diff --git a/cicd/crossplane-config.yaml.gotmpl b/cicd/crossplane-config.yaml.gotmpl
index 21690182c..bd6ec0641 100644
--- a/cicd/crossplane-config.yaml.gotmpl
+++ b/cicd/crossplane-config.yaml.gotmpl
@@ -37,12 +37,12 @@ environments:
             # v0.6.6 und v0.6.7 sind NACH v0.7.0 erschienen und enthalten nur
             # CVE-Fixes (Go 1.25.12, x/net, x/text, grpc). Unter der Decke zu
             # bleiben kostet hier also keine Sicherheitsfixes.
-            tag: v0.6.7
+            tag: v0.6.8
           functionGo:
             name: function-go-templating
             apiVersion: pkg.crossplane.io/v1beta1
             image: xpkg.crossplane.io/crossplane-contrib/function-go-templating
-            tag: v0.12.3
+            tag: v0.12.4
           kcl:
             name: function-kcl
             apiVersion: pkg.crossplane.io/v1
@@ -57,7 +57,7 @@ environments:
             name: function-environment-configs
             apiVersion: pkg.crossplane.io/v1
             image: xpkg.crossplane.io/crossplane-contrib/function-environment-configs
-            tag: v0.7.3
+            tag: v0.7.4
           # The dependsOn-derived twins of function-kcl and
           # function-patch-and-transform. The short names above stay on
           # xpkg.upbound.io (Compositions call functions by those names, and
diff --git a/renovate.json b/renovate.json
index de7c965b9..b3002c9fc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -18,6 +18,18 @@
       "/(^|/)values\\.ya?ml$/"
     ]
   },
+  "packageRules": [
+    {
+      "description": "The crossplane chart in cicd/crossplane.yaml.gotmpl is not bumped here. Its one pin source is the KCL catalog (stuttgart-things/kcl, crossplane/xplane-crossplane-catalog, crossplaneVersion), which also generates the Flux machinery profile; a Renovate bump in this repo alone puts kind clusters on a different Crossplane than Flux-built ones. Bump it by hand to what the catalog pins, as the providers, functions and configurations in cicd/crossplane-*.yaml.gotmpl already are (they carry no renovate annotation on purpose). Remove this rule once the kind play installs the Flux profile instead (stuttgart-things/stuttgart-things#3136). stuttgart-things/flux#521",
+      "matchFileNames": [
+        "cicd/crossplane.yaml.gotmpl"
+      ],
+      "matchPackageNames": [
+        "crossplane"
+      ],
+      "enabled": false
+    }
+  ],
   "customManagers": [
     {
       "description": "Chart versions parameterized through helmfile environment values (invisible to the helmfile manager)",