diff --git a/deploy/helm/a2a-shared/values-prod.yaml b/deploy/helm/a2a-shared/values-prod.yaml
index dda47b3..6478113 100644
--- a/deploy/helm/a2a-shared/values-prod.yaml
+++ b/deploy/helm/a2a-shared/values-prod.yaml
@@ -19,7 +19,7 @@ a2a:
 
   image:
     repository: ghcr.io/izzywdev/fuzeagent-a2a
-    tag: 5772f14a7a75
+    tag: 3f3d4082c06f
     pullPolicy: IfNotPresent
 
   service:
diff --git a/deploy/helm/fuzeagent/values-prod.yaml b/deploy/helm/fuzeagent/values-prod.yaml
index 4254898..b41002a 100644
--- a/deploy/helm/fuzeagent/values-prod.yaml
+++ b/deploy/helm/fuzeagent/values-prod.yaml
@@ -14,7 +14,7 @@ imagePullSecrets:
 orchestrator:
   image:
     repository: ghcr.io/izzywdev/fuzeagent-orchestrator
-    tag: 5772f14a7a75
+    tag: 3f3d4082c06f
   # First-light guardrails (also the chart default; pinned here for clarity).
   execution:
     autonomous: false
@@ -30,17 +30,17 @@ orchestrator:
 hierarchyApi:
   image:
     repository: ghcr.io/izzywdev/fuzeagent-hierarchy-api
-    tag: 5772f14a7a75
+    tag: 3f3d4082c06f
 
 ui:
   image:
     repository: ghcr.io/izzywdev/fuzeagent-ui
-    tag: 5772f14a7a75
+    tag: 3f3d4082c06f
 
 mcpServer:
   image:
     repository: ghcr.io/izzywdev/fuzeagent-mcp-server
-    tag: 5772f14a7a75
+    tag: 3f3d4082c06f
 
 # Admin console — host sits under the *.prod.fuzefront.com wildcard, which is
 # already behind Cloudflare Access email-OTP + routed through the CF tunnel to