diff --git a/README.md b/README.md
index 6d82d7f989e777c0c8a168b23c616b882ff69769..bbac5afe49930ed6e00b465f8e250245f3498af0 100644
--- a/README.md
+++ b/README.md
@@ -436,7 +436,7 @@ In order to be able to communicate with the Vault server, the variant requires t
 
 | Input / Variable  | Description                            | Default value     |
 | ----------------- | -------------------------------------- | ----------------- |
-| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:master` |
+| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest` |
 | `vault-base-url` / `VAULT_BASE_URL`  | The Vault server base API url          | _none_ |
 | `vault-oidc-aud` / `VAULT_OIDC_AUD`  | The `aud` claim for the JWT | `$CI_SERVER_URL` |
 | :lock: `VAULT_ROLE_ID`   | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | **must be defined** |
diff --git a/kicker.json b/kicker.json
index a741034cce3a3d25ad729452cd5b280ae0e53b73..64d2589238517daa67d487933a576c4acd3972fd 100644
--- a/kicker.json
+++ b/kicker.json
@@ -155,7 +155,7 @@
         {
           "name": "TBC_VAULT_IMAGE",
           "description": "The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use",
-          "default": "registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:master",
+          "default": "registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest",
           "advanced": true
         },
         {
diff --git a/templates/gitlab-ci-node-vault.yml b/templates/gitlab-ci-node-vault.yml
index 4e40d677c76bd2b434679fca63cb83c1dbe36ebf..ab81ca5c6f218a2aa431af54dd0022c2fd78162b 100644
--- a/templates/gitlab-ci-node-vault.yml
+++ b/templates/gitlab-ci-node-vault.yml
@@ -12,7 +12,7 @@ spec:
 ---
 variables:
   # variabilized vault-secrets-provider image
-  TBC_VAULT_IMAGE: registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:master
+  TBC_VAULT_IMAGE: registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest
   VAULT_BASE_URL: $[[ inputs.vault-base-url ]]
   # variables have to be explicitly declared in the YAML to be exported to the service
   VAULT_ROLE_ID: "$VAULT_ROLE_ID"