diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e8bab8978f39c6c0a130a26213008f316c06aff8..0afb5c918110a882e4aacb83b8b9474d7ba7ce0c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -25,7 +25,7 @@ test:
 
 .base:
     image:
-        name: gcr.io/kaniko-project/executor:debug
+        name: gcr.io/kaniko-project/executor:v1.23.2-debug
         entrypoint: [""]
     cache: {}
     before_script:
@@ -45,37 +45,37 @@ build_sha_prod:
     only:
         - main
     script:
-        - /kaniko/executor --build-arg "profile=prod" --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}"
-
-build_latest_prod:
-    extends: .base
-    stage: build_kubernetes
-    only:
-        - main
-    script:
-        - /kaniko/executor --build-arg "profile=prod" --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "${CI_REGISTRY_IMAGE}:latest"
-
+        - /kaniko/executor --build-arg "profile=prod" --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}" --destination "${CI_REGISTRY_IMAGE}:latest"
 
 deploy_development:
-    image: bitnami/kubectl
+    image: bitnami/kubectl:1.30-debian-12
     before_script:
         - export KUBECONFIG=$KUBECONFIG_FILE
     stage: deploy
     only:
         - dev
     script:
-        - kubectl apply --namespace=fraunhofer -f ./kubernetes/configmap.yaml
-        - kubectl set image -f ./kubernetes/deployment.yaml b-container=registry.opencode.de/opencode-analyzer/data-provider:dev_${CI_COMMIT_SHORT_SHA} --namespace=fraunhofer --local -o yaml | kubectl apply --namespace=fraunhofer -f -
-        - kubectl apply --namespace=fraunhofer -f ./kubernetes/service.yaml
+        - |-
+            set -x
+            alias dev="kubectl --namespace=fraunhofer"
+            dev apply -f ./kubernetes/configmap.yaml
+            dev set image -f ./kubernetes/deployment.yaml "b-container=registry.opencode.de/opencode-analyzer/data-provider:dev_${CI_COMMIT_SHORT_SHA}" --local -o yaml | dev apply -f -
+            dev apply -f ./kubernetes/service.yaml
+            dev rollout status -f ./kubernetes/deployment.yaml --watch=true --timeout 300s || (
+                dev rollout undo -f ./kubernetes/deployment.yaml
+                exit 1
+            )
 
 deploy_production:
-    image: bitnami/kubectl
+    image: bitnami/kubectl:1.30-debian-12
     before_script:
         - export KUBECONFIG=$KUBECONFIG_FILE
     stage: deploy
     only:
         - main
     script:
-        - kubectl apply --namespace=fraunhoferprod -f ./kubernetes/configmap-prod.yaml
-        - kubectl set image -f ./kubernetes/deployment-prod.yaml b-container=registry.opencode.de/opencode-analyzer/data-provider:${CI_COMMIT_SHORT_SHA} --namespace=fraunhoferprod --local -o yaml | kubectl apply --namespace=fraunhoferprod -f -
-        - kubectl apply --namespace=fraunhoferprod -f ./kubernetes/service.yaml
+        - alias prod="kubectl --namespace=fraunhoferprod"
+        - prod apply -f ./kubernetes/configmap-prod.yaml
+        - prod set image -f ./kubernetes/deployment-prod.yaml b-container=registry.opencode.de/opencode-analyzer/data-provider:${CI_COMMIT_SHORT_SHA} --local -o yaml | prod apply -f -
+        - prod apply -f ./kubernetes/service.yaml
+        # XXX add rollout undo if tested on dev
diff --git a/kubernetes/deployment.yaml b/kubernetes/deployment.yaml
index bb6805d8c1056a02052e9665c623b68ee4bbbf5f..80830269b84b387cdcbf656debe79ea79b80b297 100644
--- a/kubernetes/deployment.yaml
+++ b/kubernetes/deployment.yaml
@@ -80,5 +80,15 @@ spec:
                             name: crdbconf
                       - configMapRef:
                             name: data-provider-config-map
+                  startupProbe:
+                    exec:
+                        command:
+                            - curl
+                            - 127.0.0.1:5000/actuator/health
+                    initialDelaySeconds: 10
+                    timeoutSeconds: 5
+                    # service has 240 seconds to boot
+                    periodSeconds: 10
+                    failureThreshold: 24
             restartPolicy: Always
     replicas: 1