diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 52c89d45..5d60a4d2 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -705,9 +705,8 @@ data:
             # AND (&(sambaDomainName=...)(objectClass=sambaDomain))
             # return entries instead of short-circuiting. Built from
             # the samba-bridge repo at
-            # gitea.renner.uno/konairius/authentik-samba-bridge ; the tag is
-            # tracked by Flux in helmrelease.yaml global.env.
-            container_image: !Env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE
+            # gitea.renner.uno/konairius/authentik-samba-bridge .
+            container_image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655
             object_naming_template: "ak-outpost-%(name)s"
             kubernetes_namespace: authentik
             kubernetes_replicas: 1