diff --git a/.github/workflows/Makefile b/.github/workflows/Makefile
index 8e91eaf1..661220e8 100644
--- a/.github/workflows/Makefile
+++ b/.github/workflows/Makefile
@@ -1,5 +1,5 @@
 HELM_VERSION ?= v3.7.2
-KUSTOMIZE_VERSION ?= v4.5.7
+KUSTOMIZE_VERSION ?= v5.2.1
 K8S_VERSION ?= v1.25.16
 MINIKUBE_VERSION ?= v0.30.0
 SOPS_VERSION ?= v3.8.1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 010bda08..92e68152 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -55,13 +55,13 @@ jobs:
           # That's why we cover only 2 Helm minor versions in this matrix.
           # See https://github.com/helmfile/helmfile/pull/286#issuecomment-1250161182 for more context.
           - helm-version: v3.12.3
-            kustomize-version: v4.4.1
+            kustomize-version: v4.5.7
             plugin-secrets-version: 3.15.0
             plugin-diff-version: 3.7.0
             extra-helmfile-flags: ''
             v1mode: ''
           - helm-version: v3.12.3
-            kustomize-version: v4.5.7
+            kustomize-version: v5.2.1
             # We assume that the helm-secrets plugin is supposed to
             # work with the two most recent helm minor versions.
             # Once it turned out to be not practically true,
@@ -72,20 +72,20 @@ jobs:
             extra-helmfile-flags: ''
             v1mode: ''
           - helm-version: v3.13.2
-            kustomize-version: v4.4.1
+            kustomize-version: v4.5.7
             plugin-secrets-version: 3.15.0
             plugin-diff-version: 3.7.0
             extra-helmfile-flags: ''
             v1mode: ''
           - helm-version: v3.13.2
-            kustomize-version: v4.5.7
+            kustomize-version: v5.2.1
             plugin-secrets-version: 4.5.1
             plugin-diff-version: 3.8.1
             extra-helmfile-flags: ''
             v1mode: ''
           # Helmfile v1
           - helm-version: v3.13.2
-            kustomize-version: v4.5.7
+            kustomize-version: v5.2.1
             plugin-secrets-version: 4.5.1
             plugin-diff-version: 3.8.1
             extra-helmfile-flags: ''
@@ -93,7 +93,7 @@ jobs:
           # In case you need to test some optional helmfile features,
           # enable it via extra-helmfile-flags below.
           - helm-version: v3.13.2
-            kustomize-version: v4.5.7
+            kustomize-version: v5.2.1
             plugin-secrets-version: 4.5.1
             plugin-diff-version: 3.8.1
             extra-helmfile-flags: '--enable-live-output'
diff --git a/Dockerfile b/Dockerfile
index ae1968b7..18722585 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,18 +63,19 @@ RUN set -x && \
     mv kubectl /usr/local/bin/kubectl && \
     [ "$(kubectl version -o json | jq -r '.clientVersion.gitVersion')" = "${KUBECTL_VERSION}" ]
 
-ENV KUSTOMIZE_VERSION="v4.5.7"
+ENV KUSTOMIZE_VERSION="v5.2.1"
 ARG KUSTOMIZE_FILENAME="kustomize_${KUSTOMIZE_VERSION}_${TARGETOS}_${TARGETARCH}.tar.gz"
 RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/${KUSTOMIZE_FILENAME}" && \
     case ${TARGETPLATFORM} in \
-         "linux/amd64")  KUSTOMIZE_SHA256="701e3c4bfa14e4c520d481fdf7131f902531bfc002cb5062dcf31263a09c70c9"  ;; \
-         "linux/arm64")  KUSTOMIZE_SHA256="65665b39297cc73c13918f05bbe8450d17556f0acd16242a339271e14861df67"  ;; \
+        # checksim are available at https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/checksums.txt
+        "linux/amd64")  KUSTOMIZE_SHA256="88346543206b889f9287c0b92c70708040ecd5aad54dd33019c4d6579cd24de8"  ;; \
+        "linux/arm64")  KUSTOMIZE_SHA256="5566f7badece5a72d42075d8dffa6296a228966dd6ac2390de7afbb9675c3aaa"  ;; \
     esac && \
     echo "${KUSTOMIZE_SHA256}  ${KUSTOMIZE_FILENAME}" | sha256sum -c && \
     tar xvf "${KUSTOMIZE_FILENAME}" -C /usr/local/bin && \
     rm "${KUSTOMIZE_FILENAME}" && \
-    kustomize version --short | grep "kustomize/${KUSTOMIZE_VERSION}"
+    [ "$(kustomize version)" = "${KUSTOMIZE_VERSION}" ]
 
