diff --git a/kubernetes/ovh/credentials.tf b/kubernetes/ovh/credentials.tf
index e859568..d1ebd17 100644
--- a/kubernetes/ovh/credentials.tf
+++ b/kubernetes/ovh/credentials.tf
@@ -20,8 +20,12 @@ resource "kubernetes_namespace_v1" "access" {
 // Rotation anchor: replacing this resource (any change to credentials_version)
 // cascades to the consumer ServiceAccount and its token Secret through
 // replace_triggered_by, performing the credential rotation inside Terraform.
-resource "terraform_data" "credentials_version" {
-  input = var.credentials_version
+// null_resource instead of terraform_data: the Terraform of the tofu
+// controller runner (1.3.x) predates the terraform_data resource type.
+resource "null_resource" "credentials_version" {
+  triggers = {
+    version = var.credentials_version
+  }
 }
 
 // Consumer access: ServiceAccount + non expiring legacy token Secret. The
@@ -35,7 +39,7 @@ resource "kubernetes_service_account_v1" "consumer" {
   }
 
   lifecycle {
-    replace_triggered_by = [terraform_data.credentials_version]
+    replace_triggered_by = [null_resource.credentials_version]
   }
 }
 
@@ -70,7 +74,7 @@ resource "kubernetes_secret_v1" "consumer_token" {
   wait_for_service_account_token = true
 
   lifecycle {
-    replace_triggered_by = [terraform_data.credentials_version]
+    replace_triggered_by = [null_resource.credentials_version]
   }
 }
 
diff --git a/kubernetes/ovh/versions.tf b/kubernetes/ovh/versions.tf
index 0e6c7ff..b08c3b8 100644
--- a/kubernetes/ovh/versions.tf
+++ b/kubernetes/ovh/versions.tf
@@ -12,5 +12,9 @@ terraform {
       source  = "hashicorp/vault"
       version = "4.8.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.2.4"
+    }
   }
 }