diff --git a/20-kube/20-pom-deploy.yaml b/20-kube/20-pom-deploy.yaml
--- a/20-kube/20-pom-deploy.yaml
+++ b/20-kube/20-pom-deploy.yaml
@@ -31,7 +31,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
-          image: pomerium/ingress-controller:sha-efe2d11
+          # see https://hub.docker.com/r/pomerium/ingress-controller/tags but idk how to get the version number! 
+          # It's not even in the startup logs, just this: "pomerium_version":""
+          # I think sha-2c8038a is v0.21.3 (by date, https://www.pomerium.com/docs/releases/changelog)
+          image: pomerium/ingress-controller:sha-2c8038a
           imagePullPolicy: IfNotPresent
           name: pomerium
           ports: