diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0aab5c21..c34a0955 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -95,17 +95,19 @@ check_openshift_config_prod:
       variables:
         DOCKER_REGISTRY: $CI_REGISTRY_IMAGE
         IMAGE_TAG: test-cara-latest
+        KANIKO_AUTH: "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}"
     - if: '$CI_COMMIT_BRANCH == "master"'
       variables:
-        DOCKER_REGISTRY: $DOCKER_REGISTRY
+        DOCKER_REGISTRY: "${OPENSHIFT_DOCKER_REGISTRY_PROD}"
         # change to `cara-latest` after moving prod to OKD4
         IMAGE_TAG: latest
+        KANIKO_AUTH: "{\"auths\":{\"$OPENSHIFT_DOCKER_REGISTRY_PROD\":{\"auth\":\"$OPENSHIFT_DOCKER_TOKEN_PROD\"}}}"
   image:
     # Based on guidance at https://gitlab.cern.ch/gitlabci-examples/build_docker_image.
     name: gitlab-registry.cern.ch/ci-tools/docker-image-builder
     entrypoint: [""]
   script:
-    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+    - echo ${KANIKO_AUTH} > /kaniko/.docker/config.json
     - echo "Building ${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:latest Docker image..."
     - /kaniko/executor --context ${CI_PROJECT_DIR}/${DOCKER_CONTEXT_DIRECTORY} --dockerfile ${CI_PROJECT_DIR}/${DOCKERFILE_DIRECTORY}/Dockerfile --destination ${DOCKER_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
 
diff --git a/app-config/openshift/config-generate.py b/app-config/openshift/config-generate.py
index fd18be20..079f8e78 100644
--- a/app-config/openshift/config-generate.py
+++ b/app-config/openshift/config-generate.py
@@ -17,7 +17,7 @@ def configure_parser(parser: argparse.ArgumentParser) -> None:
     )
 
 
-def generate_config(output_directory: pathlib.Path, project_name: str, image_tag_name: str, hostname: str, branch: str):
+def generate_config(output_directory: pathlib.Path, project_name: str, hostname: str, branch: str):
     output_directory.mkdir(exist_ok=True, parents=True)
 
     def oc_process(component_name: str, context: typing.Optional[dict] = None):
@@ -33,7 +33,7 @@ def generate_config(output_directory: pathlib.Path, project_name: str, image_tag
     oc_process('services')
     oc_process('imagestreams')
     oc_process('buildconfig', context={'GIT_BRANCH': branch})
-    oc_process('deploymentconfig', context={'PROJECT_NAME': project_name, 'IMAGE_TAG_NAME': image_tag_name})
+    oc_process('deploymentconfig', context={'PROJECT_NAME': project_name})
 
     print(f'Config in: {output_directory.absolute()}')
 
@@ -41,16 +41,14 @@ def generate_config(output_directory: pathlib.Path, project_name: str, image_tag
 def handler(args: argparse.ArgumentParser) -> None:
     if args.instance == 'cara':
         project_name = 'cara'
-        image_tag_name = 'cara-latest'
         branch = 'master'
         hostname = 'cara.web.cern.ch'
     elif args.instance == 'test-cara':
         project_name = 'test-cara'
-        image_tag_name = 'test-cara-latest'
         branch = 'live/test-cara'
         hostname = 'test-cara.web.cern.ch'
 
-    generate_config(pathlib.Path(args.output_directory), project_name, image_tag_name, hostname, branch)
+    generate_config(pathlib.Path(args.output_directory), project_name, hostname, branch)
 
 
 def main():
diff --git a/app-config/openshift/deploymentconfig.yaml b/app-config/openshift/deploymentconfig.yaml
index 04f445b2..e4260f94 100644
--- a/app-config/openshift/deploymentconfig.yaml
+++ b/app-config/openshift/deploymentconfig.yaml
@@ -66,7 +66,7 @@
                 - auth-service
               from:
                 kind: ImageStreamTag
-                name: 'auth-service:${IMAGE_TAG_NAME}'
+                name: 'auth-service:latest'
                 namespace: ${PROJECT_NAME}
     -
       apiVersion: apps.openshift.io/v1
@@ -123,7 +123,7 @@
                 - cara-webservice
               from:
                 kind: ImageStreamTag
-                name: 'cara-webservice:${IMAGE_TAG_NAME}'
+                name: 'cara-webservice:latest'
                 namespace: ${PROJECT_NAME}
     -
       apiVersion: apps.openshift.io/v1
@@ -259,7 +259,7 @@
                 - cara-webservice
               from:
                 kind: ImageStreamTag
-                name: 'cara-webservice:${IMAGE_TAG_NAME}'
+                name: 'cara-webservice:latest'
                 namespace: ${PROJECT_NAME}
           - type: ConfigChange
     -
@@ -319,7 +319,7 @@
                 - cara-calculator-open
               from:
                 kind: ImageStreamTag
-                name: 'cara-webservice:${IMAGE_TAG_NAME}'
+                name: 'cara-webservice:latest'
                 namespace: ${PROJECT_NAME}
           - type: ConfigChange
 
@@ -327,6 +327,3 @@
     - name: PROJECT_NAME
       description: The name of this project, e.g. test-cara
       required: true
-    - name: IMAGE_TAG_NAME
-      description: The image tag name, e.g. cara-latest or cara-test-latest
-      required: true