diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index e69e269..2ff1ab1 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -51,10 +51,11 @@ spec:
       containers:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
-          # NK-WP-0041-T02 path B, key-cape@3b0446e: the in-cluster token call
-          # sends the public HTTPS origin. Staged while Authelia stays 4.38.
-          # Rollback: sha256:82f1e5ac481e4f963dbd4b05256aee75412c9e9b465d31c9356f5d17f26a6897
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:7c99cd6c6fdf63afaf22e47dad31e20dcb3a8b2079206f198cb425047be495b3
+          # key-cape@911e9de: completeAuthorization no longer backdates a
+          # freshly-verified MFA to a stale kc_login cookie's IssuedAt
+          # (INFD-IN-0005).
+          # Rollback: sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e
           imagePullPolicy: IfNotPresent
 
           ports: