diff --git a/k8s/cluster/statefulset.yaml b/k8s/cluster/statefulset.yaml
index c52569f..3e5716d 100644
--- a/k8s/cluster/statefulset.yaml
+++ b/k8s/cluster/statefulset.yaml
@@ -100,7 +100,7 @@ spec:
               mountPath: /data
       containers:
         - name: tidaldb
-          image: registry.threesix.ai/tidal/server:m12-harden-20260831@sha256:accdbad48814919fe9cece14738a904df755f3e7937e1f1d0df07cc9cd5cb9d2
+          image: registry.threesix.ai/tidal/server:m12-poisonfix-20260831@sha256:93a2929d2473c753ed2322aac547dcc5a2d8598fd00aada5104553d7b8632078
           imagePullPolicy: IfNotPresent
           # The image ENTRYPOINT is the bare binary. We override the command with
           # a tiny /bin/sh wrapper (the bookworm-slim runtime HAS a shell) so we