diff --git a/infrastructure/longhorn/core/kustomization.yaml b/infrastructure/longhorn/core/kustomization.yaml
index 82ad411..deb5308 100644
--- a/infrastructure/longhorn/core/kustomization.yaml
+++ b/infrastructure/longhorn/core/kustomization.yaml
@@ -7,4 +7,12 @@ resources:
   - secretproviderclass.yaml
   - vault-sync-deployment.yaml
   - helmrelease.yaml
-  - settings.yaml
+  - longhorn-settings-ensure-job.yaml
+
+configMapGenerator:
+  - name: longhorn-settings-ensure-script
+    files:
+      - longhorn_settings_ensure.sh=scripts/longhorn_settings_ensure.sh
+
+generatorOptions:
+  disableNameSuffixHash: true
diff --git a/infrastructure/longhorn/core/longhorn-settings-ensure-job.yaml b/infrastructure/longhorn/core/longhorn-settings-ensure-job.yaml
new file mode 100644
index 0000000..ba5927a
--- /dev/null
+++ b/infrastructure/longhorn/core/longhorn-settings-ensure-job.yaml
@@ -0,0 +1,36 @@
+# infrastructure/longhorn/core/longhorn-settings-ensure-job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: longhorn-settings-ensure-1
+  namespace: longhorn-system
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      serviceAccountName: longhorn-service-account
+      restartPolicy: Never
+      volumes:
+        - name: longhorn-settings-ensure-script
+          configMap:
+            name: longhorn-settings-ensure-script
+            defaultMode: 0555
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+      containers:
+        - name: apply
+          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
+          command: ["/scripts/longhorn_settings_ensure.sh"]
+          volumeMounts:
+            - name: longhorn-settings-ensure-script
+              mountPath: /scripts
+              readOnly: true
diff --git a/infrastructure/longhorn/core/scripts/longhorn_settings_ensure.sh b/infrastructure/longhorn/core/scripts/longhorn_settings_ensure.sh
new file mode 100644
index 0000000..0bc3446
--- /dev/null
+++ b/infrastructure/longhorn/core/scripts/longhorn_settings_ensure.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+namespace="longhorn-system"
+
+patch_setting() {
+  local name="$1"
+  local value="$2"
+
+  kubectl -n "${namespace}" patch setting.longhorn.io "${name}" \
+    --type=merge \
+    -p "{\"value\":\"${value}\"}" >/dev/null
+}
+
+patch_setting default-engine-image "registry.bstein.dev/infra/longhorn-engine:v1.8.2"
+patch_setting default-instance-manager-image "registry.bstein.dev/infra/longhorn-instance-manager:v1.8.2"
+patch_setting default-backing-image-manager-image "registry.bstein.dev/infra/longhorn-backing-image-manager:v1.8.2"
+patch_setting support-bundle-manager-image "registry.bstein.dev/infra/longhorn-support-bundle-kit:v0.0.56"
diff --git a/infrastructure/longhorn/core/settings.yaml b/infrastructure/longhorn/core/settings.yaml
deleted file mode 100644
index 45b51d4..0000000
--- a/infrastructure/longhorn/core/settings.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# infrastructure/longhorn/core/settings.yaml
-apiVersion: longhorn.io/v1beta2
-kind: Setting
-metadata:
-  name: default-engine-image
-  namespace: longhorn-system
-value: registry.bstein.dev/infra/longhorn-engine:v1.8.2
----
-apiVersion: longhorn.io/v1beta2
-kind: Setting
-metadata:
-  name: default-instance-manager-image
-  namespace: longhorn-system
-value: registry.bstein.dev/infra/longhorn-instance-manager:v1.8.2
----
-apiVersion: longhorn.io/v1beta2
-kind: Setting
-metadata:
-  name: default-backing-image-manager-image
-  namespace: longhorn-system
-value: registry.bstein.dev/infra/longhorn-backing-image-manager:v1.8.2
----
-apiVersion: longhorn.io/v1beta2
-kind: Setting
-metadata:
-  name: support-bundle-manager-image
-  namespace: longhorn-system
-value: registry.bstein.dev/infra/longhorn-support-bundle-kit:v0.0.56