diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6805acb45..868a8eb37 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -152,6 +152,7 @@ jobs:
         INTEGRATION_TEST_AZURE_CLIENT_ID: ${{ secrets.azure_client_id }}
         KOSLI_SONAR_API_TOKEN: ${{ secrets.sonarqube_token }}
         DOCKER_API_VERSION: "1.45"
+        KOSLI_API_TOKEN_PROD: ${{ secrets.kosli_api_token }}
       run: |
         # some tests use git operations, therefore the git author on the CI VM needs to be set
         git config --global user.name "John Doe"
diff --git a/Makefile b/Makefile
index b7c3d76bd..bcbf45a34 100644
--- a/Makefile
+++ b/Makefile
@@ -70,10 +70,14 @@ ensure_gotestsum:
 	@go install gotest.tools/gotestsum@latest
 
 test_setup: ensure_gotestsum
-	./bin/reset-or-start-server.sh
+# cat and exit if error
+	./hack/get-server-image.sh > /tmp/server-image.txt || (cat /tmp/server-image.txt && exit 1) 
+	export KOSLI_SERVER_IMAGE=$$(cat /tmp/server-image.txt) && ./bin/reset-or-start-server.sh
 
 test_setup_restart_server: ensure_gotestsum
-	./bin/reset-or-start-server.sh force
+# cat and exit if error
+	./hack/get-server-image.sh > /tmp/server-image.txt || (cat /tmp/server-image.txt && exit 1)
+	export KOSLI_SERVER_IMAGE=$$(cat /tmp/server-image.txt) && ./bin/reset-or-start-server.sh force
 
 test_integration: deps vet ensure_network test_setup ## Run tests except the too slow ones
 	@[ -e ~/.kosli.yml ] && mv ~/.kosli.yml ~/.kosli-renamed.yml || true
diff --git a/bin/reset-or-start-server.sh b/bin/reset-or-start-server.sh
index e111fc9cd..efbf34a4e 100755
--- a/bin/reset-or-start-server.sh
+++ b/bin/reset-or-start-server.sh
@@ -1,6 +1,14 @@
 #!/bin/bash
+set -euo pipefail
 
-force_restart=$1
+# Validate KOSLI_SERVER_IMAGE
+if [[ -z "${KOSLI_SERVER_IMAGE:-}" ]] || [[ "$KOSLI_SERVER_IMAGE" == *"Error"* ]]; then
+    echo "❌ Invalid or missing KOSLI_SERVER_IMAGE"
+    exit 1
+fi
+
+# Set force_restart to the first argument if provided, empty string otherwise
+force_restart="${1:-}"
 container_name=cli_kosli_server
 
 check_success()
@@ -18,7 +26,8 @@ restart_server()
     echo restarting server ...
     ./bin/docker_login_aws.sh staging
     docker compose down || true
-    docker pull 772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely:latest || true
+    echo -e "\033[38;5;208musing server image\033[0m ${KOSLI_SERVER_IMAGE}"
+    docker pull ${KOSLI_SERVER_IMAGE} || true
     docker compose up -d
     ./mongo/ip_wait.sh localhost:9010/minio/health/live
     ./mongo/ip_wait.sh localhost:8001/ready
diff --git a/docker-compose.yml b/docker-compose.yml
index 263e43006..b34506efc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,7 @@ services:
   server-index:
     networks: [ cli_net ]
     depends_on: [ mongo_rs_initiate, minio ]
-    image: 772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely:latest
+    image: ${KOSLI_SERVER_IMAGE}
     platform: linux/amd64
     command: /app/src/documentdb/wait_till_ready_or_raise.py
     container_name: cli_kosli_server-index
@@ -34,7 +34,7 @@ services:
         condition: service_started
       server-index:
         condition: service_completed_successfully
-    image: 772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely:latest
+    image: ${KOSLI_SERVER_IMAGE}
     platform: linux/amd64
     env_file: [ "./mongo/mongo.env" ]
     environment:
diff --git a/hack/get-server-image.sh b/hack/get-server-image.sh
new file mode 100755
index 000000000..4950cdb36
--- /dev/null
+++ b/hack/get-server-image.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -uo pipefail
+
+# Check that jq is installed
+if ! command -v jq &> /dev/null; then
+  echo "❌ Error: 'jq' is not installed. Please install it:" >&2
+  echo "    macOS: brew install jq" >&2
+  echo "    Debian/Ubuntu: sudo apt install jq" >&2
+  exit 1
+fi
+
+# Check if KOSLI_API_TOKEN_PROD is set, if not prompt for it
+if [[ -z "${KOSLI_API_TOKEN_PROD:-}" ]]; then
+  printf "Enter KOSLI_API_TOKEN_PROD: " >&2
+  read -s KOSLI_API_TOKEN_PROD
+  echo "" >&2  # new line after silent read
+  export KOSLI_API_TOKEN_PROD
+fi
+
+# Now that we have the token, we can set -e
+set -e
+
+# Get snapshot JSON from kosli
+json=$(kosli get snapshot staging-aws --org kosli -a ${KOSLI_API_TOKEN_PROD} --output json)
+
+# Extract and format the desired artifact
+echo "$json" | jq -r '
+  .artifacts[]
+  | select(.name | test("merkely:"))
+  | select(.annotation.type != "exited")
+  | "\(.name | sub(":.*"; ""))@sha256:\(.fingerprint)"
+'
\ No newline at end of file