diff --git a/infra/argo/cockpit-build-deploy.yaml b/infra/argo/cockpit-build-deploy.yaml
index 01f7ea6..052aa94 100644
--- a/infra/argo/cockpit-build-deploy.yaml
+++ b/infra/argo/cockpit-build-deploy.yaml
@@ -108,7 +108,7 @@ spec:
             - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
             - { name: workspace, mountPath: /workspace }
       container:
-        image: registry.k8s.io/kubectl:v1.31.0   # bitnami/kubectl was removed from Docker Hub (2025); use the official k8s image
+        image: alpine/k8s:1.31.0   # Alpine-based (has /bin/sh + kubectl). NOT registry.k8s.io/kubectl — that's distroless (no shell) and the deploy runs a shell script. bitnami/kubectl was removed from Docker Hub (2025).
         command: [/bin/sh, -c]
         args:
           - |