diff --git a/class/defaults.yml b/class/defaults.yml
index 4f331ba..4a8247e 100644
--- a/class/defaults.yml
+++ b/class/defaults.yml
@@ -167,7 +167,7 @@ parameters:
       control-api:
         registry: ghcr.io
         image: appuio/control-api
-        tag: v0.33.0
+        tag: v0.33.1
 
       idp-adapter:
         registry: ghcr.io
diff --git a/tests/golden/defaults/control-api/control-api/01_api_server/02_deployment.yaml b/tests/golden/defaults/control-api/control-api/01_api_server/02_deployment.yaml
index 37ae8bd..26021de 100644
--- a/tests/golden/defaults/control-api/control-api/01_api_server/02_deployment.yaml
+++ b/tests/golden/defaults/control-api/control-api/01_api_server/02_deployment.yaml
@@ -35,7 +35,7 @@ spec:
                 secretKeyRef:
                   key: url
                   name: odoo-credentials
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: apiserver
           ports:
             - containerPort: 9443
diff --git a/tests/golden/defaults/control-api/control-api/02_api_controller/02_deployment.yaml b/tests/golden/defaults/control-api/control-api/02_api_controller/02_deployment.yaml
index 5d8efa1..7c85d93 100644
--- a/tests/golden/defaults/control-api/control-api/02_api_controller/02_deployment.yaml
+++ b/tests/golden/defaults/control-api/control-api/02_api_controller/02_deployment.yaml
@@ -23,7 +23,7 @@ spec:
             - --username-prefix=appuio#
             - --webhook-cert-dir=/var/run/webhook-service-tls
           env: []
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: controller
           ports:
             - containerPort: 9443
diff --git a/tests/golden/insecure/control-api/control-api/01_api_server/02_deployment.yaml b/tests/golden/insecure/control-api/control-api/01_api_server/02_deployment.yaml
index 629738f..aeebaec 100644
--- a/tests/golden/insecure/control-api/control-api/01_api_server/02_deployment.yaml
+++ b/tests/golden/insecure/control-api/control-api/01_api_server/02_deployment.yaml
@@ -25,7 +25,7 @@ spec:
             - --secure-port=9443
             - --username-prefix=appuio#
           env: []
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: apiserver
           ports:
             - containerPort: 9443
diff --git a/tests/golden/insecure/control-api/control-api/02_api_controller/02_deployment.yaml b/tests/golden/insecure/control-api/control-api/02_api_controller/02_deployment.yaml
index 29b1210..a1deb5c 100644
--- a/tests/golden/insecure/control-api/control-api/02_api_controller/02_deployment.yaml
+++ b/tests/golden/insecure/control-api/control-api/02_api_controller/02_deployment.yaml
@@ -22,7 +22,7 @@ spec:
             - --username-prefix=appuio#
             - --webhook-cert-dir=/var/run/webhook-service-tls
           env: []
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: controller
           ports:
             - containerPort: 9443
diff --git a/tests/golden/withcronjob/control-api/control-api/01_api_server/02_deployment.yaml b/tests/golden/withcronjob/control-api/control-api/01_api_server/02_deployment.yaml
index 37ae8bd..26021de 100644
--- a/tests/golden/withcronjob/control-api/control-api/01_api_server/02_deployment.yaml
+++ b/tests/golden/withcronjob/control-api/control-api/01_api_server/02_deployment.yaml
@@ -35,7 +35,7 @@ spec:
                 secretKeyRef:
                   key: url
                   name: odoo-credentials
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: apiserver
           ports:
             - containerPort: 9443
diff --git a/tests/golden/withcronjob/control-api/control-api/02_api_controller/02_deployment.yaml b/tests/golden/withcronjob/control-api/control-api/02_api_controller/02_deployment.yaml
index 5d8efa1..7c85d93 100644
--- a/tests/golden/withcronjob/control-api/control-api/02_api_controller/02_deployment.yaml
+++ b/tests/golden/withcronjob/control-api/control-api/02_api_controller/02_deployment.yaml
@@ -23,7 +23,7 @@ spec:
             - --username-prefix=appuio#
             - --webhook-cert-dir=/var/run/webhook-service-tls
           env: []
-          image: ghcr.io/appuio/control-api:v0.33.0
+          image: ghcr.io/appuio/control-api:v0.33.1
           name: controller
           ports:
             - containerPort: 9443
diff --git a/tests/golden/withcronjob/control-api/control-api/20_cronjob.yaml b/tests/golden/withcronjob/control-api/control-api/20_cronjob.yaml
index acd6171..1bf9eb6 100644
--- a/tests/golden/withcronjob/control-api/control-api/20_cronjob.yaml
+++ b/tests/golden/withcronjob/control-api/control-api/20_cronjob.yaml
@@ -28,7 +28,7 @@ spec:
                     secretKeyRef:
                       key: url
                       name: odoo-credentials
-              image: ghcr.io/appuio/control-api:v0.33.0
+              image: ghcr.io/appuio/control-api:v0.33.1
               imagePullPolicy: IfNotPresent
               name: cleanup
               ports: []