diff --git a/pipelines/argocd/apps/stonks-beta.yaml b/pipelines/argocd/apps/stonks-beta.yaml
index f3c269a..4d280ce 100644
--- a/pipelines/argocd/apps/stonks-beta.yaml
+++ b/pipelines/argocd/apps/stonks-beta.yaml
@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: stonks-beta
   namespace: argocd
+  annotations:
+    kargo.akuity.io/authorized-stage: stonks-oracle:beta
 spec:
   project: default
   source:
diff --git a/pipelines/argocd/apps/stonks-live.yaml b/pipelines/argocd/apps/stonks-live.yaml
index 0f0ae92..e878255 100644
--- a/pipelines/argocd/apps/stonks-live.yaml
+++ b/pipelines/argocd/apps/stonks-live.yaml
@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: stonks-live
   namespace: argocd
+  annotations:
+    kargo.akuity.io/authorized-stage: stonks-oracle:live
 spec:
   project: default
   source:
diff --git a/pipelines/argocd/apps/stonks-paper.yaml b/pipelines/argocd/apps/stonks-paper.yaml
index 816ec3d..76f87c9 100644
--- a/pipelines/argocd/apps/stonks-paper.yaml
+++ b/pipelines/argocd/apps/stonks-paper.yaml
@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: stonks-paper
   namespace: argocd
+  annotations:
+    kargo.akuity.io/authorized-stage: stonks-oracle:paper
 spec:
   project: default
   source:
diff --git a/pipelines/argocd/values.yaml b/pipelines/argocd/values.yaml
index 61f5592..7996021 100644
--- a/pipelines/argocd/values.yaml
+++ b/pipelines/argocd/values.yaml
@@ -3,8 +3,7 @@
 # Namespace: argocd
 
 global:
-  podAnnotations:
-    celestium.life/inject-ca: "true"
+  podAnnotations: {}
 
 # Disable dex (not needed)
 dex:
diff --git a/pipelines/kargo/warehouse.yaml b/pipelines/kargo/warehouse.yaml
index d7f3f54..27e25c3 100644
--- a/pipelines/kargo/warehouse.yaml
+++ b/pipelines/kargo/warehouse.yaml
@@ -7,3 +7,5 @@ spec:
   subscriptions:
     - image:
         repoURL: registry.celestium.life/stonks-oracle/query-api
+        imageSelectionStrategy: NewestBuild
+        allowTags: '^[0-9a-f]{7,40}$'