diff --git a/certificates.yaml b/kind/certificates.yaml
similarity index 100%
rename from certificates.yaml
rename to kind/certificates.yaml
diff --git a/external-secrets.yaml b/kind/external-secrets.yaml
similarity index 100%
rename from external-secrets.yaml
rename to kind/external-secrets.yaml
diff --git a/kind.yaml b/kind/kind.yaml
similarity index 100%
rename from kind.yaml
rename to kind/kind.yaml
diff --git a/kustomization.yaml b/kind/kustomization.yaml
similarity index 100%
rename from kustomization.yaml
rename to kind/kustomization.yaml
diff --git a/mysql.yaml b/kind/mysql.yaml
similarity index 90%
rename from mysql.yaml
rename to kind/mysql.yaml
index 5bc3a22..d02a806 100644
--- a/mysql.yaml
+++ b/kind/mysql.yaml
@@ -25,7 +25,7 @@ spec:
         app: mysql
     spec:
       containers:
-      - image: jamielsharief/mysql
+      - image: mysql:8.4.3@sha256:106d5197fd8e4892980469ad42eb20f7a336bd81509aae4ee175d852f5cc4565
         name: mysql
         env:
         - name: MYSQL_ROOT_PASSWORD
diff --git a/postgres.yaml b/kind/postgres.yaml
similarity index 96%
rename from postgres.yaml
rename to kind/postgres.yaml
index 9aa4847..248c27e 100644
--- a/postgres.yaml
+++ b/kind/postgres.yaml
@@ -49,7 +49,7 @@ spec:
     spec:
       containers:
       - name: postgres
-        image: postgres:16-alpine
+        image: postgres:17.2-alpine@sha256:d37d2c160d34430877c802e5adc22824a2ad453499db9bab1a2ceb2be6c1a46f
         args:
         - -c
         - shared_buffers=384MB
diff --git a/rabbitmq.yaml b/kind/rabbitmq.yaml
similarity index 91%
rename from rabbitmq.yaml
rename to kind/rabbitmq.yaml
index ecc26c7..e32920b 100644
--- a/rabbitmq.yaml
+++ b/kind/rabbitmq.yaml
@@ -69,7 +69,7 @@ spec:
           value: '"8GiB"'
         - name: RABBITMQ_CONFIG_FILES
           value: /etc/rabbitmq/conf.d
-        image: rabbitmq:management
+        image: rabbitmq:4.0.5-management@sha256:4a2b95d53111fe589fb44b5152ff87253c63eb227eee21f39494f64d9d96c0b2
         imagePullPolicy: Always
         livenessProbe:
           exec:
@@ -96,10 +96,12 @@ spec:
           name: stats
           protocol: TCP
         readinessProbe:
-          exec:
-            command:
-            - rabbitmqctl
-            - status
+          httpGet:
+            port: 15672
+            path: /api/aliveness-test/%2F
+            httpHeaders:
+            - name: "Authorization"
+              value: "Basic dXNlcjpwYXNzd29yZA=="
           failureThreshold: 3
           initialDelaySeconds: 10
           periodSeconds: 5
diff --git a/secrets-store.yaml b/kind/secrets-store.yaml
similarity index 100%
rename from secrets-store.yaml
rename to kind/secrets-store.yaml
diff --git a/setup b/setup
index 91b4a8e..a544a59 100755
--- a/setup
+++ b/setup
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-kind create cluster --config kind.yaml --wait 10m
+kind create cluster --config kind/kind.yaml --wait 10m
 
 kubectl create secret docker-registry gitlab \
           --docker-server=registry.gitlab.com \
@@ -14,7 +14,7 @@ kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "gitlab"
 
 kustomized="$(mktemp --suffix .unboundkind.yaml --tmpdir=/tmp/)"
 
-kubectl kustomize --enable-helm . > "${kustomized}"
+kubectl kustomize --enable-helm ./kind > "${kustomized}"
 kubectl apply -f "${kustomized}" || true
 kubectl wait --for=condition=Ready pods --all -n cert-manager --timeout=5m
 kubectl wait --for=condition=Ready pods --all -n external-secrets --timeout=5m