diff --git a/helm/APP_NAME/templates/job-alembic-upgrade.yaml b/helm/APP_NAME/templates/job-alembic-upgrade.yaml
index 1ceefdf..b8b3c54 100644
--- a/helm/APP_NAME/templates/job-alembic-upgrade.yaml
+++ b/helm/APP_NAME/templates/job-alembic-upgrade.yaml
@@ -39,7 +39,10 @@ spec:
         runAsUser: 1001
       initContainers:
         - name: wait-for-secret
-          image: bitnami/kubectl:1.30
+          # curl + REST API K8s con SA token. Evita dependencia de un binario
+          # kubectl con tags que cambian (bitnami/kubectl retiro los tags
+          # semanticos minor 2026-05). curlimages/curl es Docker Official.
+          image: curlimages/curl:8.20.0
           command:
             - sh
             - -c
@@ -48,13 +51,19 @@ spec:
               # Espera hasta que addon-provisioner publique el Secret tras
               # reconciliar el AddonClaim (hook weight -10). 48 x 5s = 240s.
               SECRET="{{ .Values.database.secretName }}"
+              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+              CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
               i=1
               while [ "$i" -le 48 ]; do
-                if kubectl get secret "$SECRET" -n "$NAMESPACE" >/dev/null 2>&1; then
+                HTTP=$(curl -s -o /dev/null -w '%{http_code}' \
+                  --cacert "$CACERT" \
+                  -H "Authorization: Bearer $TOKEN" \
+                  "https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/secrets/$SECRET")
+                if [ "$HTTP" = "200" ]; then
                   echo "Secret $SECRET encontrado en intento $i"
                   exit 0
                 fi
-                echo "[$i/48] Secret $SECRET aun no publicado, esperando 5s..."
+                echo "[$i/48] Secret $SECRET aun no publicado (HTTP=$HTTP), esperando 5s..."
                 sleep 5
                 i=$((i + 1))
               done