diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 030fe12..d143ac2 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -50,7 +50,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f58563aa903ffa0c060e5ae9eb436aa963322d26bdde393efd2dd506dc6c4ed
           imagePullPolicy: IfNotPresent
 
           ports:
@@ -59,6 +59,10 @@ spec:
               protocol: TCP
 
           env:
+            - name: KEYCAPE_ACCOUNT_PORTAL_URL
+              value: https://users.coulomb.social
+            - name: KEYCAPE_BROWSER_LOGOUT_URL
+              value: https://auth.coulomb.social/logout
             - name: KEYCAPE_CONFIG
               value: /etc/keycape/config.yaml
             - name: KEYCAPE_RAPP_QONTO_CLIENT_SECRET