diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa1d9a395a97..654aa71d8fe1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,6 +61,7 @@ Main (unreleased)
 
 - Flow: improve river config validation step in `prometheus.scrape` by comparing `scrape_timeout` with `scrape_interval`. (@wildum)
 
+
 ### Other changes
 
 - Use Go 1.21.1 for builds. (@rfratto)
diff --git a/operations/helm/charts/grafana-agent/CHANGELOG.md b/operations/helm/charts/grafana-agent/CHANGELOG.md
index 1969dc92c7fe..7104cf1d004f 100644
--- a/operations/helm/charts/grafana-agent/CHANGELOG.md
+++ b/operations/helm/charts/grafana-agent/CHANGELOG.md
@@ -10,6 +10,10 @@ internal API changes are not present.
 Unreleased
 ----------
 
+### Enhancements
+
+- An image's digest can now be used in place of a tag. (@hainenber)
+
 0.24.0 (2023-09-08)
 -------------------
 
diff --git a/operations/helm/charts/grafana-agent/README.md b/operations/helm/charts/grafana-agent/README.md
index 7240c4e332e4..f2982e5f9c1d 100644
--- a/operations/helm/charts/grafana-agent/README.md
+++ b/operations/helm/charts/grafana-agent/README.md
@@ -62,6 +62,7 @@ use the older mode (called "static mode"), set the `agent.mode` value to
 | agent.storagePath | string | `"/tmp/agent"` | Path to where Grafana Agent stores data (for example, the Write-Ahead Log). By default, data is lost between reboots. |
 | configReloader.customArgs | list | `[]` | Override the args passed to the container. |
 | configReloader.enabled | bool | `true` | Enables automatically reloading when the agent config changes. |
+| configReloader.image.digest | string | `""` | SHA256 digest of image to use for config reloading (either in format "sha256:XYZ" or "XYZ"). When set, will override `configReloader.image.tag` |
 | configReloader.image.registry | string | `"docker.io"` | Config reloader image registry (defaults to docker.io) |
 | configReloader.image.repository | string | `"jimmidyson/configmap-reload"` | Repository to get config reloader image from. |
 | configReloader.image.tag | string | `"v0.8.0"` | Tag of image to use for config reloading. |
@@ -92,6 +93,7 @@ use the older mode (called "static mode"), set the `agent.mode` value to
 | global.image.pullSecrets | list | `[]` | Optional set of global image pull secrets. |
 | global.image.registry | string | `""` | Global image registry to use if it needs to be overriden for some specific use cases (e.g local registries, custom images, ...) |
 | global.podSecurityContext | object | `{}` | Security context to apply to the Grafana Agent pod. |
+| image.digest | string | `nil` | Grafana Agent image's SHA256 digest (either in format "sha256:XYZ" or "XYZ"). When set, will override `image.tag`. |
 | image.pullPolicy | string | `"IfNotPresent"` | Grafana Agent image pull policy. |
 | image.pullSecrets | list | `[]` | Optional set of image pull secrets. |
 | image.registry | string | `"docker.io"` | Grafana Agent image registry (defaults to docker.io) |
diff --git a/operations/helm/charts/grafana-agent/templates/_helpers.tpl b/operations/helm/charts/grafana-agent/templates/_helpers.tpl
index 0aa65bf0e964..b9336e976d62 100644
--- a/operations/helm/charts/grafana-agent/templates/_helpers.tpl
+++ b/operations/helm/charts/grafana-agent/templates/_helpers.tpl
@@ -82,13 +82,36 @@ Create the name of the service account to use
 {{- end }}
 
