diff --git a/kube/deploy/apps/authentik/app/hr.yaml b/kube/deploy/apps/authentik/app/hr.yaml
index 5d0acdce..104dcf2d 100644
--- a/kube/deploy/apps/authentik/app/hr.yaml
+++ b/kube/deploy/apps/authentik/app/hr.yaml
@@ -16,14 +16,9 @@ spec:
   values:
     image:
       repository: "ghcr.io/goauthentik/server"
-      tag: "2023.10.7@sha256:8ebdd51a95d3efdcb0cf3b26ed849cc0f9a8c032adb8cd595cabb59a1f321161" # specify image tag for Renovate to pull changelogs & security info, and for security releases without a chart release
-      digest: "sha256:8ebdd51a95d3efdcb0cf3b26ed849cc0f9a8c032adb8cd595cabb59a1f321161"
+      tag: "2023.10.7" # specify image tag for Renovate to pull changelogs & security info, and for security releases without a chart release
+      digest: "sha256:8ebdd51a95d3efdcb0cf3b26ed849cc0f9a8c032adb8cd595cabb59a1f321161" # TODO: apparently Renovate doesn't see this as a digest?
       pullPolicy: IfNotPresent 
-    image2: # Renovate test
-      repository: "ghcr.io/goauthentik/server"
-      tag: "2023.10.5" # specify image tag for Renovate to pull changelogs & security info, and for security releases without a chart release
-      digest: "sha256:f019439323ae8ffb88771584641072ffb64079a895d8d15ee7ada2da210de2a1"
-      pullPolicy: IfNotPresent
     # server is in active-active, 3 replicas seems to confuse authentik
     replicas: 2
     worker:
@@ -133,4 +128,4 @@ spec:
               matchLabels:
                 app.kubernetes.io/name: *app
                 app.kubernetes.io/instance: *app
-                app.kubernetes.io/component: worker
\ No newline at end of file
+                app.kubernetes.io/component: worker