diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index 92a6afb..64e7042 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4@sha256:06bfa760dfa40bd3d4305a67ce02e9dc70113151f09820a3bc6c75f5f7ece855
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4@sha256:f5bd58402777da32d61ccb1b8601f1388721e07bf11b9d43e8e4ea20d444e10a
     pull_policy: always
     restart: unless-stopped
     command: start --optimized
diff --git a/roles/renovate/files/renovate.service b/roles/renovate/files/renovate.service
index 6cb8f16..52e64f5 100644
--- a/roles/renovate/files/renovate.service
+++ b/roles/renovate/files/renovate.service
@@ -6,7 +6,8 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/docker run --rm \
+    --pull=always \
     -v "/etc/renovate/config.js:/usr/src/app/config.js" \
     --mount "type=volume,src=renovate,dst=/tmp/renovate" \
     --env "RENOVATE_BASE_DIR=/tmp/renovate" \
-    renovate/renovate
+    docker.io/renovate/renovate:latest