diff --git a/containers/jenkins-master/Dockerfile b/containers/jenkins-master/Dockerfile
new file mode 100644
index 0000000..63a0401
--- /dev/null
+++ b/containers/jenkins-master/Dockerfile
@@ -0,0 +1,4 @@
+FROM jenkins/jenkins:lts
+
+# disable CSRF protection, otherwise Phabricator can't trigger builds
+ENV JENKINS_OPTS "-D hudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true"
\ No newline at end of file
diff --git a/kubernetes/jenkins.yaml b/kubernetes/jenkins.yaml
index 04f853a..39ad86d 100644
--- a/kubernetes/jenkins.yaml
+++ b/kubernetes/jenkins.yaml
@@ -70,7 +70,7 @@ spec:
       hostname: jenkins-master
       containers:
       - name: master
-        image: jenkins/jenkins:lts
+        image: jenkins/jenkins:2.190.3
         ports:
         - containerPort: 8080
         - containerPort: 50000
@@ -192,4 +192,4 @@ spec:
         secret:
           secretName: github-ssh-key
       nodeSelector:
-        cloud.google.com/gke-nodepool: jenkins-agents
\ No newline at end of file
+        cloud.google.com/gke-nodepool: jenkins-agents