diff --git a/services/keycloak/synapse-oidc-secret-ensure-job.yaml b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
index 69a6698..16a7283 100644
--- a/services/keycloak/synapse-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: synapse-oidc-secret-ensure-2
+  name: synapse-oidc-secret-ensure-3
   namespace: sso
 spec:
   backoffLimit: 0
@@ -13,13 +13,12 @@ spec:
       restartPolicy: Never
       containers:
         - name: apply
-          image: bitnami/kubectl:latest
+          image: alpine:3.20
           command: ["/bin/sh", "-c"]
           args:
             - |
               set -euo pipefail
-              apt-get update >/dev/null
-              apt-get install -y curl jq >/dev/null
+              apk add --no-cache curl jq kubectl >/dev/null
 
               KC_URL="http://keycloak.sso.svc.cluster.local"
               ACCESS_TOKEN=""