diff --git a/examples/demo/01-server.yaml b/examples/demo/01-server.yaml
index b7df709..901784d 100644
--- a/examples/demo/01-server.yaml
+++ b/examples/demo/01-server.yaml
@@ -14,7 +14,12 @@ metadata:
 spec:
   image:
     repository: git.ryuvia.com/niklas/terdut-server
-    tag: v0.33.2
+    # v0.34.0: fixes callerMayManageServiceAccount so an instance-scoped
+    # service account can adopt/rotate a key on a team-scoped account it
+    # didn't just create in the same call -- without this, terdutteam-*
+    # can wedge permanently on exactly the crash-window race this demo
+    # hit live (niklas/terdut-operator#3).
+    tag: v0.34.0
   replicas: 1
   networking:
     hostname: terdut-operator-demo.example