diff --git a/AGENTS.md b/AGENTS.md
index 73e6688276..b045f0bccb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Cluster
 
-This is **kantai**, a Kubernetes cluster running Talos Linux, with a mix of bare-metal and virtual nodes, managed entirely through GitOps via FluxCD and Flux Operator. All services live under `kantai.xyz`. Current repo configuration targets Talos `v1.13.2` and Kubernetes `v1.36.1`. Flux syncs `refs/heads/main` from `https://github.com/jfroy/flatops` at `kubernetes/cluster`.
+This is **kantai**, a Kubernetes cluster running Talos Linux, with a mix of bare-metal and virtual nodes, managed entirely through GitOps via FluxCD and Flux Operator. All services live under `kantai.xyz`. Current repo configuration targets Talos `v1.13.2` and Kubernetes `v1.36.1`. Flux syncs `kubernetes/cluster` from the `latest` artifact at `oci://ghcr.io/jfroy/flatops/cluster`. GitHub Actions publishes and keylessly signs the artifact from `refs/heads/main`; Flux verifies its Cosign identity before reconciliation.
 
 ## Flux MCP Server
 
@@ -139,6 +139,7 @@ Renovate automatically opens PRs for container image and Helm chart updates. Min
 GitHub Actions workflows in `.github/workflows/`:
 
 - `claude-review.yaml` — runs `anthropics/claude-code-action` on every non-Renovate, non-fork PR to review the diff against these conventions and post inline review comments. Needs the `ANTHROPIC_API_KEY` repository secret
+- `cluster-release.yaml` — builds the `kubernetes/` tree into an OCI artifact on main, publishes it to GHCR, signs its digest with GitHub OIDC/Cosign, verifies the signature, promotes it to `latest`, then calls the OIDC-authenticated Flux Receiver for immediate reconciliation
 - `label-sync.yaml` — syncs `.github/labels.yaml` to the repository's labels
 
 PR manifest diffs are not a workflow: `konflate` runs in-cluster (`kubernetes/apps/flux-system/konflate/`), renders HelmReleases and Kustomizations for changed manifests, and reports back as PR comments and status checks. Its UI is at `konflate.kantai.xyz`.
diff --git a/kubernetes/apps/actions-runner-system/arc/ks.yaml b/kubernetes/apps/actions-runner-system/arc/ks.yaml
index 87dc1d18a6..e0b8becec4 100644
--- a/kubernetes/apps/actions-runner-system/arc/ks.yaml
+++ b/kubernetes/apps/actions-runner-system/arc/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/actions-runner-system/arc/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -34,7 +34,7 @@ spec:
   path: ./kubernetes/apps/actions-runner-system/arc/runners
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/cert-manager/cert-manager/ks.yaml b/kubernetes/apps/cert-manager/cert-manager/ks.yaml
index df9251adeb..dfa178ca08 100644
--- a/kubernetes/apps/cert-manager/cert-manager/ks.yaml
+++ b/kubernetes/apps/cert-manager/cert-manager/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/cert-manager/cert-manager/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -43,7 +43,7 @@ spec:
   path: ./kubernetes/apps/cert-manager/cert-manager/issuers
   prune: false  # don't delete issued certificates
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/cert-manager/trust-manager/ks.yaml b/kubernetes/apps/cert-manager/trust-manager/ks.yaml
index 18e10f4075..9c77a6c70f 100644
--- a/kubernetes/apps/cert-manager/trust-manager/ks.yaml
+++ b/kubernetes/apps/cert-manager/trust-manager/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/cert-manager/trust-manager/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -28,7 +28,7 @@ spec:
   path: ./kubernetes/apps/cert-manager/trust-manager/cluster-ca-bundle
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/cnpg-system/barman-cloud/ks.yaml b/kubernetes/apps/cnpg-system/barman-cloud/ks.yaml
index 138a185d52..b3446763a4 100644
--- a/kubernetes/apps/cnpg-system/barman-cloud/ks.yaml
+++ b/kubernetes/apps/cnpg-system/barman-cloud/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/cnpg-system/barman-cloud/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/cnpg-system/cloudnative-pg/ks.yaml b/kubernetes/apps/cnpg-system/cloudnative-pg/ks.yaml
index b8d8245e8c..95e2d4a7a8 100644
--- a/kubernetes/apps/cnpg-system/cloudnative-pg/ks.yaml
+++ b/kubernetes/apps/cnpg-system/cloudnative-pg/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/cnpg-system/cloudnative-pg/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/database/cnpg/ks.yaml b/kubernetes/apps/database/cnpg/ks.yaml
index 815eca6d15..9e4ed00542 100644
--- a/kubernetes/apps/database/cnpg/ks.yaml
+++ b/kubernetes/apps/database/cnpg/ks.yaml
@@ -25,7 +25,7 @@ spec:
   path: ./kubernetes/apps/database/cnpg/pg18vc
