diff --git a/apps/base/arrstack/arrproxy/migrate-job.yaml b/apps/base/arrstack/arrproxy/migrate-job.yaml
index 7f908f6..6cc9fe5 100644
--- a/apps/base/arrstack/arrproxy/migrate-job.yaml
+++ b/apps/base/arrstack/arrproxy/migrate-job.yaml
@@ -35,7 +35,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
+          image: docker.io/library/postgres:18-alpine
           imagePullPolicy: IfNotPresent
           env:
             - name: HOME
diff --git a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
index 4b5faa4..70fb45e 100644
--- a/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
+++ b/apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh
diff --git a/apps/base/arrstack/valkey/valkeycluster.yaml b/apps/base/arrstack/valkey/valkeycluster.yaml
index 2c107df..87d207f 100644
--- a/apps/base/arrstack/valkey/valkeycluster.yaml
+++ b/apps/base/arrstack/valkey/valkeycluster.yaml
@@ -28,7 +28,7 @@ metadata:
 spec:
   shards: 1
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  image: docker.io/valkey/valkey:9.0.0
   exporter:
     enabled: false
   scheduling: