diff --git a/kubernetes/apps/mapache.yaml b/kubernetes/apps/mapache.yaml
index 8ce1798..0f54a88 100644
--- a/kubernetes/apps/mapache.yaml
+++ b/kubernetes/apps/mapache.yaml
@@ -18,7 +18,7 @@
 #     --from-literal=MQTT_PASSWORD="$(cd ../../infrastructure/infra/environments/prod && terraform output -raw mqtt_password)" \
 #     --from-literal=KERBECS_PASSWORD=... \
 #     --from-literal=SENTINEL_CLIENT_SECRET=... \
-#     --from-literal=SENTINEL_TOKEN=... \
+#     --from-literal=SENTINEL_SA_TOKEN=... \
 #     --from-literal=AWS_ACCESS_KEY_ID=... \
 #     --from-literal=AWS_SECRET_ACCESS_KEY=...
 #
diff --git a/kubernetes/manifests/mapache/auth.yaml b/kubernetes/manifests/mapache/auth.yaml
index 2eaa1ae..e9700b3 100644
--- a/kubernetes/manifests/mapache/auth.yaml
+++ b/kubernetes/manifests/mapache/auth.yaml
@@ -63,26 +63,23 @@ spec:
                 secretKeyRef:
                   name: mapache-secrets
                   key: KERBECS_PASSWORD
-            # Sentinel v5 (the k8s deployment) is up, but the OAuth client +
-            # JWKS for mapache haven't been migrated over yet. Keep pointing
-            # at the legacy hosts until that cutover happens, then bump both
-            # to https://sentinel-v5.gauchoracing.com.
+            # Sentinel v5: JWKS lives at /api/core/keys under SENTINEL_URL,
+            # so the separate JWKS env var is gone. SA token replaces the
+            # v4 static SENTINEL_TOKEN.
             - name: SENTINEL_URL
-              value: https://sentinel-api.gauchoracing.com
-            - name: SENTINEL_JWKS_URL
-              value: https://sso.gauchoracing.com/.well-known/jwks.json
+              value: https://sentinel-v5.gauchoracing.com
             - name: SENTINEL_CLIENT_ID
-              value: z6V9NREjMFhf
+              value: TIvD6jCH3mGV
             - name: SENTINEL_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   name: mapache-secrets
                   key: SENTINEL_CLIENT_SECRET
-            - name: SENTINEL_TOKEN
+            - name: SENTINEL_SA_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: mapache-secrets
-                  key: SENTINEL_TOKEN
+                  key: SENTINEL_SA_TOKEN
             - name: SENTINEL_REDIRECT_URI
               value: https://mapache.gauchoracing.com/auth/login
 ---
diff --git a/kubernetes/manifests/mapache/query.yaml b/kubernetes/manifests/mapache/query.yaml
index 13be7ef..9da227a 100644
--- a/kubernetes/manifests/mapache/query.yaml
+++ b/kubernetes/manifests/mapache/query.yaml
@@ -62,14 +62,12 @@ spec:
                 secretKeyRef:
                   name: mapache-secrets
                   key: KERBECS_PASSWORD
-            # See auth.yaml — keep on legacy Sentinel until the mapache
-            # cutover happens, then bump both to sentinel-v5.gauchoracing.com.
+            # Sentinel v5: JWKS lives at /api/core/keys under SENTINEL_URL,
+            # so the separate JWKS env var is gone (main.py derives it).
             - name: SENTINEL_URL
-              value: https://sentinel-api.gauchoracing.com
-            - name: SENTINEL_JWKS_URL
-              value: https://sso.gauchoracing.com/.well-known/jwks.json
+              value: https://sentinel-v5.gauchoracing.com
             - name: SENTINEL_CLIENT_ID
-              value: z6V9NREjMFhf
+              value: TIvD6jCH3mGV
 ---
 apiVersion: v1
 kind: Service