diff --git a/apps/infra/bitwarden-cli.yaml b/apps/infra/bitwarden-cli.yaml
index 6b53be4..0bcff45 100644
--- a/apps/infra/bitwarden-cli.yaml
+++ b/apps/infra/bitwarden-cli.yaml
@@ -60,7 +60,7 @@ spec:
         kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.9.0
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0  # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
           imagePullPolicy: IfNotPresent
           # Override the baked entrypoint so --disable-origin-protection is
           # actually passed (it was commented out in the image's entrypoint.sh,