diff --git a/kube/04-gen-secrets-job.yaml b/04-gen-secrets-job.yaml
copy from kube/04-gen-secrets-job.yaml
copy to 04-gen-secrets-job.yaml
--- a/kube/04-gen-secrets-job.yaml
+++ b/04-gen-secrets-job.yaml
@@ -21,7 +21,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: pomerium/ingress-controller:main
+        image: pomerium/ingress-controller:sha-efe2d11
         imagePullPolicy: IfNotPresent
         name: gen-secrets
         securityContext: