diff --git a/scripts/lib/gitops-functions.sh b/scripts/lib/gitops-functions.sh
index 9f88ce3..5c4cf71 100755
--- a/scripts/lib/gitops-functions.sh
+++ b/scripts/lib/gitops-functions.sh
@@ -36,7 +36,17 @@ update_file() {
   echo "Check if path ${file} ${field} exists and get old current version"
   yq -e ."${field}" "${file}"
   echo "Run update ${file} ${field} ${image}"
-  yq -i ."${field}"=\""${image}"\" "${file}"
+  if [[ "${field}" == *.tag ]]; then
+    yq -i ".${field}=\"${INPUT_TAG}\"" "${file}"
+  else
+    local field_type
+    field_type=$(yq "(.${field} | type)" "${file}" 2>/dev/null || echo "!!null")
+    if [[ "${field_type}" == "!!map" ]] && yq -e ".${field}.tag" "${file}" > /dev/null 2>&1; then
+      yq -i ".${field}.tag=\"${INPUT_TAG}\"" "${file}"
+    else
+      yq -i ."${field}"=\""${image}"\" "${file}"
+    fi
+  fi
 
   echo "Writing deployment annotations to ${file}"
   yq -i '.metadata.annotations["deploy.staffbase.com/repositoryFullName"] = "'"${GITHUB_REPOSITORY}"'"' "${file}"
diff --git a/tests/fixtures/helmrelease.yaml b/tests/fixtures/helmrelease.yaml
new file mode 100644
index 0000000..39de195
--- /dev/null
+++ b/tests/fixtures/helmrelease.yaml
@@ -0,0 +1,13 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: my-service
+  namespace: my-service
+  annotations: {}
+spec:
+  values:
+    workload:
+      container:
+        image:
+          repository: registry.staffbase.com/sb-images/my-service
+          tag: placeholder
diff --git a/tests/lib-gitops-functions.bats b/tests/lib-gitops-functions.bats
index aafa1bd..81fa67e 100644
--- a/tests/lib-gitops-functions.bats
+++ b/tests/lib-gitops-functions.bats
@@ -51,6 +51,38 @@ teardown() {
 
 # --- update_file ---
 
+@test "update_file writes full URI when field value is a scalar" {
+  cat > "${TEST_TEMP_DIR}/mocks/yq" << 'YQ_MOCK'
+#!/usr/bin/env bash
+echo "yq $*" >> "${MOCK_CALLS_DIR}/yq_calls.log"
+if [[ "$*" == *"| type"* ]]; then echo "!!str"; fi
+exit 0
+YQ_MOCK
+  chmod +x "${TEST_TEMP_DIR}/mocks/yq"
+  update_file "deployment.yaml" "spec.template.spec.containers.app.image" "$IMAGE"
+  grep -q "${IMAGE}" "${TEST_TEMP_DIR}/yq_calls.log"
+  ! grep -q ".tag=\"${INPUT_TAG}\"" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
+@test "update_file writes tag to .tag subfield when field is a map with tag property" {
+  cat > "${TEST_TEMP_DIR}/mocks/yq" << 'YQ_MOCK'
+#!/usr/bin/env bash
+echo "yq $*" >> "${MOCK_CALLS_DIR}/yq_calls.log"
+if [[ "$*" == *"| type"* ]]; then echo "!!map"; fi
+exit 0
+YQ_MOCK
+  chmod +x "${TEST_TEMP_DIR}/mocks/yq"
+  update_file "helmrelease.yaml" "spec.values.workload.container.image" "$IMAGE"
+  grep -q ".spec.values.workload.container.image.tag=\"${INPUT_TAG}\"" "${TEST_TEMP_DIR}/yq_calls.log"
+  ! grep -q "${IMAGE}" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
+@test "update_file writes tag only when field path ends with .tag" {
+  update_file "helmrelease.yaml" "spec.values.workload.container.image.tag" "$IMAGE"
+  grep -q ".spec.values.workload.container.image.tag=\"${INPUT_TAG}\"" "${TEST_TEMP_DIR}/yq_calls.log"
+  ! grep -q "${IMAGE}" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
 @test "update_file calls yq to check and update field" {
   update_file "deployment.yaml" "spec.image" "$IMAGE"
   assert [ -f "${TEST_TEMP_DIR}/yq_calls.log" ]