diff --git a/environments/.stackhpc/tofu/cluster_image.auto.tfvars.json b/environments/.stackhpc/tofu/cluster_image.auto.tfvars.json
index 56d3e237c..37fa04c35 100644
--- a/environments/.stackhpc/tofu/cluster_image.auto.tfvars.json
+++ b/environments/.stackhpc/tofu/cluster_image.auto.tfvars.json
@@ -1,6 +1,6 @@
 {
     "cluster_image": {
-        "RL8": "openhpc-RL8-250422-1328-1a6eff86",
-        "RL9": "openhpc-RL9-250422-1328-1a6eff86"
+        "RL8": "openhpc-RL8-250423-1606-b61e2f1a",
+        "RL9": "openhpc-RL9-250423-1606-b61e2f1a"
     }
 }
diff --git a/environments/common/inventory/group_vars/all/prometheus.yml b/environments/common/inventory/group_vars/all/prometheus.yml
index 6c40e66bb..f4587e672 100644
--- a/environments/common/inventory/group_vars/all/prometheus.yml
+++ b/environments/common/inventory/group_vars/all/prometheus.yml
@@ -15,7 +15,9 @@ prometheus_alertmanager_config_default:
       - "{{ alertmanager_address }}:{{ alertmanager_port }}"
     basic_auth:
       username: alertmanager
-      password: "{{ vault_alertmanager_admin_password }}"
+      # cloudalchemy.prometheus/preflight checks this config so it must be
+      # templatable even during build when it is not used
+      password: "{{ vault_alertmanager_admin_password | default('UNDEFINED') }}"
 
 prometheus_alertmanager_config_extra: []
 prometheus_alertmanager_config: "{{ (prometheus_alertmanager_config_default if groups['alertmanager'] else []) + prometheus_alertmanager_config_extra }}"