# Which trust-manager Helm value pins the tag of the default CA package image?

cert-manager, Easy (Beginner), Security. https://k8wiz.com/uquiz/which-trust-manager-helm-value-pins-the-tag-of-the-default-ca-package-image

- A. defaultPackageImage.tag
- B. defaultCAPackage.version
- C. image.defaultCAs.tag
- D. bundle.defaultCATag

**Answer:** defaultPackageImage.tag

**Explanation:** The default CA package is set with defaultPackageImage.repository and defaultPackageImage.tag. If you can't upgrade to trust-manager v0.26.0, the docs say to set defaultPackageImage.tag to a fixed tag such as 20250419-deb13u1.0 or newer, quoted so it stays a string.