diff --git a/platform/cnpg/helmrelease.yaml b/platform/cnpg/helmrelease.yaml
index 18c6db9..ec1f17e 100644
--- a/platform/cnpg/helmrelease.yaml
+++ b/platform/cnpg/helmrelease.yaml
@@ -25,6 +25,11 @@ spec:
     remediation:
       retries: 3
   values:
+    # Avoid a full Postgres switchover on future operator minor bumps: update the instance-manager
+    # binary in place rather than recreating the pod (lands in the cnpg-controller-manager-config CM).
+    config:
+      data:
+        ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true"
     # Single operator replica is plenty for a home cluster; it only reconciles CRs.
     replicaCount: 1
     resources:
diff --git a/platform/externaldns/helmrelease.yaml b/platform/externaldns/helmrelease.yaml
index 1905ed3..01057c7 100644
--- a/platform/externaldns/helmrelease.yaml
+++ b/platform/externaldns/helmrelease.yaml
@@ -11,7 +11,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
+      version: ">=1.21.0 <1.22.0"   # k8s-1.36 catch-up (app v0.21; policy already set). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: external-dns
diff --git a/platform/monitoring/alloy.yaml b/platform/monitoring/alloy.yaml
index 3713edc..8a641bd 100644
--- a/platform/monitoring/alloy.yaml
+++ b/platform/monitoring/alloy.yaml
@@ -12,7 +12,7 @@ spec:
   chart:
     spec:
       chart: alloy
-      version: ">=0.10.0 <1.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
+      version: ">=1.0.0 <2.0.0"   # k8s-1.36 catch-up (1.x line). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: grafana
diff --git a/platform/oauth2-proxy/helmrelease.yaml b/platform/oauth2-proxy/helmrelease.yaml
index 2c741d6..cc9681f 100644
--- a/platform/oauth2-proxy/helmrelease.yaml
+++ b/platform/oauth2-proxy/helmrelease.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: oauth2-proxy
-      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=10.0.0 <11.0.0"   # k8s-1.36 catch-up (app v7.15.x). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: oauth2-proxy