diff --git a/.gitea/workflows/kub-deploy.yml b/.gitea/workflows/kub-deploy.yml
index 7d393c6..c343677 100644
--- a/.gitea/workflows/kub-deploy.yml
+++ b/.gitea/workflows/kub-deploy.yml
@@ -74,7 +74,11 @@ jobs:
           # Apply manifests and restart
           sshpass -e ssh -o StrictHostKeyChecking=no root@${{ env.K8S_SERVER }} "
             kubectl apply -n kbs-stage -f /tmp/frontoffice-deployment.yaml &&
-            crictl rmi ${REGISTRY}/${IMAGE_NAME}:latest 2>/dev/null || true &&
+            # Drop cached :latest so IfNotPresent/Always both pick the new digest
+            # (crictl is broken on this host — use containerd ctr)
+            ctr -n k8s.io images ls -q | grep -E 'frontoffice(:latest|@)' | while read -r ref; do
+              ctr -n k8s.io images rm \"\$ref\" 2>/dev/null || true
+            done
             kubectl -n kbs-stage rollout restart deployment/frontoffice &&
             kubectl -n kbs-stage rollout status deployment/frontoffice --timeout=180s &&
             rm -f /tmp/frontoffice-deployment.yaml
diff --git a/k8s/staging/frontoffice-deployment.yaml b/k8s/staging/frontoffice-deployment.yaml
index 22d2154..57235cf 100644
--- a/k8s/staging/frontoffice-deployment.yaml
+++ b/k8s/staging/frontoffice-deployment.yaml
@@ -21,7 +21,8 @@ spec:
       containers:
         - name: frontoffice
           image: 185.252.31.44:30080/admin/frontoffice:latest
-          imagePullPolicy: IfNotPresent
+          # Staging uses :latest — Always avoids stale node cache after registry retag
+          imagePullPolicy: Always
           ports:
             - containerPort: 80
               name: http