diff --git a/kubernetes/infrastructure/bird/daemonset.yaml b/kubernetes/infrastructure/bird/daemonset.yaml
index 75eace14..645d72ea 100644
--- a/kubernetes/infrastructure/bird/daemonset.yaml
+++ b/kubernetes/infrastructure/bird/daemonset.yaml
@@ -60,9 +60,12 @@ spec:
           effect: NoSchedule
       initContainers:
         - name: render-config
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          # The dated tag is rebuilt within the day it names.
-          imagePullPolicy: Always
+          # By digest, not by the dated tag: the tag is rebuilt within the day
+          # it names, and the cluster's image path keeps resolving it to the
+          # first build of that day — imagePullPolicy: Always does not help,
+          # because the tag itself resolves stale. Update this when the image
+          # is rebuilt.
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -88,8 +91,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          imagePullPolicy: Always
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           resources:
             requests:
               cpu: "50m"