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/database/influxdb/ks.yaml b/kubernetes/apps/database/influxdb/ks.yaml
index 87b183da8a..c6f4b2c883 100644
--- a/kubernetes/apps/database/influxdb/ks.yaml
+++ b/kubernetes/apps/database/influxdb/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/database/influxdb/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/external-secrets/external-secrets/ks.yaml b/kubernetes/apps/external-secrets/external-secrets/ks.yaml
index e90177c705..3b66516a5f 100644
--- a/kubernetes/apps/external-secrets/external-secrets/ks.yaml
+++ b/kubernetes/apps/external-secrets/external-secrets/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/external-secrets/external-secrets/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -43,7 +43,7 @@ spec:
   path: ./kubernetes/apps/external-secrets/external-secrets/stores
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/flux-system/instance/ks.yaml b/kubernetes/apps/flux-system/instance/ks.yaml
index ebf7ef2152..9ba9379af3 100644
--- a/kubernetes/apps/flux-system/instance/ks.yaml
+++ b/kubernetes/apps/flux-system/instance/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/flux-system/instance/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/flux-system/instance/ks/helm-values.yaml b/kubernetes/apps/flux-system/instance/ks/helm-values.yaml
index 35486a7702..4586614332 100644
--- a/kubernetes/apps/flux-system/instance/ks/helm-values.yaml
+++ b/kubernetes/apps/flux-system/instance/ks/helm-values.yaml
@@ -9,13 +9,26 @@ instance:
     - helm-controller
     - notification-controller
   sync:
-    kind: GitRepository
-    url: https://github.com/jfroy/flatops
-    ref: refs/heads/main
+    kind: OCIRepository
+    url: oci://ghcr.io/jfroy/flatops/cluster
+    ref: latest
     path: kubernetes/cluster
-    interval: 1h
+    interval: 5m
   kustomize:
     patches:
+      # Only reconcile cluster state from artifacts signed by this workflow on main.
+      - patch: |-
+          - op: add
+            path: /spec/verify
+            value:
+              provider: cosign
+              matchOIDCIdentity:
+                - issuer: ^https://token[.]actions[.]githubusercontent[.]com$
+                  subject: ^https://github[.]com/jfroy/flatops/[.]github/workflows/cluster-release[.]yaml@refs/heads/main$
+        target:
+          group: source.toolkit.fluxcd.io
+          kind: OCIRepository
+          name: flux-system
       # Increase the number of reconciliations that can be performed in parallel
       # https://fluxcd.io/flux/installation/configuration/vertical-scaling/#increase-the-number-of-workers-and-limits
       - patch: |
diff --git a/kubernetes/apps/flux-system/konflate/ks.yaml b/kubernetes/apps/flux-system/konflate/ks.yaml
index 37aaf08a74..9644f9de9d 100644
--- a/kubernetes/apps/flux-system/konflate/ks.yaml
+++ b/kubernetes/apps/flux-system/konflate/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/flux-system/konflate/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/flux-system/ocharted/ks.yaml b/kubernetes/apps/flux-system/ocharted/ks.yaml
index 893504a2fd..dcf12d1b7a 100644
--- a/kubernetes/apps/flux-system/ocharted/ks.yaml
+++ b/kubernetes/apps/flux-system/ocharted/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/flux-system/ocharted/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/flux-system/operator/ks.yaml b/kubernetes/apps/flux-system/operator/ks.yaml
index 26b46de1c4..4e4129742b 100644
--- a/kubernetes/apps/flux-system/operator/ks.yaml
+++ b/kubernetes/apps/flux-system/operator/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/flux-system/operator/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/gpu-operator/gpu-operator/ks.yaml b/kubernetes/apps/gpu-operator/gpu-operator/ks.yaml
index 10aa2f7725..1a3786bc20 100644
--- a/kubernetes/apps/gpu-operator/gpu-operator/ks.yaml
+++ b/kubernetes/apps/gpu-operator/gpu-operator/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/gpu-operator/gpu-operator/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kopiur-system/kopiur/ks.yaml b/kubernetes/apps/kopiur-system/kopiur/ks.yaml
index 97da00e995..4baa93bdc5 100644
--- a/kubernetes/apps/kopiur-system/kopiur/ks.yaml
+++ b/kubernetes/apps/kopiur-system/kopiur/ks.yaml
@@ -18,7 +18,7 @@ spec:
   path: ./kubernetes/apps/kopiur-system/kopiur/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -36,7 +36,7 @@ spec:
   path: ./kubernetes/apps/kopiur-system/kopiur/repository
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/cilium/ks.yaml b/kubernetes/apps/kube-system/cilium/ks.yaml
index 11f17b2ce4..6d2ada9b11 100644
--- a/kubernetes/apps/kube-system/cilium/ks.yaml
+++ b/kubernetes/apps/kube-system/cilium/ks.yaml
@@ -14,7 +14,7 @@ spec:
   path: ./kubernetes/apps/kube-system/cilium/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -31,7 +31,7 @@ spec:
   path: ./kubernetes/apps/kube-system/cilium/config
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/coredns/ks.yaml b/kubernetes/apps/kube-system/coredns/ks.yaml
index d6bc622bce..9f70a2b2e0 100644
--- a/kubernetes/apps/kube-system/coredns/ks.yaml
+++ b/kubernetes/apps/kube-system/coredns/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/coredns/app
   prune: false  # don't GC coredns to avoid unwanted DR
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/cpufreq/ks.yaml b/kubernetes/apps/kube-system/cpufreq/ks.yaml
index d6d0015cf9..c1f0e7e59a 100644
--- a/kubernetes/apps/kube-system/cpufreq/ks.yaml
+++ b/kubernetes/apps/kube-system/cpufreq/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/cpufreq/kantai1
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/csi-driver-smb/ks.yaml b/kubernetes/apps/kube-system/csi-driver-smb/ks.yaml
index ccef41a2bc..69dbf3252d 100644
--- a/kubernetes/apps/kube-system/csi-driver-smb/ks.yaml
+++ b/kubernetes/apps/kube-system/csi-driver-smb/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/csi-driver-smb/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/descheduler/ks.yaml b/kubernetes/apps/kube-system/descheduler/ks.yaml
index c63bbdd419..2c1358f208 100644
--- a/kubernetes/apps/kube-system/descheduler/ks.yaml
+++ b/kubernetes/apps/kube-system/descheduler/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/descheduler/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/gateway-crd/ks.yaml b/kubernetes/apps/kube-system/gateway-crd/ks.yaml
index 4584d8f47e..aa2860cf01 100644
--- a/kubernetes/apps/kube-system/gateway-crd/ks.yaml
+++ b/kubernetes/apps/kube-system/gateway-crd/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/gateway-crd/experimental
   prune: false  # don't GC CRDs
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/generic-device-plugin/ks.yaml b/kubernetes/apps/kube-system/generic-device-plugin/ks.yaml
index f542aafdfc..8b65f1ad34 100644
--- a/kubernetes/apps/kube-system/generic-device-plugin/ks.yaml
+++ b/kubernetes/apps/kube-system/generic-device-plugin/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/generic-device-plugin/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/k8s-digester/ks.yaml b/kubernetes/apps/kube-system/k8s-digester/ks.yaml
index 85f8183d1f..d70f35e8bb 100644
--- a/kubernetes/apps/kube-system/k8s-digester/ks.yaml
+++ b/kubernetes/apps/kube-system/k8s-digester/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/k8s-digester/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml b/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
index cc3830bfa1..cc44ef8fb4 100644
--- a/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
+++ b/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/kubelet-csr-approver/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/metrics-server/ks.yaml b/kubernetes/apps/kube-system/metrics-server/ks.yaml
index edcb87f285..b3172f42e0 100644
--- a/kubernetes/apps/kube-system/metrics-server/ks.yaml
+++ b/kubernetes/apps/kube-system/metrics-server/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/metrics-server/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/multus/ks.yaml b/kubernetes/apps/kube-system/multus/ks.yaml
index 3c1bef29dc..36cb231697 100644
--- a/kubernetes/apps/kube-system/multus/ks.yaml
+++ b/kubernetes/apps/kube-system/multus/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/kube-system/multus/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -34,7 +34,7 @@ spec:
   path: ./kubernetes/apps/kube-system/multus/networks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml b/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml
index 5c7c164c3f..18d4672571 100644
--- a/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml
+++ b/kubernetes/apps/kube-system/node-feature-discovery/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/node-feature-discovery/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -26,7 +26,7 @@ spec:
   path: ./kubernetes/apps/kube-system/node-feature-discovery/custom
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/reloader/ks.yaml b/kubernetes/apps/kube-system/reloader/ks.yaml
index 8907b3e6c0..fc8feee735 100644
--- a/kubernetes/apps/kube-system/reloader/ks.yaml
+++ b/kubernetes/apps/kube-system/reloader/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/reloader/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/runtimes/ks.yaml b/kubernetes/apps/kube-system/runtimes/ks.yaml
