diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 5b283ae..b1b8e5d 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -54,7 +54,7 @@ spec:
           # 2026-05-24: direct-imported into railiance01 k3s for the
           # bootstrap-console OIDC/MFA rollout. Use IfNotPresent while the
           # HTTP registry push/pull path is being cleaned up.
-          image: key-cape:e8b4ede
+          image: key-cape:909bb32
           imagePullPolicy: IfNotPresent
 
           ports:
diff --git a/sso-mfa/k8s/user-engine/runtime.yaml b/sso-mfa/k8s/user-engine/runtime.yaml
index 0c999fc..3c8f415 100644
--- a/sso-mfa/k8s/user-engine/runtime.yaml
+++ b/sso-mfa/k8s/user-engine/runtime.yaml
@@ -45,7 +45,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: user-engine:portal-b2f1185
+          image: user-engine:portal-e23674d
           imagePullPolicy: Never
           ports: [{name: http, containerPort: 8080}]
           env: