diff --git a/.cruft.json b/.cruft.json
index c2ab0d7d6..1f8bce1ca 100644
--- a/.cruft.json
+++ b/.cruft.json
@@ -17,7 +17,7 @@
       "automerge_patch_v0": "n",
       "automerge_patch_regexp_blocklist": "",
       "automerge_patch_v0_regexp_allowlist": "",
-      "automerge_minor_regexp_allowlist": "",
+      "automerge_minor_regexp_allowlist": "^quay.io/appuio/oc$",
       "auto_release": "y",
       "copyright_holder": "VSHN AG <info@vshn.ch>",
       "copyright_year": "2021",
diff --git a/class/defaults.yml b/class/defaults.yml
index 88db45f9b..80ff4b63c 100644
--- a/class/defaults.yml
+++ b/class/defaults.yml
@@ -143,7 +143,7 @@ parameters:
         version: "1.16.4"
 
     images:
-      kubectl:
-        registry: docker.io
-        image: bitnami/kubectl
-        tag: '1.30.7@sha256:1249fc292e84a38575ee0cadc3e28dcd7ddf5a3a4e5da401b1a8599e8ac52a1b'
+      oc:
+        registry: quay.io
+        repository: appuio/oc
+        tag: v4.18
diff --git a/component/cleanup.libsonnet b/component/cleanup.libsonnet
index 9723d451a..a169085cb 100644
--- a/component/cleanup.libsonnet
+++ b/component/cleanup.libsonnet
@@ -56,7 +56,7 @@ local job = kube.Job(name) {
         serviceAccountName: serviceAccount.metadata.name,
         containers_+: {
           patch_crds: kube.Container(name) {
-            image: '%(registry)s/%(image)s:%(tag)s' % params.images.kubectl,
+            image: '%(registry)s/%(repository)s:%(tag)s' % params.images.oc,
             workingDir: '/home',
             command: [ 'sh', '-c' ],
             args: [
diff --git a/component/egress-gateway-shadow-ranges.libsonnet b/component/egress-gateway-shadow-ranges.libsonnet
index 21c04b231..92a36c9ab 100644
--- a/component/egress-gateway-shadow-ranges.libsonnet
+++ b/component/egress-gateway-shadow-ranges.libsonnet
@@ -146,7 +146,7 @@ local egress_ip_shadow_ranges =
           spec+: {
             containers_: {
               sleep: kube.Container('sleep') {
-                image: '%(registry)s/%(image)s:%(tag)s' % params.images.kubectl,
+                image: '%(registry)s/%(repository)s:%(tag)s' % params.images.oc,
                 command: [ '/bin/sh', '-c', 'trap : TERM INT; sleep infinity & wait' ],
                 volumeMounts_: {
                   shadow_ranges: {
diff --git a/renovate.json b/renovate.json
index f2e1d6718..aaa59c9e4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -37,6 +37,21 @@
         "automerge",
         "bump:patch"
       ]
+    },
+    {
+      "matchUpdateTypes": [
+        "minor"
+      ],
+      "automerge": true,
+      "platformAutomerge": false,
+      "labels": [
+        "dependency",
+        "automerge",
+        "bump:minor"
+      ],
+      "matchPackagePatterns": [
+        "^quay.io/appuio/oc$"
+      ]
     }
   ]
 }
diff --git a/tests/golden/clustermesh/cilium/cilium/olm/99_cleanup.yaml b/tests/golden/clustermesh/cilium/cilium/olm/99_cleanup.yaml
index 94ad3664d..bc150fdcd 100644
--- a/tests/golden/clustermesh/cilium/cilium/olm/99_cleanup.yaml
+++ b/tests/golden/clustermesh/cilium/cilium/olm/99_cleanup.yaml
@@ -75,7 +75,7 @@ spec:
           env:
             - name: HOME
               value: /home
-          image: docker.io/bitnami/kubectl:1.30.7@sha256:1249fc292e84a38575ee0cadc3e28dcd7ddf5a3a4e5da401b1a8599e8ac52a1b
+          image: quay.io/appuio/oc:v4.18
           imagePullPolicy: IfNotPresent
           name: cleanup-old-clusterserviceversions
           ports: []
diff --git a/tests/golden/egress-gateway/cilium/cilium/30_egress_ip_shadow_ranges.yaml b/tests/golden/egress-gateway/cilium/cilium/30_egress_ip_shadow_ranges.yaml
index 4535048c5..e663709e4 100644
--- a/tests/golden/egress-gateway/cilium/cilium/30_egress_ip_shadow_ranges.yaml
+++ b/tests/golden/egress-gateway/cilium/cilium/30_egress_ip_shadow_ranges.yaml
@@ -37,7 +37,7 @@ spec:
             - -c
             - 'trap : TERM INT; sleep infinity & wait'
           env: []
-          image: docker.io/bitnami/kubectl:1.30.7@sha256:1249fc292e84a38575ee0cadc3e28dcd7ddf5a3a4e5da401b1a8599e8ac52a1b
+          image: quay.io/appuio/oc:v4.18
           imagePullPolicy: IfNotPresent
           name: sleep
           ports: []
diff --git a/tests/golden/enterprise-bgp/cilium/cilium/olm/99_cleanup.yaml b/tests/golden/enterprise-bgp/cilium/cilium/olm/99_cleanup.yaml
index 94ad3664d..bc150fdcd 100644
--- a/tests/golden/enterprise-bgp/cilium/cilium/olm/99_cleanup.yaml
+++ b/tests/golden/enterprise-bgp/cilium/cilium/olm/99_cleanup.yaml
@@ -75,7 +75,7 @@ spec:
           env:
             - name: HOME
               value: /home
-          image: docker.io/bitnami/kubectl:1.30.7@sha256:1249fc292e84a38575ee0cadc3e28dcd7ddf5a3a4e5da401b1a8599e8ac52a1b
+          image: quay.io/appuio/oc:v4.18
           imagePullPolicy: IfNotPresent
           name: cleanup-old-clusterserviceversions
           ports: []
diff --git a/tests/golden/olm-opensource/cilium/cilium/olm/99_cleanup.yaml b/tests/golden/olm-opensource/cilium/cilium/olm/99_cleanup.yaml
index 94ad3664d..bc150fdcd 100644
--- a/tests/golden/olm-opensource/cilium/cilium/olm/99_cleanup.yaml
+++ b/tests/golden/olm-opensource/cilium/cilium/olm/99_cleanup.yaml
@@ -75,7 +75,7 @@ spec:
           env:
             - name: HOME
               value: /home
-          image: docker.io/bitnami/kubectl:1.30.7@sha256:1249fc292e84a38575ee0cadc3e28dcd7ddf5a3a4e5da401b1a8599e8ac52a1b
+          image: quay.io/appuio/oc:v4.18
           imagePullPolicy: IfNotPresent
           name: cleanup-old-clusterserviceversions
           ports: []