diff --git a/images/07-iso/wrapper b/images/07-iso/wrapper
index 65cea26b..eba333e9 100755
--- a/images/07-iso/wrapper
+++ b/images/07-iso/wrapper
@@ -2,4 +2,4 @@
 A="$(echo "$@" | sed 's!-hfsplus -apm-block-size 2048 -hfsplus-file-creator-type chrp tbxj /System/Library/CoreServices/.disk_label -hfs-bless-by i /System/Library/CoreServices/boot.efi!!')"
 echo $A >> /tmp/args
 set -x
-exec xorriso -joliet on -rockridge on "$@"
+exec xorriso -joliet on -rockridge on $A
diff --git a/overlay/share/rancher/k3s/server/manifests/system-upgrade-controller.yaml b/overlay/share/rancher/k3s/server/manifests/system-upgrade-controller.yaml
index 54b1bd97..d65979a7 100644
--- a/overlay/share/rancher/k3s/server/manifests/system-upgrade-controller.yaml
+++ b/overlay/share/rancher/k3s/server/manifests/system-upgrade-controller.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -13,7 +12,7 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name:  system-upgrade
+  name: system-upgrade
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -29,13 +28,14 @@ metadata:
   name: default-controller-env
   namespace: k3os-system
 data:
-  SYSTEM_UPGRADE_CONTROLLER_DEBUG: "true"
+  SYSTEM_UPGRADE_CONTROLLER_DEBUG: "false"
   SYSTEM_UPGRADE_CONTROLLER_THREADS: "2"
   SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: "900"
   SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: "2"
   SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: "IfNotPresent"
   SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: "rancher/kubectl:v1.17.0"
   SYSTEM_UPGRADE_JOB_PRIVILEGED: "true"
+  SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: "900"
   SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: "15m"
 ---
 apiVersion: apps/v1
@@ -59,13 +59,9 @@ spec:
               - matchExpressions:
                   - {key: "node-role.kubernetes.io/master", operator: In, values: ["true"]}
       serviceAccountName: k3os-upgrade
-      tolerations:
-        - key: "node.kubernetes.io/unschedulable" # necessary to avoid cordon/drain
-          operator: "Exists"
-          effect: "NoSchedule"
       containers:
         - name: system-upgrade-controller
-          image: rancher/system-upgrade-controller:v0.3.1
+          image: rancher/system-upgrade-controller:v0.4.0
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
@@ -79,10 +75,6 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-            - name: SYSTEM_UPGRADE_CONTROLLER_SERVICE_ACCOUNT
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.serviceAccountName
           volumeMounts:
             - name: etc-ssl
               mountPath: /etc/ssl