diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a6d8850b..6060cfc5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -20,24 +20,25 @@ variables:
   DOCKER_BUILDKIT: "1"
   COMPOSE_DOCKER_CLI_BUILD: "1" 
   CI_DEBUG_TRACE: "true"
+  TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
 
-before_script:
-    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
-
+     
 # runs on protected branches and pushes to repo
 build-push:
   stage: build
   tags:
     - integration
+  before_script:
+    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
   script:
-    - TAG=$CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA sh ./scripts/build-push.sh
+    - TAG=$TAG sh ./scripts/build-push.sh
   rules:
   - if: $CI_COMMIT_REF_PROTECTED == "true"
     when: always
 
 deploy-k8s-dev:
   stage: deploy
-  image: dtzar/helm-kubectl
+  image: k8s.gcr.io/kustomize/kustomize:v3.8.7
   variables:
     CI_DEBUG_TRACE: "true"
   script:
@@ -55,12 +56,12 @@ deploy-k8s-dev:
     - kubectl delete hr redis && kubectl delete pvc -l 'app=redis'
     - kubectl apply -f kubernetes/eth-node/ -f kubernetes/postgresql/ -f kubernetes/redis/
     - echo "deploy and run database migrations..."
-    - kubectl apply -f kubernetes/cic-auth-proxy
-    - kubectl apply -f kubernetes/cic-cache
-    - kubectl apply -f kubernetes/cic-eth
-    - kubectl apply -f kubernetes/cic-meta
-    - kubectl apply -f kubernetes/cic-notify
-    - kubectl apply -f kubernetes/cic-staff-client
-    - kubectl apply -f kubernetes/cic-ussd
+      # set image based on deploy tag
+    - bash ./scripts/set-image.sh
+    - kubectl apply -f . 
     - echo "run contract migrations..."
     - kubectl apply -f kubernetes/contract-migration/contract-migration-job.yaml
+  rules:
+  - if: $CI_COMMIT_REF_PROTECTED == "true"
+    when: always
+
diff --git a/docker-compose.yml b/docker-compose.yml
index d61cab55..894a3f0c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -117,6 +117,7 @@ services:
     volumes:
       - contract-config:/tmp/cic/config
 
+
   cic-cache-tracker:
     image: registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-cache:${TAG:-latest}
     profiles:
diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml
new file mode 100644
index 00000000..4ea1bcca
--- /dev/null
+++ b/kubernetes/kustomization.yaml
@@ -0,0 +1,2 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
diff --git a/scripts/set-image.sh b/scripts/set-image.sh
new file mode 100755
index 00000000..52ed9cce
--- /dev/null
+++ b/scripts/set-image.sh
@@ -0,0 +1,21 @@
+#! /bin/bash
+
+set -e
+
+cd kubernetes/
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-cache:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/bloxberg-node:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/contract-migration:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-eth:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-notify:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-meta:$TAG
+
+kustomize edit set image registry.gitlab.com/grassrootseconomics/cic-internal-integration/cic-ussd:$TAG
+
+echo "kustomize set image to ${TAG? no variable TAG set}"