diff --git a/docker/scheduled-task.Dockerfile b/docker/scheduled-task.Dockerfile
index 1ece0e96..f4f994be 100644
--- a/docker/scheduled-task.Dockerfile
+++ b/docker/scheduled-task.Dockerfile
@@ -4,7 +4,10 @@
 # its steps only reach for kubectl + gomplate (bash/jq/np ship in the base).
 FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0
 
-RUN apk add --no-cache gomplate
+# aws-cli: the k8s scope scripts this overlay runs on top of call `aws` (sts
+# assume-role first of all, then IAM and ECR); without it every action fails at
+# the assume_role step on AWS installs.
+RUN apk add --no-cache aws-cli gomplate
 
 ARG TARGETARCH
 ARG KUBECTL_VERSION=1.30.4
@@ -13,6 +16,11 @@ RUN curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_V
  && kubectl version --client
 
 COPY . /app/pkg
+# The scheduled task is the k8s scope run with the scheduled_task overlay (see
+# scheduled_task/specs/notification-channel.json.tpl: --service-path=k8s
+# --overrides-path=scheduled_task), so the base stays k8s and the overlay goes
+# in NP_OVERRIDES_PATH, like containers-datadog does.
 ENV NP_PACKAGE_NAME=scheduled-task \
-    NP_SERVICE_PATH=/app/pkg/scheduled_task \
+    NP_SERVICE_PATH=/app/pkg/k8s \
+    NP_OVERRIDES_PATH=/app/pkg/scheduled_task \
     NP_SCOPE_ENTRYPOINT=/app/pkg/entrypoint