diff --git a/docker/staging_pull_compose.template.yaml b/docker/staging_pull_compose.template.yaml
index 91e1ced1..01c6b86f 100644
--- a/docker/staging_pull_compose.template.yaml
+++ b/docker/staging_pull_compose.template.yaml
@@ -263,13 +263,18 @@ services:
       - ory-net
 
   init-rp:
-    image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+    image: alpine:latest
     env_file:
       - .env
-    entrypoint: ["/bin/sh"]
     command:
+      - /bin/sh
       - -ec
       - |
+        apk add --no-cache curl tar
+        curl -sLo /tmp/hydra.tar.gz https://github.com/ory/hydra/releases/download/v25.4.0/hydra_25.4.0-linux_64bit.tar.gz
+        tar -xzf /tmp/hydra.tar.gz -C /usr/local/bin hydra
+        rm /tmp/hydra.tar.gz
+
         hydra delete oauth2-client --endpoint http://hydra:4445 adminfront >/dev/null 2>&1 || true
         hydra delete oauth2-client --endpoint http://hydra:4445 devfront >/dev/null 2>&1 || true
         hydra delete oauth2-client --endpoint http://hydra:4445 $${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect} >/dev/null 2>&1 || true
@@ -281,7 +286,7 @@ services:
           --response-type code \
           --scope openid,offline_access,profile,email \
           --token-endpoint-auth-method none \
-          --redirect-uri $${ADMINFRONT_CALLBACK_URLS:-http://localhost:5173/auth/callback}
+          --redirect-uri "$${ADMINFRONT_CALLBACK_URLS:-http://localhost:5173/auth/callback}"
 
         hydra create oauth2-client \
           --endpoint http://hydra:4445 \
@@ -290,12 +295,12 @@ services:
           --response-type code \
           --scope openid,offline_access,profile,email \
           --token-endpoint-auth-method none \
-          --redirect-uri $${DEVFRONT_CALLBACK_URLS:-http://localhost:5174/auth/callback}
+          --redirect-uri "$${DEVFRONT_CALLBACK_URLS:-http://localhost:5174/auth/callback}"
 
         hydra create oauth2-client \
           --endpoint http://hydra:4445 \
-          --id $${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect} \
-          --secret $${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret} \
+          --id "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" \
+          --secret "$${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}" \
           --grant-type client_credentials \
           --response-type token \
           --scope openid,offline_access,profile,email