diff --git a/services/comms/comms-secrets-ensure-job.yaml b/services/comms/comms-secrets-ensure-job.yaml
index 674f1fd..62e945e 100644
--- a/services/comms/comms-secrets-ensure-job.yaml
+++ b/services/comms/comms-secrets-ensure-job.yaml
@@ -20,7 +20,6 @@ spec:
               set -eu
               trap 'echo "comms-secrets-ensure failed"; sleep 300' ERR
               umask 077
-              apk add --no-cache curl jq >/dev/null
 
               safe_pass() {
                 head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
diff --git a/services/comms/mas-admin-client-secret-ensure-job.yaml b/services/comms/mas-admin-client-secret-ensure-job.yaml
index 5d47c7d..d9f0e94 100644
--- a/services/comms/mas-admin-client-secret-ensure-job.yaml
+++ b/services/comms/mas-admin-client-secret-ensure-job.yaml
@@ -67,8 +67,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/comms/mas-db-ensure-job.yaml b/services/comms/mas-db-ensure-job.yaml
index b843646..030c73a 100644
--- a/services/comms/mas-db-ensure-job.yaml
+++ b/services/comms/mas-db-ensure-job.yaml
@@ -24,8 +24,6 @@ spec:
                 head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
               }
 
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/comms/synapse-signingkey-ensure-job.yaml b/services/comms/synapse-signingkey-ensure-job.yaml
index 9439f22..ae30561 100644
--- a/services/comms/synapse-signingkey-ensure-job.yaml
+++ b/services/comms/synapse-signingkey-ensure-job.yaml
@@ -37,8 +37,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/keycloak/mas-secrets-ensure-job.yaml b/services/keycloak/mas-secrets-ensure-job.yaml
index 9d59479..1ae1c9d 100644
--- a/services/keycloak/mas-secrets-ensure-job.yaml
+++ b/services/keycloak/mas-secrets-ensure-job.yaml
@@ -95,8 +95,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-sso-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"