diff --git a/addons/observability/grafana-agent/values.yaml b/addons/observability/grafana-agent/values.yaml
index 8ab7248..d1ab2ce 100644
--- a/addons/observability/grafana-agent/values.yaml
+++ b/addons/observability/grafana-agent/values.yaml
@@ -72,13 +72,13 @@ agent:
       // expects service "aps" and the workspace's region.
       prometheus.remote_write "amp" {
         endpoint {
-          url = sys.env("AMP_REMOTE_WRITE_URL")
+          url = env("AMP_REMOTE_WRITE_URL")
           sigv4 {
-            region = sys.env("AWS_REGION")
+            region = env("AWS_REGION")
           }
         }
         external_labels = {
-          cluster = sys.env("CLUSTER_NAME"),
+          cluster = env("CLUSTER_NAME"),
         }
       }
 
diff --git a/addons/operations/velero/values.yaml b/addons/operations/velero/values.yaml
index f074719..8a40dda 100644
--- a/addons/operations/velero/values.yaml
+++ b/addons/operations/velero/values.yaml
@@ -51,11 +51,13 @@ tolerations:
   - key: CriticalAddonsOnly
     operator: Exists
 
-# Override kubectl image for helm hooks (bitnamilegacy/kubectl:1.35 doesn't exist)
+# Override kubectl image for helm hooks. Bitnami migrated public images to
+# `bitnamilegacy/`; pin to a real existing tag (latest isn't published on
+# the legacy repo).
 kubectl:
   image:
-    repository: docker.io/bitnami/kubectl
-    tag: latest
+    repository: docker.io/bitnamilegacy/kubectl
+    tag: 1.33.4-debian-12-r0
 
 # Default backup schedules
 schedules:
diff --git a/addons/security/kyverno/values.yaml b/addons/security/kyverno/values.yaml
index d4de878..d5cd352 100644
--- a/addons/security/kyverno/values.yaml
+++ b/addons/security/kyverno/values.yaml
@@ -66,15 +66,18 @@ features:
 webhooksCleanup:
   enabled: true
 
-# Override kubectl image for helm hooks (bitnami/kubectl:1.32.3 doesn't exist)
+# Override kubectl image for helm hooks. Bitnami migrated public images to
+# `bitnamilegacy/` (the `bitnami/kubectl` repo on Docker Hub is no longer
+# published). Pin to a real, existing tag — `latest` on the legacy repo
+# isn't reliably maintained either.
 cleanupJobs:
   admissionReports:
     image:
       registry: docker.io
-      repository: bitnami/kubectl
-      tag: latest
+      repository: bitnamilegacy/kubectl
+      tag: 1.33.4-debian-12-r0
   clusterAdmissionReports:
     image:
       registry: docker.io
-      repository: bitnami/kubectl
-      tag: latest
+      repository: bitnamilegacy/kubectl
+      tag: 1.33.4-debian-12-r0