diff --git a/cluster/staging/app/core/deploy/tricot.hcl b/cluster/staging/app/core/deploy/tricot.hcl
index e7aded6..d642708 100644
--- a/cluster/staging/app/core/deploy/tricot.hcl
+++ b/cluster/staging/app/core/deploy/tricot.hcl
@@ -24,7 +24,7 @@ job "core-tricot" {
       driver = "docker"
 
       config {
-        image = "armael/tricot:n6dk1b5xrdww12zf12jbcmihqs6g1brz"
+        image = "armael/tricot:8sa24l6pxdppb5gq0nnj9kvcl9mijliy-block_user_agent"
         network_mode = "host"
         readonly_rootfs = true
         ports = [ "http_port", "https_port" ]
diff --git a/cluster/staging/app/garage/deploy/garage.hcl b/cluster/staging/app/garage/deploy/garage.hcl
index f0b164e..89e3d0d 100644
--- a/cluster/staging/app/garage/deploy/garage.hcl
+++ b/cluster/staging/app/garage/deploy/garage.hcl
@@ -192,6 +192,9 @@ job "garage-staging" {
             "tricot-add-header Access-Control-Allow-Origin *",
             "tricot-on-demand-tls-ask http://garage-staging-admin.service.staging.consul:3909/check",
             "tricot-site-lb",
+            "tricot-block-user-agent Claude-Web",
+            "tricot-block-user-agent ClaudeBot",
+            "tricot-block-user-agent anthropic-ai",
         ]
         port = "web"
         # Check 1: Garage is alive and answering TCP connections