diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml
index 83c7643..4905601 100644
--- a/.github/workflows/upload.yml
+++ b/.github/workflows/upload.yml
@@ -4,6 +4,10 @@ on: [push]
 
 env:
   ECR_REPOSITORY: toolbox
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   upload-docker-image:
     runs-on: ubuntu-latest
@@ -14,8 +18,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.TRUSS_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.TRUSS_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::127178877223:role/github/github-truss
           aws-region: us-east-2
 
       - name: Login to AWS ECR
diff --git a/Dockerfile b/Dockerfile
index c7627d2..118b0ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,9 @@ ENV VAULT_ADDR https://vault.vault.svc:8200
 ENV VAULT_SKIP_VERIFY true
 
 # kubectl
-COPY --from=bitnami/kubectl:1.33.2 /opt/bitnami/kubectl/bin/kubectl /usr/bin/kubectl
+ADD --checksum=sha256:8efbb9435132a190920eb65a47a8c1ecf755ad85ab57a600c9bedbab460bb7a8 \
+    https://dl.k8s.io/release/v1.34.11/bin/linux/amd64/kubectl /usr/bin/kubectl
+RUN chmod +x /usr/bin/kubectl
 
 # AWS CLI
 RUN apk add --no-cache aws-cli