diff --git a/README.md b/README.md
index b5e8deb..cbd34fc 100644
--- a/README.md
+++ b/README.md
@@ -73,6 +73,7 @@ For runtime verification (do the workloads actually start, do probes/security se
 
 - Resources are named `{{ .Release.Name }}-{{ .Chart.Name }}-<kind>`; template files are named `<app>.<kind>.yaml` (StatefulSets use `.sfs.yaml`).
 - Image tags come from `{{ .Chart.AppVersion }}`.
+- Auxiliary/sidecar images (images other than the app image, currently only the delegation nginx in matrix-synapse) are pinned via values (`<workload>.image.repository` / `<workload>.image.tag`) instead of being hardcoded in templates, and their pinned versions are reviewed alongside every app-version update round.
 - Secrets are **1Password `OnePasswordItem` CRs**: values expose `secrets.<name>SecretRef` holding an `op://` item path; the 1Password operator materializes the Kubernetes Secret in-cluster.
 - Ingress assumes ingress-nginx (`ingressClassName: nginx`) and cert-manager: `ingress.clusterIssuer` and `ingress.domain` are required values; the TLS secret is named `tls-<release>-<chart>-ingress`.
 - `env` entries in `values.yaml` are rendered through `tpl`, so values may contain Helm templating; `value`, `secretKeyRef` and `configMapKeyRef` forms are supported.
diff --git a/matrix-synapse/Chart.yaml b/matrix-synapse/Chart.yaml
index 3453775..de2e90f 100644
--- a/matrix-synapse/Chart.yaml
+++ b/matrix-synapse/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: matrix-synapse
 description: A Helm chart to deploy a Matrix Synapse server on Kubernetes
 type: application
-version: 4.1.1+upv1.159.0
+version: 4.2.0+upv1.159.0
 appVersion: "v1.159.0"
 maintainers:
   - name: jklein
\ No newline at end of file
diff --git a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
index d821685..da3717a 100644
--- a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
+++ b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
@@ -20,7 +20,7 @@ spec:
         {{- toYaml .Values.matrix.delegation.securityContext.pod | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
-          image: "nginx:1.28.3"
+          image: "{{ .Values.matrix.delegation.image.repository }}:{{ .Values.matrix.delegation.image.tag }}"
           securityContext:
             {{- toYaml .Values.matrix.delegation.securityContext.container | nindent 12 }}
           ports:
diff --git a/matrix-synapse/values.yaml b/matrix-synapse/values.yaml
index 614cab8..1cad93d 100644
--- a/matrix-synapse/values.yaml
+++ b/matrix-synapse/values.yaml
@@ -17,6 +17,11 @@ matrix:
     replicas: 1
     enabled: false
     serverUrl: null
+    # Auxiliary image, pinned independently of appVersion (which tracks
+    # Synapse). Reviewed alongside every app-version update round.
+    image:
+      repository: nginx
+      tag: 1.30.4
     # The delegation nginx runs as the image's unprivileged nginx user
     # (uid 101) and listens on the unprivileged port 8080; pid file and temp
     # paths are redirected to the /tmp emptyDir by the mounted nginx.conf.