I don’t remember much about how to use kubernetes but if you can specify a tag like nextcloud:28 instead of nextcloud:latest you should have a safer time with upgrades. Then make sure you always upgrade all the way before moving to a newer major version, this is crucial.

There are varying degrees of version specificity available: https://hub.docker.com/_/nextcloud/tags

Make sure you’re periodically evaluating your site with https://scan.nextcloud.com/ and following all of the recommended best practices.