index 4ac9d7faee..306b12dfaf 100644
--- a/kubernetes/apps/kube-system/runtimes/ks.yaml
+++ b/kubernetes/apps/kube-system/runtimes/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/runtimes/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/snapshot-controller/ks.yaml b/kubernetes/apps/kube-system/snapshot-controller/ks.yaml
index 37f019db84..9b8bbb6a4f 100644
--- a/kubernetes/apps/kube-system/snapshot-controller/ks.yaml
+++ b/kubernetes/apps/kube-system/snapshot-controller/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/kube-system/snapshot-controller/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/spegel/ks.yaml b/kubernetes/apps/kube-system/spegel/ks.yaml
index 542522ac32..728b58e9ec 100644
--- a/kubernetes/apps/kube-system/spegel/ks.yaml
+++ b/kubernetes/apps/kube-system/spegel/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/spegel/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/kube-system/zfs-static-csi/ks.yaml b/kubernetes/apps/kube-system/zfs-static-csi/ks.yaml
index b2af2aefb4..306098ab9c 100644
--- a/kubernetes/apps/kube-system/zfs-static-csi/ks.yaml
+++ b/kubernetes/apps/kube-system/zfs-static-csi/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/kube-system/zfs-static-csi/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/mcp/flux-operator-mcp/ks.yaml b/kubernetes/apps/mcp/flux-operator-mcp/ks.yaml
index a17de90fc3..3196d8eb04 100644
--- a/kubernetes/apps/mcp/flux-operator-mcp/ks.yaml
+++ b/kubernetes/apps/mcp/flux-operator-mcp/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/mcp/flux-operator-mcp/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/mcp/ha-mcp/ks.yaml b/kubernetes/apps/mcp/ha-mcp/ks.yaml
index 081236a784..146d26270d 100644
--- a/kubernetes/apps/mcp/ha-mcp/ks.yaml
+++ b/kubernetes/apps/mcp/ha-mcp/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/mcp/ha-mcp/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/cloudflared/ks.yaml b/kubernetes/apps/network/cloudflared/ks.yaml
index d172099057..2fca398f02 100644
--- a/kubernetes/apps/network/cloudflared/ks.yaml
+++ b/kubernetes/apps/network/cloudflared/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/network/cloudflared/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/echo/ks.yaml b/kubernetes/apps/network/echo/ks.yaml
index d095fb47c9..8a6faece92 100644
--- a/kubernetes/apps/network/echo/ks.yaml
+++ b/kubernetes/apps/network/echo/ks.yaml
@@ -11,7 +11,7 @@ spec:
       APP: *app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/envoy-gateway/ks.yaml b/kubernetes/apps/network/envoy-gateway/ks.yaml
index fd804f4a45..0e42774fdc 100644
--- a/kubernetes/apps/network/envoy-gateway/ks.yaml
+++ b/kubernetes/apps/network/envoy-gateway/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/network/envoy-gateway/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/external-dns/ks.yaml b/kubernetes/apps/network/external-dns/ks.yaml
index f83492e000..b5cb38e5b6 100644
--- a/kubernetes/apps/network/external-dns/ks.yaml
+++ b/kubernetes/apps/network/external-dns/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/common
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -24,7 +24,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/cf-httproute
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -40,7 +40,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/cf-httproute-proxied
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -56,7 +56,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/cf-crd
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -72,7 +72,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/cf-crd-proxied
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -88,7 +88,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/unifi
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -104,7 +104,7 @@ spec:
   path: ./kubernetes/apps/network/external-dns/unifi-crd
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/gateway-certificates/ks.yaml b/kubernetes/apps/network/gateway-certificates/ks.yaml
index 5830eb83dc..84dfe3c214 100644
--- a/kubernetes/apps/network/gateway-certificates/ks.yaml
+++ b/kubernetes/apps/network/gateway-certificates/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/network/gateway-certificates/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/network/k8s-gateway/ks.yaml b/kubernetes/apps/network/k8s-gateway/ks.yaml
index 51c13fd67c..a7421af160 100644
--- a/kubernetes/apps/network/k8s-gateway/ks.yaml
+++ b/kubernetes/apps/network/k8s-gateway/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/network/k8s-gateway/tailscale-dns
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability-agents/node-exporter/ks.yaml b/kubernetes/apps/observability-agents/node-exporter/ks.yaml
index 6ea8303206..871982773e 100644
--- a/kubernetes/apps/observability-agents/node-exporter/ks.yaml
+++ b/kubernetes/apps/observability-agents/node-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/node-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability-agents/scrutiny-collector/ks.yaml b/kubernetes/apps/observability-agents/scrutiny-collector/ks.yaml
index b0a9438c9b..afba689b91 100644
--- a/kubernetes/apps/observability-agents/scrutiny-collector/ks.yaml
+++ b/kubernetes/apps/observability-agents/scrutiny-collector/ks.yaml
@@ -11,7 +11,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/scrutiny-collector/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -30,7 +30,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/scrutiny-collector/zfs
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability-agents/smartctl-exporter/ks.yaml b/kubernetes/apps/observability-agents/smartctl-exporter/ks.yaml
index d4c44ff5b1..1801e8bed0 100644
--- a/kubernetes/apps/observability-agents/smartctl-exporter/ks.yaml
+++ b/kubernetes/apps/observability-agents/smartctl-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/smartctl-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability-agents/telegraf/ks.yaml b/kubernetes/apps/observability-agents/telegraf/ks.yaml
index 69aca50da6..bf0c416c2c 100644
--- a/kubernetes/apps/observability-agents/telegraf/ks.yaml
+++ b/kubernetes/apps/observability-agents/telegraf/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/telegraf/powerwall
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -24,7 +24,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/telegraf/zfs
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability-agents/vlagent/ks.yaml b/kubernetes/apps/observability-agents/vlagent/ks.yaml
index 5c697337b7..6f0a0e4744 100644
--- a/kubernetes/apps/observability-agents/vlagent/ks.yaml
+++ b/kubernetes/apps/observability-agents/vlagent/ks.yaml
@@ -12,7 +12,7 @@ spec:
   path: ./kubernetes/apps/observability-agents/vlagent/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/beszel/ks.yaml b/kubernetes/apps/observability/beszel/ks.yaml
index 9e523dd1d5..18a64979cb 100644
--- a/kubernetes/apps/observability/beszel/ks.yaml
+++ b/kubernetes/apps/observability/beszel/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/observability/beszel/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/blackbox-exporter/ks.yaml b/kubernetes/apps/observability/blackbox-exporter/ks.yaml
index 1632dc6fcb..e5bc97afe7 100644
--- a/kubernetes/apps/observability/blackbox-exporter/ks.yaml
+++ b/kubernetes/apps/observability/blackbox-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability/blackbox-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/dozzle/ks.yaml b/kubernetes/apps/observability/dozzle/ks.yaml
index 2e725a0ee6..32d59f7b54 100644
--- a/kubernetes/apps/observability/dozzle/ks.yaml
+++ b/kubernetes/apps/observability/dozzle/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/observability/dozzle/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/exportarr/ks.yaml b/kubernetes/apps/observability/exportarr/ks.yaml
index 43842e18e3..0e4921aab1 100644
--- a/kubernetes/apps/observability/exportarr/ks.yaml
+++ b/kubernetes/apps/observability/exportarr/ks.yaml
@@ -7,7 +7,7 @@ spec:
   path: ./kubernetes/apps/observability/exportarr/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/gatus-sidecar/ks.yaml b/kubernetes/apps/observability/gatus-sidecar/ks.yaml
index 59cd810894..7d68a6b070 100644
--- a/kubernetes/apps/observability/gatus-sidecar/ks.yaml
+++ b/kubernetes/apps/observability/gatus-sidecar/ks.yaml
@@ -7,7 +7,7 @@ spec:
   path: ./kubernetes/apps/observability/gatus-sidecar/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/grafana/ks.yaml b/kubernetes/apps/observability/grafana/ks.yaml
index 30b48db4ee..9341feca13 100644
--- a/kubernetes/apps/observability/grafana/ks.yaml
+++ b/kubernetes/apps/observability/grafana/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability/grafana/dashboards
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -28,7 +28,7 @@ spec:
   path: ./kubernetes/apps/observability/grafana/instance
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -48,7 +48,7 @@ spec:
   path: ./kubernetes/apps/observability/grafana/operator
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   wait: true
diff --git a/kubernetes/apps/observability/idrac-exporter/ks.yaml b/kubernetes/apps/observability/idrac-exporter/ks.yaml
index 39af5420e0..f396c11efc 100644
--- a/kubernetes/apps/observability/idrac-exporter/ks.yaml
+++ b/kubernetes/apps/observability/idrac-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability/idrac-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/kite/ks.yaml b/kubernetes/apps/observability/kite/ks.yaml
index 6c4290c154..9f85b2dc5c 100644
--- a/kubernetes/apps/observability/kite/ks.yaml
+++ b/kubernetes/apps/observability/kite/ks.yaml
@@ -7,7 +7,7 @@ spec:
   path: ./kubernetes/apps/observability/kite/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml b/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml
index 2df0541584..db3fc9ff0b 100644
--- a/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml
+++ b/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml
@@ -11,7 +11,7 @@ spec:
   path: ./kubernetes/apps/observability/kube-prometheus-stack/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/netronome/ks.yaml b/kubernetes/apps/observability/netronome/ks.yaml
index baf55888ac..71d296f9a8 100644
--- a/kubernetes/apps/observability/netronome/ks.yaml
+++ b/kubernetes/apps/observability/netronome/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/observability/netronome/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/nut-exporter/ks.yaml b/kubernetes/apps/observability/nut-exporter/ks.yaml
index 487df21ed7..5f24122dda 100644
--- a/kubernetes/apps/observability/nut-exporter/ks.yaml
+++ b/kubernetes/apps/observability/nut-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability/nut-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml b/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml
index 1a671a93a7..ed13418ff6 100644
--- a/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml
+++ b/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml
@@ -9,7 +9,7 @@ spec:
   path: ./kubernetes/apps/observability/prometheus-operator-crds/app
   prune: false  # don't GC CRDs
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/scrutiny/ks.yaml b/kubernetes/apps/observability/scrutiny/ks.yaml
index f49197a0d6..9e027f9865 100644
--- a/kubernetes/apps/observability/scrutiny/ks.yaml
+++ b/kubernetes/apps/observability/scrutiny/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/observability/scrutiny/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/silence-operator/ks.yaml b/kubernetes/apps/observability/silence-operator/ks.yaml
index 3a8fdc9f05..255a3c4f75 100644
--- a/kubernetes/apps/observability/silence-operator/ks.yaml
+++ b/kubernetes/apps/observability/silence-operator/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/observability/silence-operator/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -31,7 +31,7 @@ spec:
   path: ./kubernetes/apps/observability/silence-operator/silences
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/siren/ks.yaml b/kubernetes/apps/observability/siren/ks.yaml
index c1760ea6b2..6df7585250 100644
--- a/kubernetes/apps/observability/siren/ks.yaml
+++ b/kubernetes/apps/observability/siren/ks.yaml
@@ -7,7 +7,7 @@ spec:
   path: ./kubernetes/apps/observability/siren/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/speedtest-exporter/ks.yaml b/kubernetes/apps/observability/speedtest-exporter/ks.yaml
index 3a2ac3b022..556fbd3b87 100644
--- a/kubernetes/apps/observability/speedtest-exporter/ks.yaml
+++ b/kubernetes/apps/observability/speedtest-exporter/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: kubernetes/apps/observability/speedtest-exporter/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/trove/ks.yaml b/kubernetes/apps/observability/trove/ks.yaml
index a0dd63a497..2769f2082d 100644
--- a/kubernetes/apps/observability/trove/ks.yaml
+++ b/kubernetes/apps/observability/trove/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/observability/trove/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/unpoller/ks.yaml b/kubernetes/apps/observability/unpoller/ks.yaml
index a909f067c9..a0e051bf1f 100644
--- a/kubernetes/apps/observability/unpoller/ks.yaml
+++ b/kubernetes/apps/observability/unpoller/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/observability/unpoller/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/observability/victoria/ks.yaml b/kubernetes/apps/observability/victoria/ks.yaml
index 23c1d3d4e4..ae89064c1a 100644
--- a/kubernetes/apps/observability/victoria/ks.yaml
+++ b/kubernetes/apps/observability/victoria/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/observability/victoria/logs
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -44,7 +44,7 @@ spec:
   path: ./kubernetes/apps/observability/victoria/metrics
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -68,7 +68,7 @@ spec:
   path: ./kubernetes/apps/observability/victoria/operator
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -84,7 +84,7 @@ spec:
   path: ./kubernetes/apps/observability/victoria/operator-crds
   prune: false
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/openebs-system/etcd/ks.yaml b/kubernetes/apps/openebs-system/etcd/ks.yaml
index 2147b3e2fc..f06e8bfbab 100644
--- a/kubernetes/apps/openebs-system/etcd/ks.yaml
+++ b/kubernetes/apps/openebs-system/etcd/ks.yaml
@@ -12,7 +12,7 @@ spec:
   path: ./kubernetes/apps/openebs-system/etcd/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/openebs-system/openebs-localpv/ks.yaml b/kubernetes/apps/openebs-system/openebs-localpv/ks.yaml
index fa4a25cb23..96779776d9 100644
--- a/kubernetes/apps/openebs-system/openebs-localpv/ks.yaml
+++ b/kubernetes/apps/openebs-system/openebs-localpv/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/openebs-system/openebs-localpv/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/openebs-system/openebs/ks.yaml b/kubernetes/apps/openebs-system/openebs/ks.yaml
index 85a8d7e253..7e952d8acc 100644
--- a/kubernetes/apps/openebs-system/openebs/ks.yaml
+++ b/kubernetes/apps/openebs-system/openebs/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/openebs-system/openebs/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/plane/plane/ks.yaml b/kubernetes/apps/plane/plane/ks.yaml
index 4e260b3e2f..2a6c8894b1 100644
--- a/kubernetes/apps/plane/plane/ks.yaml
+++ b/kubernetes/apps/plane/plane/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/plane/plane/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   healthChecks:
diff --git a/kubernetes/apps/renovate/renovate/ks.yaml b/kubernetes/apps/renovate/renovate/ks.yaml
index 52185d2b97..fd56c8d8ed 100644
--- a/kubernetes/apps/renovate/renovate/ks.yaml
+++ b/kubernetes/apps/renovate/renovate/ks.yaml
@@ -16,7 +16,7 @@ spec:
   path: ./kubernetes/apps/renovate/renovate/operator
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -34,7 +34,7 @@ spec:
   path: ./kubernetes/apps/renovate/renovate/jobs
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/rook-ceph/cluster/ks.yaml b/kubernetes/apps/rook-ceph/cluster/ks.yaml
index 61661ecea3..efc919ff87 100644
--- a/kubernetes/apps/rook-ceph/cluster/ks.yaml
+++ b/kubernetes/apps/rook-ceph/cluster/ks.yaml
@@ -26,7 +26,7 @@ spec:
   path: ./kubernetes/apps/rook-ceph/cluster/app
   prune: false  # don't GC ceph cluster to avoid unwanted DR
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/rook-ceph/drivers/ks.yaml b/kubernetes/apps/rook-ceph/drivers/ks.yaml
index 5b1f643b44..582cb76ee8 100644
--- a/kubernetes/apps/rook-ceph/drivers/ks.yaml
+++ b/kubernetes/apps/rook-ceph/drivers/ks.yaml
@@ -15,7 +15,7 @@ spec:
   path: ./kubernetes/apps/rook-ceph/drivers/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/rook-ceph/operator/ks.yaml b/kubernetes/apps/rook-ceph/operator/ks.yaml
index c564eb9844..dbef4cf16f 100644
--- a/kubernetes/apps/rook-ceph/operator/ks.yaml
+++ b/kubernetes/apps/rook-ceph/operator/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/rook-ceph/operator/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/storage/backups/ks.yaml b/kubernetes/apps/storage/backups/ks.yaml
index 86265c05ce..fad9b07874 100644
--- a/kubernetes/apps/storage/backups/ks.yaml
+++ b/kubernetes/apps/storage/backups/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/storage/backups/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/storage/kantai1-samba/ks.yaml b/kubernetes/apps/storage/kantai1-samba/ks.yaml
index c2f1fb4303..6ddaee3306 100644
--- a/kubernetes/apps/storage/kantai1-samba/ks.yaml
+++ b/kubernetes/apps/storage/kantai1-samba/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/storage/kantai1-samba/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/storage/maintenance/ks.yaml b/kubernetes/apps/storage/maintenance/ks.yaml
index db05168aac..5761981018 100644
--- a/kubernetes/apps/storage/maintenance/ks.yaml
+++ b/kubernetes/apps/storage/maintenance/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/storage/maintenance/kantai1
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/storage/storage-pv/ks.yaml b/kubernetes/apps/storage/storage-pv/ks.yaml
index 50ac0730ad..518148de34 100644
--- a/kubernetes/apps/storage/storage-pv/ks.yaml
+++ b/kubernetes/apps/storage/storage-pv/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/storage/storage-pv/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   wait: true
diff --git a/kubernetes/apps/tailscale/netpols/ks.yaml b/kubernetes/apps/tailscale/netpols/ks.yaml
index d72ab16fd6..f5e0967342 100644
--- a/kubernetes/apps/tailscale/netpols/ks.yaml
+++ b/kubernetes/apps/tailscale/netpols/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/tailscale/netpols/ks
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/tailscale/tailscale-operator/ks.yaml b/kubernetes/apps/tailscale/tailscale-operator/ks.yaml
index 382d128526..ab738dc3dd 100644
--- a/kubernetes/apps/tailscale/tailscale-operator/ks.yaml
+++ b/kubernetes/apps/tailscale/tailscale-operator/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/tailscale/tailscale-operator/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -26,7 +26,7 @@ spec:
 #   path: ./kubernetes/apps/tailscale/tailscale-operator/connector
 #   prune: true
 #   sourceRef:
-#     kind: GitRepository
+#     kind: OCIRepository
 #     name: flux-system
 #     namespace: flux-system
 #   interval: 1h
diff --git a/kubernetes/apps/talos-admin/etcd-defrag/ks.yaml b/kubernetes/apps/talos-admin/etcd-defrag/ks.yaml
index f1e96b5ea3..938d1ec3e4 100644
--- a/kubernetes/apps/talos-admin/etcd-defrag/ks.yaml
+++ b/kubernetes/apps/talos-admin/etcd-defrag/ks.yaml
@@ -8,7 +8,7 @@ spec:
   path: ./kubernetes/apps/talos-admin/etcd-defrag/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/talos-admin/talos-backup/ks.yaml b/kubernetes/apps/talos-admin/talos-backup/ks.yaml
index bffe2475a5..7fdbdf8e22 100644
--- a/kubernetes/apps/talos-admin/talos-backup/ks.yaml
+++ b/kubernetes/apps/talos-admin/talos-backup/ks.yaml
@@ -10,7 +10,7 @@ spec:
   path: ./kubernetes/apps/talos-admin/talos-backup/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/talos-admin/tuppr/ks.yaml b/kubernetes/apps/talos-admin/tuppr/ks.yaml
index 22804e1d1f..ffb259ce1b 100644
--- a/kubernetes/apps/talos-admin/tuppr/ks.yaml
+++ b/kubernetes/apps/talos-admin/tuppr/ks.yaml
@@ -13,7 +13,7 @@ spec:
   path: ./kubernetes/apps/talos-admin/tuppr/app
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -31,7 +31,7 @@ spec:
   path: ./kubernetes/apps/talos-admin/tuppr/upgrades
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/apps/toolhive-system/toolhive/ks.yaml b/kubernetes/apps/toolhive-system/toolhive/ks.yaml
index f87ef55674..376b56ecd3 100644
--- a/kubernetes/apps/toolhive-system/toolhive/ks.yaml
+++ b/kubernetes/apps/toolhive-system/toolhive/ks.yaml
@@ -7,7 +7,7 @@ spec:
   path: ./kubernetes/apps/toolhive-system/toolhive/crds
   prune: false
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   wait: true
@@ -30,7 +30,7 @@ spec:
   path: ./kubernetes/apps/toolhive-system/toolhive/operator
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -50,7 +50,7 @@ spec:
   path: ./kubernetes/apps/toolhive-system/toolhive/registry
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/cluster/ks.yaml b/kubernetes/cluster/ks.yaml
index 58a3b66eee..baa04bfa2a 100644
--- a/kubernetes/cluster/ks.yaml
+++ b/kubernetes/cluster/ks.yaml
@@ -11,7 +11,7 @@ spec:
   path: ./kubernetes/apps
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
@@ -62,7 +62,7 @@ spec:
   path: ./kubernetes/vap
   prune: true
   sourceRef:
-    kind: GitRepository
+    kind: OCIRepository
     name: flux-system
     namespace: flux-system
   interval: 1h
diff --git a/kubernetes/cluster/ocirepository.yaml b/kubernetes/cluster/ocirepository.yaml
deleted file mode 100644
index 5a0c621cf2..0000000000
--- a/kubernetes/cluster/ocirepository.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-# yaml-language-server: $schema=https://crd.kantai.xyz/source.toolkit.fluxcd.io/ocirepository_v1.json
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-  annotations:
-    # Keep the source in place when FluxInstance takes over its management.
-    kustomize.toolkit.fluxcd.io/prune: Disabled
-spec:
-  interval: 5m
-  ref:
-    tag: latest
-  url: oci://ghcr.io/jfroy/flatops/cluster
-  verify:
-    provider: cosign
-    matchOIDCIdentity:
-      - issuer: ^https://token[.]actions[.]githubusercontent[.]com$
-        subject: ^https://github[.]com/jfroy/flatops/[.]github/workflows/cluster-release[.]yaml@refs/heads/main$
diff --git a/kubernetes/components/common/alerts/alertmanager/alert.yaml b/kubernetes/components/common/alerts/alertmanager/alert.yaml
index 1c1afbfce9..b386edb691 100644
--- a/kubernetes/components/common/alerts/alertmanager/alert.yaml
+++ b/kubernetes/components/common/alerts/alertmanager/alert.yaml
@@ -11,8 +11,6 @@ spec:
   eventSources:
     - kind: FluxInstance
       name: "*"
-    - kind: GitRepository
-      name: "*"
     - kind: HelmRelease
       name: "*"
     - kind: HelmRepository