diff --git a/src/com/homelab/stages/updateHelmTag.groovy b/src/com/homelab/stages/updateHelmTag.groovy
index 53a8f63..65e16fe 100644
--- a/src/com/homelab/stages/updateHelmTag.groovy
+++ b/src/com/homelab/stages/updateHelmTag.groovy
@@ -43,6 +43,14 @@ def run(Map config) {
                 def authedUrl = "${urlParts[0]}://\${GIT_USER}:\${GIT_PASS}@${urlParts[1]}"
                 sh """
                     git clone ${authedUrl} .
+                    # docker:27-cli's Alpine base doesn't ship yq by
+                    # default. Package name is 'yq-go' on Alpine >= 3.20,
+                    # plain 'yq' on older Alpine (both are mikefarah/yq,
+                    # the Go tool this -i/path-expression syntax assumes
+                    # — a same-named 'yq' package on some distros is a
+                    # completely different, Python-based tool). Try both
+                    # rather than guess which Alpine base is current.
+                    apk add --no-cache yq-go 2>/dev/null || apk add --no-cache yq
                     yq -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}
                     git config user.email 'jenkins-ci@homelab.local'
                     git config user.name 'jenkins-ci'