diff --git a/charts/emissary-ingress/templates/deployment-canary.yaml b/charts/emissary-ingress/templates/deployment-canary.yaml
index e6e8c2775e..024bc02579 100644
--- a/charts/emissary-ingress/templates/deployment-canary.yaml
+++ b/charts/emissary-ingress/templates/deployment-canary.yaml
@@ -113,7 +113,7 @@ spec:
       initContainers:
       {{- if and .Values.waitForApiext (eq .Values.waitForApiext.enabled true) }}
       - name: wait-for-apiext
-        image: istio/kubectl:1.5.10
+        image: public.ecr.aws/bitnami/kubectl:1.30.0
         imagePullPolicy: IfNotPresent
         {{- with .Values.waitForApiext.securityContext }}
         securityContext:
@@ -122,6 +122,7 @@ spec:
         command: ["/bin/sh", "-c"]
         args:
           - |
+            set -eu
             deployment_name={{ .Values.waitForApiext.deploymentName | default "emissary-apiext" | quote }}
             deployment_namespace={{ .Values.waitForApiext.deploymentNamespace | default "emissary-system" | quote }}
             while true; do
@@ -135,7 +136,7 @@ spec:
                   while true; do
                   desired_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.spec.replicas}')
                   current_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.status.replicas}')
-                  if [[ $current_replicas != $desired_replicas ]]; then
+                  if [ $current_replicas != $desired_replicas ]; then
                     echo "$deployment_name.$deployment_namespace is in the process of restarting. Have: $current_replicas, want $desired_replicas"
                     sleep 3
                   else
diff --git a/charts/emissary-ingress/templates/deployment.yaml b/charts/emissary-ingress/templates/deployment.yaml
index 2c4d17a0a1..b44fe53768 100644
--- a/charts/emissary-ingress/templates/deployment.yaml
+++ b/charts/emissary-ingress/templates/deployment.yaml
@@ -134,7 +134,7 @@ spec:
       initContainers:
       {{- if and .Values.waitForApiext (eq .Values.waitForApiext.enabled true) }}
       - name: wait-for-apiext
-        image: istio/kubectl:1.5.10
+        image: public.ecr.aws/bitnami/kubectl:1.30.0
         imagePullPolicy: IfNotPresent
         {{- with .Values.waitForApiext.securityContext }}
         securityContext:
@@ -143,6 +143,7 @@ spec:
         command: ["/bin/sh", "-c"]
         args:
           - |
+            set -eu
             deployment_name={{ .Values.waitForApiext.deploymentName | default "emissary-apiext" | quote }}
             deployment_namespace={{ .Values.waitForApiext.deploymentNamespace | default "emissary-system" | quote }}
             while true; do
@@ -156,7 +157,7 @@ spec:
                   while true; do
                   desired_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.spec.replicas}')
                   current_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.status.replicas}')
-                  if [[ $current_replicas != $desired_replicas ]]; then
+                  if [ $current_replicas != $desired_replicas ]; then
                     echo "$deployment_name.$deployment_namespace is in the process of restarting. Have: $current_replicas, want $desired_replicas"
                     sleep 3
                   else
diff --git a/manifests/emissary/emissary-defaultns.yaml.in b/manifests/emissary/emissary-defaultns.yaml.in
index 5126f391ff..1eaddfbcff 100644
--- a/manifests/emissary/emissary-defaultns.yaml.in
+++ b/manifests/emissary/emissary-defaultns.yaml.in
@@ -321,6 +321,7 @@ spec:
       initContainers:
       - args:
         - |
+          set -eu
           deployment_name="emissary-apiext"
           deployment_namespace="emissary-system"
           while true; do
@@ -334,7 +335,7 @@ spec:
                 while true; do
                 desired_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.spec.replicas}')
                 current_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.status.replicas}')
-                if [[ $current_replicas != $desired_replicas ]]; then
+                if [ $current_replicas != $desired_replicas ]; then
                   echo "$deployment_name.$deployment_namespace is in the process of restarting. Have: $current_replicas, want $desired_replicas"
                   sleep 3
                 else
@@ -354,7 +355,7 @@ spec:
         command:
         - /bin/sh
         - -c
-        image: istio/kubectl:1.5.10
+        image: public.ecr.aws/bitnami/kubectl:1.30.0
         imagePullPolicy: IfNotPresent
         name: wait-for-apiext
         securityContext:
diff --git a/manifests/emissary/emissary-emissaryns.yaml.in b/manifests/emissary/emissary-emissaryns.yaml.in
index 906e58a8cf..012e5dfc1c 100644
--- a/manifests/emissary/emissary-emissaryns.yaml.in
+++ b/manifests/emissary/emissary-emissaryns.yaml.in
@@ -321,6 +321,7 @@ spec:
       initContainers:
       - args:
         - |
+          set -eu
           deployment_name="emissary-apiext"
           deployment_namespace="emissary-system"
           while true; do
@@ -334,7 +335,7 @@ spec:
                 while true; do
                 desired_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.spec.replicas}')
                 current_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.status.replicas}')
-                if [[ $current_replicas != $desired_replicas ]]; then
+                if [ $current_replicas != $desired_replicas ]; then
                   echo "$deployment_name.$deployment_namespace is in the process of restarting. Have: $current_replicas, want $desired_replicas"
                   sleep 3
                 else
@@ -354,7 +355,7 @@ spec:
         command:
         - /bin/sh
         - -c
-        image: istio/kubectl:1.5.10
+        image: public.ecr.aws/bitnami/kubectl:1.30.0
         imagePullPolicy: IfNotPresent
         name: wait-for-apiext
         securityContext:
diff --git a/python/tests/integration/manifests/ambassador.yaml b/python/tests/integration/manifests/ambassador.yaml
index 157edb6997..192300185f 100644
--- a/python/tests/integration/manifests/ambassador.yaml
+++ b/python/tests/integration/manifests/ambassador.yaml
@@ -189,6 +189,7 @@ spec:
   initContainers:
   - args:
     - |
+      set -eu
       deployment_name="emissary-apiext"
       deployment_namespace="emissary-system"
       while true; do
@@ -202,7 +203,7 @@ spec:
             while true; do
             desired_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.spec.replicas}')
             current_replicas=$(kubectl get deployment $deployment_name -n $deployment_namespace -o jsonpath='{.status.replicas}')
-            if [[ $current_replicas != $desired_replicas ]]; then
+            if [ $current_replicas != $desired_replicas ]; then
               echo "$deployment_name.$deployment_namespace is in the process of restarting. Have: $current_replicas, want $desired_replicas"
               sleep 3
             else
@@ -222,7 +223,7 @@ spec:
     command:
     - /bin/sh
     - -c
-    image: istio/kubectl:1.5.10
+    image: public.ecr.aws/bitnami/kubectl:1.30.0
     imagePullPolicy: IfNotPresent
     name: wait-for-apiext
     securityContext: