diff --git a/cicd/crossplane-config.yaml.gotmpl b/cicd/crossplane-config.yaml.gotmpl
index 15e6e227..21690182 100644
--- a/cicd/crossplane-config.yaml.gotmpl
+++ b/cicd/crossplane-config.yaml.gotmpl
@@ -3,6 +3,25 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # derivedNames: false (default) keeps every CR name as it has always
+      # been. true switches each entry that carries a `derivedName` to it --
+      # the name Crossplane itself derives from the package path, and the one
+      # the flux machinery profile and the xplane-crossplane-catalog use
+      # (stuttgart-things/flux#506). Set it with
+      #   helmfile apply ... --state-values-set derivedNames=true
+      #
+      # FRESH CLUSTERS ONLY. A rename on a live cluster is not a rename: the
+      # release creates the new CR and helm deletes the old one, and deleting
+      # a Configuration takes its XRDs -- and every XR on them -- with it. Leaving the old CR in place instead
+      # gives two CRs for one source, a duplicate Lock node, and every package
+      # on the cluster goes Healthy=False. The kind_machinery play checks for
+      # CRs under the old names before it sets this, and stops.
+      #
+      # Opt-in rather than the default because not every consumer pins this
+      # repo: plays/kind-machinery-test.yaml (ansible), the
+      # platform-engineering-showcase Taskfile/bundle and dev3-kind apply
+      # these helmfiles from main, with no preflight in front of them.
+      - derivedNames: false
       - functions:
           autoReady:
             name: function-auto-ready
@@ -57,7 +76,12 @@ environments:
             name: crossplane-contrib-function-patch-and-transform
             apiVersion: pkg.crossplane.io/v1
             image: xpkg.crossplane.io/crossplane-contrib/function-patch-and-transform
-            tag: v0.10.8
+            # v0.10.9, the version of the short-named entry above: two versions
+            # of one function add nothing. Every dependsOn allows it
+            # (>=v0.10.6,<v0.11.0) and the digest is identical on both mirrors
+            # -- the pattern function-kcl already runs healthy on kind5.
+            # Level with xplane-crossplane-catalog 0.7.0.
+            tag: v0.10.9
       # Migrated from the decommissioned ghcr.io/stuttgart-things/crossplane/...
       # registry to ghcr.io/stuttgart-things/crossplane-configurations/...
       # (Crossplane v2, namespaced XRs). Entries are re-added one at a time as
@@ -65,10 +89,12 @@ environments:
       - configurations:
           namespace:
             name: namespace
+            derivedName: stuttgart-things-crossplane-configurations-namespace
             image: ghcr.io/stuttgart-things/crossplane-configurations/namespace
             tag: v0.1.2
           volumeClaim:
             name: volume-claim
+            derivedName: stuttgart-things-crossplane-configurations-volume-claim
             image: ghcr.io/stuttgart-things/crossplane-configurations/volume-claim
             tag: v0.1.0
 ---
diff --git a/cicd/crossplane-providers.yaml.gotmpl b/cicd/crossplane-providers.yaml.gotmpl
index 93056210..4456c36a 100644
--- a/cicd/crossplane-providers.yaml.gotmpl
+++ b/cicd/crossplane-providers.yaml.gotmpl
@@ -3,6 +3,26 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # derivedNames: false (default) keeps every CR name as it has always
+      # been. true switches each entry that carries a `derivedName` to it --
+      # the name Crossplane itself derives from the package path, and the one
+      # the flux machinery profile and the xplane-crossplane-catalog use
+      # (stuttgart-things/flux#506). Set it with
+      #   helmfile apply ... --state-values-set derivedNames=true
+      #
+      # FRESH CLUSTERS ONLY. A rename on a live cluster is not a rename: the
+      # release creates the new CR and helm deletes the old one, and deleting
+      # a Provider or Configuration takes its CRDs/XRDs -- and every managed
+      # resource or XR on them -- with it. Leaving the old CR in place instead
+      # gives two CRs for one source, a duplicate Lock node, and every package
+      # on the cluster goes Healthy=False. The kind_machinery play checks for
+      # CRs under the old names before it sets this, and stops.
+      #
+      # Opt-in rather than the default because not every consumer pins this
+      # repo: plays/kind-machinery-test.yaml (ansible), the
+      # platform-engineering-showcase Taskfile/bundle and dev3-kind apply
+      # these helmfiles from main, with no preflight in front of them.
