diff --git a/Dockerfile b/Dockerfile
index 14cc8b5..44bee35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,19 @@
-FROM bitnami/kubectl:1.24.12
+# Digest-pinned on purpose. This action runs on taskade/taskcade's production
+# deploy path (production.yml: "Create AWS credentials secret" and "Register
+# Temporal taskade Namespace"), so the base image must be immutable - a floating
+# tag lets a third party change what runs with our kubeconfig and AWS creds.
+#
+# Do NOT move this to bitnami/kubectl. The 1.24.12 attempt broke twice over:
+#   1. `bitnami/kubectl:1.24.12` 404s. Bitnami retired their free Docker Hub
+#      catalog; the image only survives at `bitnamilegacy/kubectl:1.24.12`.
+#   2. Even resolved to bitnamilegacy, the build still fails at the RUN below
+#      with `curl: command not found` - the bitnami base ships no curl.
+# Both were reproduced with `docker build` before this revert.
+#
+# Upgrading kubectl past the 1.23.15 in this image is a real want, but it needs
+# a base that has curl (or a different way to fetch aws-iam-authenticator) and
+# a version chosen against the live EKS control plane. Track it separately.
+FROM gcr.io/cloud-builders/kubectl@sha256:2be508c9ef153be3d3d2e986acd430821d99c1bcbdccda2e426222338f034762
 
 LABEL version="1.0.0"
 LABEL name="kubectl"