diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index 75c94e04..e321b2f3 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2
     pull_policy: always
     restart: unless-stopped
     command: start --optimized
diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
index f158e623..d963f802 100644
--- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
@@ -46,28 +46,7 @@ server {
     # Also provide "_hidden" for by, since it's not relevant.
     proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
 
-    # temporary until we can upgrade keycloak stb 2026-08-25
-    allow 185.161.129.134/32; # z9
-    allow 2a07:c480:0:100::/56; # z9
-    allow 2a07:c481:1::/48; # z9 new ipv6
-    allow 213.240.180.39/32; # stb home
-    allow 2a01:170:118b:f701::1/64; # stb home
-
-    # Wieske
-    allow 212.12.48.0/24;
-    allow 2a00:14b0:4200:3000::/64;
-    allow 172.31.18.0/24;
-    allow 172.31.17.0/25;
-    allow 172.31.17.128/25;
-    allow 212.12.51.128/28;
-    allow 2a00:14b0:4200:3500::130:0/112;
-    allow 2a00:14b0:f000:23::/64;
-    allow 10.32.2.0/24;
-    allow 2a00:14b0:42:102::/64;
-    allow 212.12.50.208/29;
-    allow 2a00:14b0:42:105::/64;
-
-    deny all;
+    allow all;
 
     # Redirect a user opening any not set location on id.hamburg.ccc.de to the account management page.
     location ^~ / {