diff --git a/catalog.yaml b/catalog.yaml
index 0d4652d..cd1d994 100644
--- a/catalog.yaml
+++ b/catalog.yaml
@@ -2,7 +2,7 @@ charts:
   - name: keiailab-commons
     version: 0.8.1
   - name: mongodb-operator
-    version: 1.16.7
+    version: 1.16.8
   - name: valkey-operator
     version: 1.5.1
   - name: nodevitals
diff --git a/index.yaml b/index.yaml
index 6722c0b..4ab9c58 100644
--- a/index.yaml
+++ b/index.yaml
@@ -20,7 +20,7 @@ entries:
         url: https://raw.githubusercontent.com/keiailab/keiailab-commons/main/charts/keiailab-helm-signing-public.asc
     apiVersion: v2
     appVersion: 0.8.0
-    created: '2026-07-30T09:04:37.483526368Z'
+    created: '2026-07-30T14:07:57.167708174Z'
     description: 'Keiailab commons Helm library chart. downstream consumer 가 공유하는
       partial helper (commonLabels / observability.serviceMonitor 등) 를 제공한다. type:
       library — consumer chart 가 dependency 로 import. '
@@ -49,9 +49,9 @@ entries:
   - annotations:
       artifacthub.io/category: database
       artifacthub.io/changes: |
-        - kind: security
-          description: "MongoDBSearch now drops the auto-created searchCoordinator (search-sync) user from the source on CR deletion via a finalizer. Previously the privileged user was never garbage-collected (no finalizer/dropUser), so deleting a MongoDBSearch left an orphaned searchCoordinator account on the source — a privilege-leak (on sharded clusters it lingered on the config server and every shard). The cleanup drops the user on RS (pod-0) and Sharded (mongos + each shard); it is leak-free (only a deleted source is best-effort skipped — a transient-unavailable source retries) and targets only operator-managed users (identified by the managed-by sync secret, not the current spec value)."
-      artifacthub.io/containsSecurityUpdates: 'true'
+        - kind: fixed
+          description: "artifacthub.io/images now points the operator image at the public registry (ghcr.io/keiailab/mongodb-operator:v1.16.6). The annotation was left at the internal-only harbor.keiailab.dev registry pinned to a stale v1.16.4 tag, so Artifact Hub's security scanner could not resolve the host and every scan of the package errored out — the chart itself has defaulted to ghcr.io since 1.16.7. Chart-only metadata release, no operator changes."
+      artifacthub.io/containsSecurityUpdates: 'false'
       artifacthub.io/crds: |
         - kind: MongoDB
           version: v1alpha1
@@ -126,7 +126,7 @@ entries:
                   name: s3-credentials
       artifacthub.io/images: |
         - name: mongodb-operator
-          image: harbor.keiailab.dev/keiailab/platform/mongodb-operator:v1.16.4
+          image: ghcr.io/keiailab/mongodb-operator:v1.16.6
         - name: mongodb
           image: mongo:8.3.1
         - name: mongodb-exporter
@@ -158,14 +158,14 @@ entries:
         url: https://raw.githubusercontent.com/KeiaiLab/mongodb-operator/main/charts/keiailab-helm-signing-public.asc
     apiVersion: v2
     appVersion: 1.16.6
-    created: '2026-07-30T09:04:37.500697426Z'
+    created: '2026-07-30T14:07:57.186850543Z'
     dependencies:
     - name: keiailab-commons
       repository: oci://ghcr.io/keiailab/charts
       version: 0.8.0
     description: A Kubernetes Operator for MongoDB — ReplicaSets, Sharded Clusters
       with auto scale-out, S3/PVC Backup, TLS, and LDAP. MIT licensed.
-    digest: 8dea8fadee179b2ba7fc50a16da0df9cb1a80f650366999c13e721e107a2021a
+    digest: 10d7107694d39e39c813ee7aaf5935435eebf50530de0b398e5d0e903765d461
     home: https://github.com/keiailab/mongodb-operator
     icon: https://raw.githubusercontent.com/KeiaiLab/mongodb-operator/main/docs/branding/symbol.png
     keywords:
@@ -195,8 +195,8 @@ entries:
     - https://github.com/keiailab/mongodb-operator
     type: application
     urls:
-    - oci://ghcr.io/keiailab/charts/mongodb-operator:1.16.7
-    version: 1.16.7
+    - oci://ghcr.io/keiailab/charts/mongodb-operator:1.16.8
+    version: 1.16.8
   nodevitals:
   - annotations:
       artifacthub.io/category: monitoring-logging
@@ -218,7 +218,7 @@ entries:
           url: https://raw.githubusercontent.com/KeiaiLab/nodevitals/main/docs/branding/symbol.png
     apiVersion: v2
     appVersion: 0.8.2
-    created: '2026-07-30T09:04:37.501621243Z'
+    created: '2026-07-30T14:07:57.187825835Z'
     description: Unified hardware telemetry agent for Kubernetes nodes
     digest: d9e7e5894f16af44650a0fef941fe52dd87a335e0537433aa05ae81e65af865e
     home: https://github.com/keiailab/nodevitals
@@ -256,7 +256,7 @@ entries:
       artifacthub.io/operator: 'true'
     apiVersion: v2
     appVersion: v0.7.0
-    created: '2026-07-30T09:04:37.50233147Z'
+    created: '2026-07-30T14:07:57.188566142Z'
     description: A Kubernetes Operator for the Qdrant vector database — declarative
       QdrantCluster provisioning, distributed (Raft) clusters, scale-out. MIT licensed.
     digest: 4481895cfb7e79db0a459fc9d34da97d3eab0e4a654fa9edbcb664f19f5033e0
@@ -377,7 +377,7 @@ entries:
           url: https://raw.githubusercontent.com/KeiaiLab/valkey-operator/main/docs/branding/symbol.png
     apiVersion: v2
     appVersion: 1.5.1
-    created: '2026-07-30T09:04:37.50615049Z'
+    created: '2026-07-30T14:07:57.192760502Z'
     dependencies:
     - name: keiailab-commons
       repository: oci://ghcr.io/keiailab/charts
@@ -408,4 +408,4 @@ entries:
     urls:
     - oci://ghcr.io/keiailab/charts/valkey-operator:1.5.1
     version: 1.5.1
-generated: '2026-07-30T09:04:37Z'
+generated: '2026-07-30T14:07:57Z'