diff --git a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
index 85834d3..d20db48 100644
--- a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
+++ b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
@@ -222,7 +222,7 @@ never transfers that identity to the later registration. The full suite passes
 131 tests with three environment-dependent skips.
 
 The latest tested image is published at
-`forgejo.coulomb.social/coulomb/user-engine@sha256:6f71bea99513ffa64eab28e1c8eeaef9348e95b6f0742bca228c6fbd5301ebde`;
+`forgejo.coulomb.social/coulomb/user-engine@sha256:a49a0a105d392e374f6da958f8ad1bff36f2cfa8779ac5cafa479b7f34b6efc1`;
 the matching email-connect image is
 `forgejo.coulomb.social/coulomb/email-connect@sha256:bc7a01b4ab9acd2f12f3150c84e4b6590744c035bc15689c93584d8da06bd730`.
 The cluster already applies a Traefik-wide rate limit, and the runtime manifest