diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6354f00ff78683884262be4c63afd4a50374fab..ee38e779c221190bde64abd332cd405bc0171a18 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [6.8.1](https://gitlab.com/to-be-continuous/python/compare/6.8.0...6.8.1) (2024-04-03)
+
+
+### Bug Fixes
+
+* **vault:** use vault-secrets-provider's "latest" image tag ([4342c01](https://gitlab.com/to-be-continuous/python/commit/4342c01475a4e227c4c4e06af4be0c016b2da2a2))
+
 # [6.8.0](https://gitlab.com/to-be-continuous/python/compare/6.7.0...6.8.0) (2024-04-02)
 
 
diff --git a/README.md b/README.md
index d4caf50e3764ee348412507327d5caab5f4d5b6c..47d6837d5c5f56a11f6c855e7686fbb80ff84f31 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Add the following to your `gitlab-ci.yml`:
 ```yaml
 include:
   # 1: include the component
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.0
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.1
     # 2: set/override component inputs
     inputs:
       image: registry.hub.docker.com/library/python:3.10
@@ -29,7 +29,7 @@ Add the following to your `gitlab-ci.yml`:
 include:
   # 1: include the template
   - project: 'to-be-continuous/python'
-    ref: '6.8.0'
+    ref: '6.8.1'
     file: '/templates/gitlab-ci-python.yml'
 
 variables:
@@ -470,9 +470,9 @@ With:
 ```yaml
 include:
   # main component
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.0
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.1
   # Vault variant
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-vault@6.8.0
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-vault@6.8.1
     inputs:
       vault-base-url: "https://vault.acme.host/v1"
       # audience claim for JWT
@@ -512,13 +512,13 @@ The variant requires the additional configuration parameters:
 
 ```yaml
 include:
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.0
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python@6.8.1
     # 2: set/override component inputs
     inputs:
       image: registry.hub.docker.com/library/python:3.10
       pytest-enabled: true
 
-  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-gcp@6.8.0
+  - component: gitlab.com/to-be-continuous/python/gitlab-ci-python-gcp@6.8.1
     inputs:
       # common OIDC config for non-prod envs
       gcp-oidc-provider: "projects/<gcp_nonprod_proj_id>/locations/global/workloadIdentityPools/<pool_id>/providers/<provider_id>"
diff --git a/templates/gitlab-ci-python-gcp.yml b/templates/gitlab-ci-python-gcp.yml
index 4a68c6218a93f32a5ccd13dd991be5e7b08e73a4..5ca0be42daee3a8602817d3decdc0b94c00d6e07 100644
--- a/templates/gitlab-ci-python-gcp.yml
+++ b/templates/gitlab-ci-python-gcp.yml
@@ -43,7 +43,7 @@ variables:
   image: $PYTHON_IMAGE
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "python", "6.8.0"]
+      command: ["--service", "python", "6.8.1"]
   variables:
     GCP_JWT: $GCP_JWT
   before_script:
diff --git a/templates/gitlab-ci-python-vault.yml b/templates/gitlab-ci-python-vault.yml
index 3bb2abed63d41da185f26e796f091cbfb1a92b17..b6034a497a9f1b12a3830ef450d99e5f49bd7634 100644
--- a/templates/gitlab-ci-python-vault.yml
+++ b/templates/gitlab-ci-python-vault.yml
@@ -22,7 +22,7 @@ variables:
 .python-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "python", "6.8.0"]
+      command: ["--service", "python", "6.8.1"]
     - name: "$TBC_VAULT_IMAGE"
       alias: "vault-secrets-provider"
   variables:
diff --git a/templates/gitlab-ci-python.yml b/templates/gitlab-ci-python.yml
index 0fb55eb10fc30f68bb9a7108f577556e3146893f..0a55f42102a6e41c4f7e7732ebcdc5295a860998 100644
--- a/templates/gitlab-ci-python.yml
+++ b/templates/gitlab-ci-python.yml
@@ -805,7 +805,7 @@ stages:
   image: $PYTHON_IMAGE
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "python", "6.8.0"]
+      command: ["--service", "python", "6.8.1"]
   # Cache downloaded dependencies and plugins between builds.
   # To keep cache across branches add 'key: "$CI_JOB_NAME"'
   cache: