diff --git a/.github/workflows/selftest.yml b/.github/workflows/selftest.yml
index fb8cbd5..a74c4e4 100644
--- a/.github/workflows/selftest.yml
+++ b/.github/workflows/selftest.yml
@@ -59,6 +59,10 @@ jobs:
         with:
           persist-credentials: false
       - run: scripts/install-tool.sh shellcheck
+      - name: helm from tools.lock
+        run: |
+          scripts/install-tool.sh helm
+          "$RUNNER_TEMP/bin/helm" version --short | grep -q '^v3\.22\.0'
       - name: shellcheck
         run: shellcheck scripts/*.sh
       - name: sarif-summary unit tests
diff --git a/tools.lock b/tools.lock
index 2dd8904..97734b1 100644
--- a/tools.lock
+++ b/tools.lock
@@ -17,6 +17,7 @@ pinact      5.0.0   d005bbb85da80dacdc07816f24a5da723a9f6d1e9f3d3e7e73df33f9caa1
 shellcheck  0.11.0  8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198  https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz  shellcheck-v0.11.0/shellcheck
 just        1.59.0  409044617b6f06517c1035e55ca38c8c856ff8b650e41bc2aa1ef82d5903a23e  https://github.com/casey/just/releases/download/1.59.0/just-1.59.0-x86_64-unknown-linux-musl.tar.gz  just
 kubeconform 0.8.0   9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883  https://github.com/yannh/kubeconform/releases/download/v0.8.0/kubeconform-linux-amd64.tar.gz  kubeconform
+helm        3.22.0  1e4ab49e429626cf6c6958d914248b78c9730803c2751b87627e171dc800e7bb  https://get.helm.sh/helm-v3.22.0-linux-amd64.tar.gz  linux-amd64/helm
 bun         1.3.13  79c0771fa8b92c33aae41e15a0e0d307ea99d0e2f00317c71c6c53237a78e25a  https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-linux-x64.zip  bun-linux-x64/bun
 uv          0.13.0  1468ebd5a5541121837c5a2817b9972ba6090fa6caa3d142620850a47fb75154  https://github.com/astral-sh/uv/releases/download/0.13.0/uv-x86_64-unknown-linux-gnu.tar.gz  uv-x86_64-unknown-linux-gnu/uv
 uvx         0.13.0  1468ebd5a5541121837c5a2817b9972ba6090fa6caa3d142620850a47fb75154  https://github.com/astral-sh/uv/releases/download/0.13.0/uv-x86_64-unknown-linux-gnu.tar.gz  uv-x86_64-unknown-linux-gnu/uvx