diff --git a/renovate.json b/renovate.json
index 2975de6..13774e4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,7 +4,9 @@
     "config:recommended", // Included in config:best-practices anyway, but added for clarity.
     "config:best-practices",
     ":ignoreUnstable",
-    ":disableRateLimiting"
+    ":disableRateLimiting",
+    ":rebaseStalePrs",
+    ":label(renovate)"
   ],
   "semanticCommits": "disabled",
   "packageRules": [
diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index 398d814..c5616e4 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4@sha256:65d65fa0e858a608fd3e7d16ecfd7a5ced2fba4ab22a8fd3b86f3742ecec0a83
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4@sha256:bf6c9afa692c375e558ccc1c9986bd25e39f54450b09c666e2e7bed7edf803b3
     pull_policy: always
     restart: unless-stopped
     command: start --optimized