diff --git a/tests/integration/kubernetes/confidential_kbs.sh b/tests/integration/kubernetes/confidential_kbs.sh
index c7cfc66683..e8685d2dd9 100644
--- a/tests/integration/kubernetes/confidential_kbs.sh
+++ b/tests/integration/kubernetes/confidential_kbs.sh
@@ -266,9 +266,8 @@ function kbs_k8s_deploy() {
 
 	# Image tag for TDX
 	if [ "${KATA_HYPERVISOR}" = "qemu-tdx" ]; then
-		# The ITA / ITTS images are named as:
-		# ita-as-${image_tag}
-		image_tag=$(echo ${image_tag} | sed 's/built-in/ita/g')
+		image=$(get_from_kata_deps ".externals.coco-trustee.ita_image")
+		image_tag=$(get_from_kata_deps ".externals.coco-trustee.ita_image_tag")
 	fi
 
 	# The ingress handler for AKS relies on the cluster's name which in turn
diff --git a/versions.yaml b/versions.yaml
index 121b86fbfa..5798e4339e 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -238,8 +238,11 @@ externals:
     description: "Provides attestation and secret delivery components"
     url: "https://github.com/confidential-containers/trustee"
     version: "f287fcd60b0b3ddbef5546d646669813b9e68f8d"
+    # image / ita_image and image_tag / ita_image_tag must be in sync
     image: "ghcr.io/confidential-containers/staged-images/kbs"
     image_tag: "f287fcd60b0b3ddbef5546d646669813b9e68f8d"
+    ita_image: "ghcr.io/confidential-containers/staged-images/kbs-ita-as"
+    ita_image_tag: "f287fcd60b0b3ddbef5546d646669813b9e68f8d-x86_64"
     toolchain: "1.74.0"
 
   crio: