diff --git a/apps/infra/bitwarden-cli.yaml b/apps/infra/bitwarden-cli.yaml
index f12fbae..6b53be4 100644
--- a/apps/infra/bitwarden-cli.yaml
+++ b/apps/infra/bitwarden-cli.yaml
@@ -60,7 +60,7 @@ spec:
         kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.9.0
           imagePullPolicy: IfNotPresent
           # Override the baked entrypoint so --disable-origin-protection is
           # actually passed (it was commented out in the image's entrypoint.sh,