diff --git a/manifests/ate-install/actortemplate-vap.yaml b/manifests/ate-install/actortemplate-vap.yaml
new file mode 100644
index 0000000..e07fae3
--- /dev/null
+++ b/manifests/ate-install/actortemplate-vap.yaml
@@ -0,0 +1,39 @@
+#  Copyright 2026 Google LLC
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "actortemplate-validation.actortemplates.ate.dev"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   ["ate.dev"]
+      apiVersions: ["v1alpha1"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["actortemplates"]
+  validations:
+    - expression: 'object.spec.containers.all(c, c.image.contains("@"))'
+      messageExpression: '"All images must be pinned to a specific SHA"'
+
+---
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "actortemplate-validation-binding.actortemplates.ate.dev"
+spec:
+  policyName: "actortemplate-validation.actortemplates.ate.dev"
+  validationActions: [Deny]