diff --git a/.github/workflows/service.yml b/.github/workflows/service.yml
index 4a8f1c0..75f6958 100644
--- a/.github/workflows/service.yml
+++ b/.github/workflows/service.yml
@@ -104,6 +104,9 @@ jobs:
         with:
           context: service
           push: true
-          tags: ghcr.io/airframesio/coverage-service:latest
+          # The sha tag gives production an immutable reference to pin.
+          tags: |
+            ghcr.io/airframesio/coverage-service:latest
+            ghcr.io/airframesio/coverage-service:sha-${{ github.sha }}
           cache-from: type=gha,scope=service
           cache-to: type=gha,scope=service,mode=max
diff --git a/service/src/index.ts b/service/src/index.ts
index 1ffc87b..d2761e7 100644
--- a/service/src/index.ts
+++ b/service/src/index.ts
@@ -12,7 +12,8 @@ async function main() {
   console.log(`Port: ${config.port}`);
   console.log(`NATS: ${config.natsUrl}`);
   console.log(`Main API: ${config.mainApiUrl}`);
-  console.log(`Database: ${config.databaseUrl}`);
+  // Never log the connection string as is: it carries the database password.
+  console.log(`Database: ${config.databaseUrl.replace(/\/\/([^:@/]+):[^@/]*@/, '//$1:***@')}`);
 
   // 1. Initialize coverage store
   const store = new CoverageStore();