 {{/*
-Calculate name of image tag to use.
+Calculate name of image ID to use for "grafana-agent".
 */}}
-{{- define "grafana-agent.imageTag" -}}
-{{- if .Values.image.tag -}}
-{{- .Values.image.tag }}
-{{- else -}}
-{{- .Chart.AppVersion }}
+{{- define "grafana-agent.imageId" -}}
+{{- if .Values.image.digest }}
+{{- $digest := .Values.image.digest }}
+{{- if not (hasPrefix "sha256:" $digest) }}
+{{- $digest = printf "sha256:%s" $digest }}
+{{- end }}
+{{- printf "@%s" $digest }}
+{{- else if .Values.image.tag }}
+{{- printf ":%s" .Values.image.tag }}
+{{- else }}
+{{- printf ":%s" .Chart.AppVersion }}
+{{- end }}
+{{- end }}
+
+{{/*
+Calculate name of image ID to use for "config-reloader".
+*/}}
+{{- define "config-reloader.imageId" -}}
+{{- if .Values.configReloader.image.digest }}
+{{- $digest := .Values.configReloader.digest }}
+{{- if not (hasPrefix "sha256:" $digest) }}
+{{- $digest = printf "sha256:%s" $digest }}
+{{- end }}
+{{- printf "@%s" $digest }}
+{{- else if .Values.configReloader.image.tag }}
+{{- printf ":%s" .Values.configReloader.image.tag }}
+{{- else }}
+{{- printf ":%s" "v0.8.0" }}
 {{- end }}
 {{- end }}
 
diff --git a/operations/helm/charts/grafana-agent/templates/containers/_agent.yaml b/operations/helm/charts/grafana-agent/templates/containers/_agent.yaml
index 7563e11b96a7..2de13343258c 100644
--- a/operations/helm/charts/grafana-agent/templates/containers/_agent.yaml
+++ b/operations/helm/charts/grafana-agent/templates/containers/_agent.yaml
@@ -1,6 +1,6 @@
 {{- define "grafana-agent.container" -}}
 - name: grafana-agent
-  image: {{ .Values.global.image.registry | default .Values.image.registry }}/{{ .Values.image.repository }}:{{ include "grafana-agent.imageTag" . }}
+  image: {{ .Values.global.image.registry | default .Values.image.registry }}/{{ .Values.image.repository }}{{ include "grafana-agent.imageId" . }}
   imagePullPolicy: {{ .Values.image.pullPolicy }}
   args:
     {{- if eq .Values.agent.mode "flow"}}
diff --git a/operations/helm/charts/grafana-agent/templates/containers/_watch.yaml b/operations/helm/charts/grafana-agent/templates/containers/_watch.yaml
index 410e56eeeafe..250e4b4f0da7 100644
--- a/operations/helm/charts/grafana-agent/templates/containers/_watch.yaml
+++ b/operations/helm/charts/grafana-agent/templates/containers/_watch.yaml
@@ -1,7 +1,7 @@
 {{- define "grafana-agent.watch-container" -}}
 {{- if .Values.configReloader.enabled -}}
 - name: config-reloader
-  image: {{ .Values.global.image.registry | default .Values.configReloader.image.registry }}/{{ .Values.configReloader.image.repository }}:{{ .Values.configReloader.image.tag }}
+  image: {{ .Values.global.image.registry | default .Values.configReloader.image.registry }}/{{ .Values.configReloader.image.repository }}{{ include "config-reloader.imageId" . }}
   {{- if .Values.configReloader.customArgs }}
   args:
     {{- toYaml .Values.configReloader.customArgs | nindent 4 }}
diff --git a/operations/helm/charts/grafana-agent/values.yaml b/operations/helm/charts/grafana-agent/values.yaml
index b51efbeafdfb..da4a1b737073 100644
--- a/operations/helm/charts/grafana-agent/values.yaml
+++ b/operations/helm/charts/grafana-agent/values.yaml
@@ -99,6 +99,8 @@ image:
   # -- (string) Grafana Agent image tag. When empty, the Chart's appVersion is
   # used.
   tag: null
+  # -- Grafana Agent image's SHA256 digest (either in format "sha256:XYZ" or "XYZ"). When set, will override `image.tag`.
+  digest: null
   # -- Grafana Agent image pull policy.
   pullPolicy: IfNotPresent
   # -- Optional set of image pull secrets.
@@ -128,6 +130,8 @@ configReloader:
     repository: jimmidyson/configmap-reload
     # -- Tag of image to use for config reloading.
     tag: v0.8.0
+    # -- SHA256 digest of image to use for config reloading (either in format "sha256:XYZ" or "XYZ"). When set, will override `configReloader.image.tag`
+    digest: ""
   # -- Override the args passed to the container.
   customArgs: []
   # -- Resource requests and limits to apply to the config reloader container.