diff --git a/platform/kyverno/admission/helmrelease.yaml b/platform/kyverno/admission/helmrelease.yaml
index b8c4080..e451e0f 100644
--- a/platform/kyverno/admission/helmrelease.yaml
+++ b/platform/kyverno/admission/helmrelease.yaml
@@ -34,6 +34,17 @@ spec:
     remediation:
       retries: 3
   values:
+    # The chart's cleanup Jobs default to bitnami/kubectl:1.30.2, which Bitnami PURGED from Docker Hub
+    # (2024 catalog change) → the jobs ImagePullBackOff. policyReportsCleanup runs as a Helm
+    # post-upgrade HOOK, so its failure STALLS every helm upgrade (5m timeout → HelmRelease not-Ready →
+    # platform Kustomization blocks). Point both cleanup images at Bitnami's relocated `bitnamilegacy`
+    # mirror — the identical image (has /bin/bash + awk/wc/xargs + kubectl the jobs need). Pinned tag.
+    policyReportsCleanup:
+      image:
+        repository: bitnamilegacy/kubectl
+    webhooksCleanup:
+      image:
+        repository: bitnamilegacy/kubectl
     # Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
     # restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
     admissionController: