diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 2ff1ab1..2e48472 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -51,11 +51,12 @@ spec:
       containers:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
-          # key-cape@911e9de: completeAuthorization no longer backdates a
-          # freshly-verified MFA to a stale kc_login cookie's IssuedAt
-          # (INFD-IN-0005).
-          # Rollback: sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e
+          # key-cape@8be8065: the provider-metadata/JWKS discovery fetch now
+          # carries the same split-horizon X-Forwarded-Proto/Host headers as
+          # the token exchange (ADHOC-2026-09-27-T02) -- the prior image
+          # (911e9de) broke every login on Authelia 4.38 without this.
+          # Rollback: sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5
           imagePullPolicy: IfNotPresent
 
           ports: