diff --git a/platform/velero/helmrelease.yaml b/platform/velero/helmrelease.yaml
index 31d56f1..6cfd8d6 100644
--- a/platform/velero/helmrelease.yaml
+++ b/platform/velero/helmrelease.yaml
@@ -40,15 +40,19 @@ spec:
     remediation:
       retries: 3
   values:
-    # --- CRD upgrade/cleanup hook image. The chart default is docker.io/bitnami/kubectl, whose public
-    #     Docker Hub catalog Bitnami REMOVED (Aug 2025) — `docker.io/bitnami/kubectl:1.31` 404s, leaving
-    #     the pre-install `velero-upgrade-crds` hook in Init:ImagePullBackOff and Velero never installing.
-    #     Repoint to the Rancher-maintained kubectl mirror, pinned to the cluster's exact k8s minor
-    #     (v1.31.5, multi-arch amd64/arm64). Verified pullable via the Docker Hub registry API. ---
-    kubectl:
-      image:
-        repository: docker.io/rancher/kubectl
-        tag: v1.31.5
+    # --- CRD install strategy. The chart's pre-install `velero-upgrade-crds` HOOK job runs
+    #     docker.io/bitnami/kubectl, whose public Docker Hub catalog Bitnami REMOVED (Aug 2025) —
+    #     `docker.io/bitnami/kubectl:1.31` now 404s, leaving the hook in Init:ImagePullBackOff so Velero
+    #     never installs. The hook exists ONLY to UPDATE CRDs on chart upgrades; it is NOT how CRDs are
+    #     first installed. The chart ships all 13 Velero CRDs (backups/restores/backupstoragelocations/
+    #     schedules/podvolumebackups/…) in its native `crds/` directory, which Helm applies
+    #     UNCONDITIONALLY on install — before hooks — regardless of this flag.
+    #     Disabling the hook therefore drops the fragile external-kubectl-image dependency entirely while
+    #     the CRDs still install via Helm's crds/ handling. Trade-off: Helm never manages crds/ after the
+    #     initial install, so CRD *schema upgrades* on future chart bumps become a manual/Renovate step —
+    #     acceptable: Velero's CRDs are stable, and this is far less fragile than pinning a shell-bearing
+    #     kubectl mirror (rancher/kubectl is distroless → no /bin/sh for the hook's copy-binary step). ---
+    upgradeCRDs: false
     # --- AWS object-store plugin (BSL provider=aws → MinIO S3-compatible), loaded as an init container.
     #     Image minor MUST track the Velero minor (chart 8.x = Velero 1.15 → plugin v1.11.x). ---
     initContainers: