diff --git a/bootstrap/helmfile.d/00-crds.yaml b/bootstrap/helmfile.d/00-crds.yaml
index 861faed566..0a2e864513 100644
--- a/bootstrap/helmfile.d/00-crds.yaml
+++ b/bootstrap/helmfile.d/00-crds.yaml
@@ -22,7 +22,7 @@ releases:
   - name: external-secrets
     namespace: external-secrets
     chart: oci://ghcr.io/external-secrets/charts/external-secrets
-    version: 1.3.1
+    version: 2.1.0
 
   - name: envoy-gateway
     namespace: network
diff --git a/kubernetes/apps/security/external-secrets/app/ocirepository.yaml b/kubernetes/apps/security/external-secrets/app/ocirepository.yaml
index e5b6fa7d2b..4193561b3c 100644
--- a/kubernetes/apps/security/external-secrets/app/ocirepository.yaml
+++ b/kubernetes/apps/security/external-secrets/app/ocirepository.yaml
@@ -10,7 +10,7 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 1.3.1
+    tag: 2.1.0
   url: oci://ghcr.io/external-secrets/charts/external-secrets
   verify:
     provider: cosign