 ENV SOPS_VERSION="v3.8.1"
 ARG SOPS_FILENAME="sops-${SOPS_VERSION}.${TARGETOS}.${TARGETARCH}"
diff --git a/Dockerfile.debian-stable-slim b/Dockerfile.debian-stable-slim
index cc15ddfe..490a1a8d 100644
--- a/Dockerfile.debian-stable-slim
+++ b/Dockerfile.debian-stable-slim
@@ -68,18 +68,19 @@ RUN set -x && \
     mv kubectl /usr/local/bin/kubectl && \
     [ "$(kubectl version -o json | jq -r '.clientVersion.gitVersion')" = "${KUBECTL_VERSION}" ]
 
-ENV KUSTOMIZE_VERSION="v4.5.7"
+ENV KUSTOMIZE_VERSION="v5.2.1"
 ARG KUSTOMIZE_FILENAME="kustomize_${KUSTOMIZE_VERSION}_${TARGETOS}_${TARGETARCH}.tar.gz"
 RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/${KUSTOMIZE_FILENAME}" && \
     case ${TARGETPLATFORM} in \
-         "linux/amd64")  KUSTOMIZE_SHA256="701e3c4bfa14e4c520d481fdf7131f902531bfc002cb5062dcf31263a09c70c9"  ;; \
-         "linux/arm64")  KUSTOMIZE_SHA256="65665b39297cc73c13918f05bbe8450d17556f0acd16242a339271e14861df67"  ;; \
+        # checksim are available at https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/checksums.txt
+        "linux/amd64")  KUSTOMIZE_SHA256="88346543206b889f9287c0b92c70708040ecd5aad54dd33019c4d6579cd24de8"  ;; \
+        "linux/arm64")  KUSTOMIZE_SHA256="5566f7badece5a72d42075d8dffa6296a228966dd6ac2390de7afbb9675c3aaa"  ;; \
     esac && \
     echo "${KUSTOMIZE_SHA256}  ${KUSTOMIZE_FILENAME}" | sha256sum -c && \
     tar xvf "${KUSTOMIZE_FILENAME}" -C /usr/local/bin && \
     rm "${KUSTOMIZE_FILENAME}" && \
-    kustomize version --short | grep "kustomize/${KUSTOMIZE_VERSION}"
+    [ "$(kustomize version)" = "${KUSTOMIZE_VERSION}" ]
 
 ENV SOPS_VERSION="v3.8.1"
 ARG SOPS_FILENAME="sops-${SOPS_VERSION}.${TARGETOS}.${TARGETARCH}"
diff --git a/Dockerfile.ubuntu b/Dockerfile.ubuntu
index b3c3218d..cb34b27d 100644
--- a/Dockerfile.ubuntu
+++ b/Dockerfile.ubuntu
@@ -68,18 +68,19 @@ RUN set -x && \
     mv kubectl /usr/local/bin/kubectl && \
     [ "$(kubectl version -o json | jq -r '.clientVersion.gitVersion')" = "${KUBECTL_VERSION}" ]
 
-ENV KUSTOMIZE_VERSION="v4.5.7"
+ENV KUSTOMIZE_VERSION="v5.2.1"
 ARG KUSTOMIZE_FILENAME="kustomize_${KUSTOMIZE_VERSION}_${TARGETOS}_${TARGETARCH}.tar.gz"
 RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/${KUSTOMIZE_FILENAME}" && \
     case ${TARGETPLATFORM} in \
-         "linux/amd64")  KUSTOMIZE_SHA256="701e3c4bfa14e4c520d481fdf7131f902531bfc002cb5062dcf31263a09c70c9"  ;; \
-         "linux/arm64")  KUSTOMIZE_SHA256="65665b39297cc73c13918f05bbe8450d17556f0acd16242a339271e14861df67"  ;; \
+        # checksim are available at https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/checksums.txt
+        "linux/amd64")  KUSTOMIZE_SHA256="88346543206b889f9287c0b92c70708040ecd5aad54dd33019c4d6579cd24de8"  ;; \
+        "linux/arm64")  KUSTOMIZE_SHA256="5566f7badece5a72d42075d8dffa6296a228966dd6ac2390de7afbb9675c3aaa"  ;; \
     esac && \
     echo "${KUSTOMIZE_SHA256}  ${KUSTOMIZE_FILENAME}" | sha256sum -c && \
     tar xvf "${KUSTOMIZE_FILENAME}" -C /usr/local/bin && \
     rm "${KUSTOMIZE_FILENAME}" && \
-    kustomize version --short | grep "kustomize/${KUSTOMIZE_VERSION}"
+    [ "$(kustomize version)" = "${KUSTOMIZE_VERSION}" ]
 
 ENV SOPS_VERSION="v3.8.1"
 ARG SOPS_FILENAME="sops-${SOPS_VERSION}.${TARGETOS}.${TARGETARCH}"