diff --git a/argocd/manifests/tailscale-operator-ringtail/kustomization.yaml b/argocd/manifests/tailscale-operator-ringtail/kustomization.yaml
index fc119c9..25c3545 100644
--- a/argocd/manifests/tailscale-operator-ringtail/kustomization.yaml
+++ b/argocd/manifests/tailscale-operator-ringtail/kustomization.yaml
@@ -15,7 +15,7 @@ resources:
 images:
   - name: docker.io/tailscale/k8s-operator
     newName: registry.ops.eblu.me/blumeops/tailscale-operator
-    newTag: v1.94.2-ac40a18-nix
+    newTag: v1.94.2-d03ed33-nix
 
 # Rewrite the proxyclass image to our local nix-built mirror (indri's overlay
 # carries the equivalent dagger/arm64 patch). A strategic merge patch is used
diff --git a/argocd/manifests/tailscale-operator/kustomization.yaml b/argocd/manifests/tailscale-operator/kustomization.yaml
index ad275a9..239f7ea 100644
--- a/argocd/manifests/tailscale-operator/kustomization.yaml
+++ b/argocd/manifests/tailscale-operator/kustomization.yaml
@@ -21,7 +21,7 @@ resources:
 images:
   - name: docker.io/tailscale/k8s-operator
     newName: registry.ops.eblu.me/blumeops/tailscale-operator
-    newTag: v1.94.2-ac40a18
+    newTag: v1.94.2-d03ed33
 
 # Rewrite the proxyclass image to the local mirror. A strategic merge patch
 # is used instead of kustomize's `images:` directive because that directive
diff --git a/argocd/manifests/tailscale-operator/proxyclass-image.yaml b/argocd/manifests/tailscale-operator/proxyclass-image.yaml
index eae73eb..82a7e0b 100644
--- a/argocd/manifests/tailscale-operator/proxyclass-image.yaml
+++ b/argocd/manifests/tailscale-operator/proxyclass-image.yaml
@@ -6,6 +6,6 @@ spec:
   statefulSet:
     pod:
       tailscaleContainer:
-        image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-ac40a18
+        image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-d03ed33
       tailscaleInitContainer:
-        image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-ac40a18
+        image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-d03ed33