diff --git a/services/comms/oneoffs/synapse-admin-ensure-job.yaml b/services/comms/oneoffs/synapse-admin-ensure-job.yaml
index 245adba..33ccd79 100644
--- a/services/comms/oneoffs/synapse-admin-ensure-job.yaml
+++ b/services/comms/oneoffs/synapse-admin-ensure-job.yaml
@@ -1,12 +1,12 @@
 # services/comms/oneoffs/synapse-admin-ensure-job.yaml
-# One-off job for comms/synapse-admin-ensure-6.
-# Purpose: synapse admin ensure 6 (see container args/env in this file).
+# One-off job for comms/synapse-admin-ensure-7.
+# Purpose: synapse admin ensure 7 (see container args/env in this file).
 # Run by setting spec.suspend to false, reconcile, then set it back to true.
 # Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: synapse-admin-ensure-6
+  name: synapse-admin-ensure-7
   namespace: comms
 spec:
   suspend: false
@@ -33,6 +33,7 @@ spec:
       containers:
         - name: ensure
           image: registry.bstein.dev/infra/synapse-admin-ensure:0.1.0
+          imagePullPolicy: Always
           env:
             - name: VAULT_ADDR
               value: http://vault.vault.svc.cluster.local:8200