+      - derivedNames: false
       # Provider CRs (installed here rather than via the upstream crossplane
       # chart's provider.packages so they can carry a runtimeConfigRef).
       #   rbac: optional. When set, additionally emits a DeploymentRuntimeConfig
@@ -41,6 +61,7 @@ environments:
               clusterRole: cluster-admin
           providerOpentofu:
             name: provider-opentofu
+            derivedName: upbound-provider-opentofu
             package: xpkg.upbound.io/upbound/provider-opentofu:v1.1.6
             rbac:
               clusterRole: cluster-admin
@@ -67,6 +88,7 @@ environments:
                 memory: 2Gi
           providerKubeconfig:
             name: provider-kubeconfig
+            derivedName: stuttgart-things-provider-kubeconfig-xpkg
             package: ghcr.io/stuttgart-things/provider-kubeconfig-xpkg:v0.13.2
           # provider-kubernetes and provider-proxmox-bpg come in only through
           # Configurations' dependsOn. Not pinned, a fresh cluster got whatever
diff --git a/cicd/values/crossplane-configurations.values.yaml.gotmpl b/cicd/values/crossplane-configurations.values.yaml.gotmpl
index d7cf4008..a2b85cc3 100644
--- a/cicd/values/crossplane-configurations.values.yaml.gotmpl
+++ b/cicd/values/crossplane-configurations.values.yaml.gotmpl
@@ -1,10 +1,14 @@
 customresources:
 {{- range $key, $fn := .Values.configurations }}
+  {{- $crName := $fn.name | required (printf "configurations.%s.name is required" $key) }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $fn "derivedName") }}
+  {{- $crName = $fn.derivedName }}
+  {{- end }}
   {{ $key }}:
     apiVersion: pkg.crossplane.io/v1
     kind: Configuration
     metadata:
-      name: {{ $fn.name | required (printf "functions.%s.name is required" $key) }}
+      name: {{ $crName }}
     spec:
       package: {{ printf "%s:%s" $fn.image $fn.tag | required (printf "functions.%s.image and tag are required" $key) }}
 {{- end }}
diff --git a/cicd/values/crossplane-providers.values.yaml.gotmpl b/cicd/values/crossplane-providers.values.yaml.gotmpl
index 557c5493..4f539fd0 100644
--- a/cicd/values/crossplane-providers.values.yaml.gotmpl
+++ b/cicd/values/crossplane-providers.values.yaml.gotmpl
@@ -1,30 +1,35 @@
 ---
 customresources:
 {{- range $key, $p := .Values.providers }}
+  {{- /* One name for the CR, its DeploymentRuntimeConfig, SA and binding -- they move together or not at all. */}}
+  {{- $crName := $p.name | required (printf "providers.%s.name is required" $key) }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $p "derivedName") }}
+  {{- $crName = $p.derivedName }}
+  {{- end }}
   {{ $key }}:
     apiVersion: {{ dig "apiVersion" "pkg.crossplane.io/v1" $p }}
     kind: Provider
     metadata:
-      name: {{ $p.name | required (printf "providers.%s.name is required" $key) }}
+      name: {{ $crName }}
     spec:
       package: {{ $p.package | required (printf "providers.%s.package is required" $key) }}
       {{- if or (hasKey $p "rbac") (hasKey $p "env") (hasKey $p "resources") }}
       runtimeConfigRef:
         apiVersion: pkg.crossplane.io/v1beta1
         kind: DeploymentRuntimeConfig
-        name: {{ $p.name }}
+        name: {{ $crName }}
       {{- end }}
   {{- if or (hasKey $p "rbac") (hasKey $p "env") (hasKey $p "resources") }}
   {{ $key }}Runtimeconfig:
     apiVersion: pkg.crossplane.io/v1beta1
     kind: DeploymentRuntimeConfig
     metadata:
-      name: {{ $p.name }}
+      name: {{ $crName }}
     spec:
       {{- if hasKey $p "rbac" }}
       serviceAccountTemplate:
         metadata:
-          name: {{ $p.name }}
+          name: {{ $crName }}
       {{- end }}
       {{- if or (hasKey $p "env") (hasKey $p "resources") }}
       # env, not args: every provider flag also has an environment variable,
@@ -54,15 +59,19 @@ customresources:
 
 clusterRoleBindings:
 {{- range $key, $p := .Values.providers }}
+  {{- $crName := $p.name }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $p "derivedName") }}
+  {{- $crName = $p.derivedName }}
+  {{- end }}
   {{- if hasKey $p "rbac" }}
-  crossplane-{{ $p.name }}:
+  crossplane-{{ $crName }}:
     roleRef:
       kind: ClusterRole
       name: {{ $p.rbac.clusterRole }}
       apiGroup: rbac.authorization.k8s.io
     subjects:
       - kind: ServiceAccount
-        name: {{ $p.name }}
+        name: {{ $crName }}
         namespace: {{ $.Values.namespace }}
   {{- end }}
 {{- end }}