision: 0.34.1
       helm:
         valueFiles:
           - $values/vault/overrides.yaml
diff --git a/vault/overrides.yaml b/vault/overrides.yaml
index 9e361a0..3f0359a 100644
--- a/vault/overrides.yaml
+++ b/vault/overrides.yaml
@@ -4,6 +4,11 @@ global:
 injector:
    enabled: true
 server:
+   # Pinned to the running version: the chart would otherwise pull its own
+   # default on the next pod restart, and with Shamir unsealing a Vault
+   # upgrade needs someone with the unseal keys at hand.
+   image:
+      tag: "1.17.2"
    dataStorage:
       storageClass: longhorn
    standalone: