diff --git a/services/maintenance/metis-configmap.yaml b/services/maintenance/metis-configmap.yaml
index 070752bd..ab420ebc 100644
--- a/services/maintenance/metis-configmap.yaml
+++ b/services/maintenance/metis-configmap.yaml
@@ -11,11 +11,11 @@ data:
   METIS_DEFAULT_FLASH_HOST: titan-22
   METIS_FLASH_HOSTS: titan-22
   METIS_LOCAL_HOST: titan-22
-  METIS_ALLOWED_GROUPS: admin,maintenance,maintainer
+  METIS_ALLOWED_GROUPS: admin,maintenance
   METIS_MAX_DEVICE_BYTES: "300000000000"
   METIS_NAMESPACE: maintenance
-  METIS_RUNNER_IMAGE_AMD64: registry.bstein.dev/bstein/metis:0.1.0-14-amd64
-  METIS_RUNNER_IMAGE_ARM64: registry.bstein.dev/bstein/metis:0.1.0-14-arm64
+  METIS_RUNNER_IMAGE_AMD64: registry.bstein.dev/bstein/metis:0.1.0-15-amd64
+  METIS_RUNNER_IMAGE_ARM64: registry.bstein.dev/bstein/metis:0.1.0-15-arm64
   METIS_HARBOR_REGISTRY: registry.bstein.dev
   METIS_HARBOR_PROJECT: metis
   METIS_HARBOR_API_BASE: https://registry.bstein.dev/api/v2.0
diff --git a/services/maintenance/metis-deployment.yaml b/services/maintenance/metis-deployment.yaml
index c060c623..ec9dd3d6 100644
--- a/services/maintenance/metis-deployment.yaml
+++ b/services/maintenance/metis-deployment.yaml
@@ -27,7 +27,7 @@ spec:
         node-role.kubernetes.io/accelerator: "true"
       containers:
         - name: metis
-          image: registry.bstein.dev/bstein/metis:0.1.0-14-amd64
+          image: registry.bstein.dev/bstein/metis:0.1.0-15-amd64
           imagePullPolicy: Always
           envFrom:
             - configMapRef:
diff --git a/services/maintenance/oauth2-proxy-metis.yaml b/services/maintenance/oauth2-proxy-metis.yaml
index 8ffd311b..34207b05 100644
--- a/services/maintenance/oauth2-proxy-metis.yaml
+++ b/services/maintenance/oauth2-proxy-metis.yaml
@@ -82,8 +82,6 @@ spec:
             - --allowed-group=/admin
             - --allowed-group=maintenance
             - --allowed-group=/maintenance
-            - --allowed-group=maintainer
-            - --allowed-group=/maintainer
             - --set-xauthrequest=true
             - --pass-access-token=true
             - --set-authorization-header=true