diff --git a/platform/velero/helmrelease.yaml b/platform/velero/helmrelease.yaml
index deb6501..31d56f1 100644
--- a/platform/velero/helmrelease.yaml
+++ b/platform/velero/helmrelease.yaml
@@ -40,6 +40,15 @@ spec:
     remediation:
       retries: 3
   values:
+    # --- CRD upgrade/cleanup hook image. The chart default is docker.io/bitnami/kubectl, whose public
+    #     Docker Hub catalog Bitnami REMOVED (Aug 2025) — `docker.io/bitnami/kubectl:1.31` 404s, leaving
+    #     the pre-install `velero-upgrade-crds` hook in Init:ImagePullBackOff and Velero never installing.
+    #     Repoint to the Rancher-maintained kubectl mirror, pinned to the cluster's exact k8s minor
+    #     (v1.31.5, multi-arch amd64/arm64). Verified pullable via the Docker Hub registry API. ---
+    kubectl:
+      image:
+        repository: docker.io/rancher/kubectl
+        tag: v1.31.5
     # --- AWS object-store plugin (BSL provider=aws → MinIO S3-compatible), loaded as an init container.
     #     Image minor MUST track the Velero minor (chart 8.x = Velero 1.15 → plugin v1.11.x). ---
     initContainers: