diff --git a/cicd/crossplane-config.yaml.gotmpl b/cicd/crossplane-config.yaml.gotmpl
index 56751c2e..de048a5d 100644
--- a/cicd/crossplane-config.yaml.gotmpl
+++ b/cicd/crossplane-config.yaml.gotmpl
@@ -13,27 +13,32 @@ environments:
             # >=v0.6.5,<v0.7.0. Installing v0.7.0 makes those Configurations'
             # package revisions Unhealthy ("incompatible dependencies"). Bump only
             # once the Configuration packages widen the constraint.
-            tag: v0.6.5
+            #
+            # v0.6.7 (2026-08-21): die 0.6er-Linie bekommt weiter Backports —
+            # v0.6.6 und v0.6.7 sind NACH v0.7.0 erschienen und enthalten nur
+            # CVE-Fixes (Go 1.25.12, x/net, x/text, grpc). Unter der Decke zu
+            # bleiben kostet hier also keine Sicherheitsfixes.
+            tag: v0.6.7
           functionGo:
             name: function-go-templating
             apiVersion: pkg.crossplane.io/v1beta1
             image: xpkg.crossplane.io/crossplane-contrib/function-go-templating
-            tag: v0.12.2
+            tag: v0.12.3
           kcl:
             name: function-kcl
             apiVersion: pkg.crossplane.io/v1
             image: xpkg.upbound.io/crossplane-contrib/function-kcl
-            tag: v0.12.1
+            tag: v0.12.2
           patchAndTransform:
             name: function-patch-and-transform
             apiVersion: pkg.crossplane.io/v1beta1
             image: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform
-            tag: v0.10.7
+            tag: v0.10.9
           environmentConfigs:
             name: function-environment-configs
             apiVersion: pkg.crossplane.io/v1
             image: xpkg.crossplane.io/crossplane-contrib/function-environment-configs
-            tag: v0.7.2
+            tag: v0.7.3
       # Migrated from the decommissioned ghcr.io/stuttgart-things/crossplane/...
       # registry to ghcr.io/stuttgart-things/crossplane-configurations/...
       # (Crossplane v2, namespaced XRs). Entries are re-added one at a time as
diff --git a/cicd/crossplane-providers.yaml.gotmpl b/cicd/crossplane-providers.yaml.gotmpl
index 1bee9516..08b6ab4e 100644
--- a/cicd/crossplane-providers.yaml.gotmpl
+++ b/cicd/crossplane-providers.yaml.gotmpl
@@ -29,17 +29,24 @@ environments:
           # its own. See crossplane-configurations#147.
           providerHelm:
             name: crossplane-contrib-provider-helm
-            package: xpkg.crossplane.io/crossplane-contrib/provider-helm:v1.3.0
+            # v1.4.0 (2026-08-21): eingebettetes Helm-SDK v3 -> v4. Die
+            # Release-API bleibt gleich, das Laufzeitverhalten nicht —
+            # Server-Side-Apply ist fuer NEU installierte Releases der Default
+            # und `wait` haengt an kstatus statt an der alten Ready-Logik.
+            # Bestehende Releases behalten ihre Apply-Methode. Weil hier jede
+            # Platform-App durchlaeuft (cert-manager, openebs, cni, flux-init),
+            # gehoert dieser Bump nie in dieselbe Runde wie reine CVE-Updates.
+            package: xpkg.crossplane.io/crossplane-contrib/provider-helm:v1.4.0
             rbac:
               clusterRole: cluster-admin
           providerOpentofu:
             name: provider-opentofu
-            package: xpkg.upbound.io/upbound/provider-opentofu:v1.1.4
+            package: xpkg.upbound.io/upbound/provider-opentofu:v1.1.6
             rbac:
               clusterRole: cluster-admin
           providerKubeconfig:
             name: provider-kubeconfig
-            package: ghcr.io/stuttgart-things/provider-kubeconfig-xpkg:v0.13.1
+            package: ghcr.io/stuttgart-things/provider-kubeconfig-xpkg:v0.13.2
       # NOTE: the ClusterProviderConfig resources live in the separate
       # crossplane-provider-configs.yaml.gotmpl — they reference ProviderConfig
       # CRDs that only register once these providers are Healthy, so keeping