diff --git a/Dockerfile b/Dockerfile
index d7ffb2a36a11cd70b4745d1fe58e762fa85f1e1b..7b6af16fd3e221862d99b91c711fb2f94c9e1407 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,8 @@ RUN yum update -y && \
     yum install restic-${restic_version} -y && \
     # we need this to interact with manila OpenStack to get CephFS information
     yum install centos-release-openstack-xena -y && \
-    yum install -y /usr/bin/openstack python3-requests-kerberos && \
+    # Openstack installation broken, see: https://gitlab.cern.ch/drupal/paas/drupal-operations/-/jobs/21224622
+    # yum install -y /usr/bin/openstack --disableplugin=protectbase && \
     yum clean all
 
 COPY ./tekton-task-templates /tekton-task-templates
diff --git a/scripts/restore-stuck-updates.sh b/scripts/restore-stuck-updates.sh
new file mode 100755
index 0000000000000000000000000000000000000000..3c6cd4c97622277ecb81e7cd8b9c3e3130874ece
--- /dev/null
+++ b/scripts/restore-stuck-updates.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+### FILTERs
+STUCK_WEBSITE_FILTER='.status.releaseID.current != .status.releaseID.failsafe'
+WEBSITE_LIST_OUTPUT='(.metadata.name + " " + .metadata.namespace + " " + .status.releaseID.failsafe)'
+
+# Time between patches not to overwhelm the Operator
+# This can be skipped/reduced once we have this issue closed: https://gitlab.cern.ch/webservices/webframeworks-planning/-/issues/869
+export GRACE_PERIOD="1s"
+
+## NB: This will match the spec of all websites based on failStatus version
+##
+oc get -o json drupalsite -A |
+    jq -r ".items[] | select(${STUCK_WEBSITE_FILTER}) | ${WEBSITE_LIST_OUTPUT}"  |
+        # Retrieve Spec Name from failSafe status
+        xargs -l bash -c 'export name=$(echo $2 | cut -d"-" -f -2);
+        # Retrieve spec ReleaseID from failsafe status
+        export spec=$(echo $2 |cut -d"-" -f 3"-"45);
+        # Generate Patch to be applied
+        cat > patch.yaml <<EOF
+spec:
+  version:
+    name: ${name}
+    releaseSpec: ${spec}
+EOF
+        oc patch drupalsite/$0 -n $1 --type=merge --patch-file patch.yaml;
+        sleep ${GRACE_PERIOD}'