diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index 4f6a9377..5806c374 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -229,8 +229,11 @@ jobs:
       - name: Start Docker daemon
         run: |
           # Start Docker daemon in background if not running
+          # --iptables=false avoids NAT/bridge setup which requires root caps
+          # not available in unprivileged CI runners (only needed for container networking,
+          # not for building/pushing images)
           if ! docker info > /dev/null 2>&1; then
-            sudo dockerd &
+            sudo dockerd --iptables=false &
             # Wait for Docker to be ready
             timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
           fi
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 827ab342..ff7f2339 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: migrate
-          image: git.mcintire.me/graham/towerops-web:production-1773688540-020a55c
+          image: git.mcintire.me/graham/towerops-web:production-1773753909-becd2ef
           imagePullPolicy: IfNotPresent
           command: ["/app/bin/migrate"]
           securityContext:
@@ -104,7 +104,7 @@ spec:
               cpu: "500m"
       containers:
         - name: towerops
-          image: git.mcintire.me/graham/towerops-web:production-1773688540-020a55c
+          image: git.mcintire.me/graham/towerops-web:production-1773753909-becd2ef
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false