diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml
index 5e2203f..cd18a2e 100644
--- a/cloudformation/values/dns-override.values.yaml
+++ b/cloudformation/values/dns-override.values.yaml
@@ -14,7 +14,7 @@ replicaCount: 2
 
 image:
   repository: socketdev/socket-registry-firewall
-  tag: "1.1.328"   # pin; do not use :latest for a security product
+  tag: "1.1.335"   # pin; do not use :latest for a security product
 
 socket:
   # Injected at install time from AWS Secrets Manager by the CloudFormation
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index 55976fb..87ffcd5 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: socket-firewall
 description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster
 type: application
-version: 0.4.0
-appVersion: "1.1.328"
+version: 0.4.1
+appVersion: "1.1.335"
 keywords:
   - security
   - supply-chain
diff --git a/helm/values.yaml b/helm/values.yaml
index 7d7d316..92f7275 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -5,7 +5,7 @@ image:
   repository: socketdev/socket-registry-firewall
   # Defaults to the latest published image so deployments pick up new releases
   # without a chart bump. Pin a version for reproducibility, e.g. tag: "1.1.327".
-  tag: "1.1.328"
+  tag: "1.1.335"
   # Always (not IfNotPresent) so "latest" actually refreshes on pod restart.
   pullPolicy: Always