diff --git a/k8s/infra/oidc-bootstrap/bootstrap.yaml b/k8s/infra/oidc-bootstrap/bootstrap.yaml
index 4420957..44b8f4f 100644
--- a/k8s/infra/oidc-bootstrap/bootstrap.yaml
+++ b/k8s/infra/oidc-bootstrap/bootstrap.yaml
@@ -1,6 +1,6 @@
 # One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
-# OIDC authenticator (they last started before the Authentik provider existed, so
-# OIDC tokens were never accepted). Delete this whole directory afterwards.
+# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
+# tokens were never accepted -> every login got 401). Delete this whole directory after.
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -35,7 +35,7 @@ roleRef:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: oidc-bootstrap-restart-apiserver
+  name: oidc-bootstrap-restart-apiserver-v2
   namespace: kube-system
 spec:
   backoffLimit: 4
@@ -46,13 +46,14 @@ spec:
       restartPolicy: Never
       containers:
         - name: restart
-          image: docker.io/bitnami/kubectl:1.31.0
+          image: docker.io/curlimages/curl:8.22.0
           command: ["/bin/sh", "-c"]
           args:
             - |
               set -u
-              echo "deleting the control-plane apiservers so OIDC initialises"
+              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
               for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
-                kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true
+                curl -sS --max-time 15 --cacert "$CA" -H "Authorization: Bearer $TOKEN"                   -X DELETE "https://kubernetes.default.svc/api/v1/namespaces/kube-system/pods/$pod?gracePeriodSeconds=0"                   -o /dev/null -w "$pod -> HTTP %{http_code}\n" || echo "$pod -> request failed"
               done
-              echo "requested; kubelet recreates each static pod in ~20-40s"
\ No newline at end of file
+              echo "deletes requested; kubelet recreates each static pod in ~20-40s"
\ No newline at end of file