diff --git a/.github/workflows/Makefile b/.github/workflows/Makefile
index 47d6d167..179e3cd5 100644
--- a/.github/workflows/Makefile
+++ b/.github/workflows/Makefile
@@ -1,4 +1,4 @@
-HELM_VERSION ?= v4.2.0
+HELM_VERSION ?= v4.2.1
 KUSTOMIZE_VERSION ?= v5.8.0
 K8S_VERSION ?= v1.34.0
 MINIKUBE_VERSION ?= v1.37.0
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 28993711..70030c93 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        helm-version: [v3.18.6, v3.21.0, v4.2.0]
+        helm-version: [v3.18.6, v3.21.1, v4.2.1]
     steps:
       - uses: actions/checkout@v6
         with:
@@ -67,16 +67,16 @@ jobs:
         env:
           HELMFILE_HELM4: ${{ startsWith(matrix.helm-version, 'v4') && '1' || '0' }}
       - name: Archive built binaries
-        if: matrix.helm-version == 'v4.2.0'
+        if: matrix.helm-version == 'v4.2.1'
         run: tar -cvf built-binaries.tar helmfile diff-yamls dyff
       - uses: actions/upload-artifact@v7
-        if: matrix.helm-version == 'v4.2.0'
+        if: matrix.helm-version == 'v4.2.1'
         with:
           name: built-binaries-${{ github.run_id }}
           path: built-binaries.tar
           retention-days: 1
       - name: Display built binaries
-        if: matrix.helm-version == 'v4.2.0'
+        if: matrix.helm-version == 'v4.2.1'
         run: ls -l helmfile diff-yamls dyff
 
   integration_tests:
@@ -105,23 +105,23 @@ jobs:
             plugin-secrets-version: 4.7.4
             plugin-diff-version: 3.15.8
             extra-helmfile-flags: '--enable-live-output'
-          - helm-version: v3.21.0
+          - helm-version: v3.21.1
             kustomize-version: v5.8.0
             plugin-secrets-version: 4.7.4
             plugin-diff-version: 3.15.8
             extra-helmfile-flags: ''
-          - helm-version: v3.21.0
+          - helm-version: v3.21.1
             kustomize-version: v5.8.0
             plugin-secrets-version: 4.7.4
             plugin-diff-version: 3.15.8
             extra-helmfile-flags: '--enable-live-output'
           # Helmfile now supports both Helm 3.x and Helm 4.x
-          - helm-version: v4.2.0
+          - helm-version: v4.2.1
             kustomize-version: v5.8.0
             plugin-secrets-version: 4.7.4
             plugin-diff-version: 3.15.8
             extra-helmfile-flags: ''
-          - helm-version: v4.2.0
+          - helm-version: v4.2.1
             kustomize-version: v5.8.0
             plugin-secrets-version: 4.7.4
             plugin-diff-version: 3.15.8
diff --git a/Dockerfile b/Dockerfile
index fc0361da..1665d991 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ ENV HELM_CONFIG_HOME="${HELM_CONFIG_HOME}"
 ARG HELM_DATA_HOME="${HOME}/.local/share/helm"
 ENV HELM_DATA_HOME="${HELM_DATA_HOME}"
 
-ARG HELM_VERSION="v4.2.0"
+ARG HELM_VERSION="v4.2.1"
 ENV HELM_VERSION="${HELM_VERSION}"
 ENV HELM_BIN="/usr/local/bin/helm"
 ARG HELM_LOCATION="https://get.helm.sh"
@@ -39,8 +39,8 @@ RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "${HELM_LOCATION}/${HELM_FILENAME}" && \
     echo Verifying ${HELM_FILENAME}... && \
     case ${TARGETPLATFORM} in \
-    "linux/amd64")  HELM_SHA256="97dbeb971be4ac4b27e3839976d9564c0fb35c6f3b1da89dd1e292d236af4096"  ;; \
-    "linux/arm64")  HELM_SHA256="1f8de130dfbd04de64978e7b852a7a547be1404956a366608276d2520b678670"  ;; \
+    "linux/amd64")  HELM_SHA256="479dca836e5b45e8bd222400c5591b0e3a647378f03ff96597180db97c17fdae"  ;; \
+    "linux/arm64")  HELM_SHA256="596b9a73d366c1e72ce67d595c22805480e30914593aafbc9f547694e72814db"  ;; \
     esac && \
     echo "${HELM_SHA256}  ${HELM_FILENAME}" | sha256sum -c && \
     echo Extracting ${HELM_FILENAME}... && \
diff --git a/Dockerfile.debian-stable-slim b/Dockerfile.debian-stable-slim
index 7e199278..4d8bdf68 100644
--- a/Dockerfile.debian-stable-slim
+++ b/Dockerfile.debian-stable-slim
@@ -38,7 +38,7 @@ ENV HELM_CONFIG_HOME="${HELM_CONFIG_HOME}"
 ARG HELM_DATA_HOME="${HOME}/.local/share/helm"
 ENV HELM_DATA_HOME="${HELM_DATA_HOME}"
 
-ARG HELM_VERSION="v4.2.0"
+ARG HELM_VERSION="v4.2.1"
 ENV HELM_VERSION="${HELM_VERSION}"
 ENV HELM_BIN="/usr/local/bin/helm"
 ARG HELM_LOCATION="https://get.helm.sh"
@@ -47,8 +47,8 @@ RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "${HELM_LOCATION}/${HELM_FILENAME}" && \
     echo Verifying ${HELM_FILENAME}... && \
     case ${TARGETPLATFORM} in \
-    "linux/amd64")  HELM_SHA256="97dbeb971be4ac4b27e3839976d9564c0fb35c6f3b1da89dd1e292d236af4096"  ;; \
-    "linux/arm64")  HELM_SHA256="1f8de130dfbd04de64978e7b852a7a547be1404956a366608276d2520b678670"  ;; \
+    "linux/amd64")  HELM_SHA256="479dca836e5b45e8bd222400c5591b0e3a647378f03ff96597180db97c17fdae"  ;; \
+    "linux/arm64")  HELM_SHA256="596b9a73d366c1e72ce67d595c22805480e30914593aafbc9f547694e72814db"  ;; \
     esac && \
     echo "${HELM_SHA256}  ${HELM_FILENAME}" | sha256sum -c && \
     echo Extracting ${HELM_FILENAME}... && \
diff --git a/Dockerfile.ubuntu b/Dockerfile.ubuntu
index 0f3e0463..d4382097 100644
--- a/Dockerfile.ubuntu
+++ b/Dockerfile.ubuntu
@@ -38,7 +38,7 @@ ENV HELM_CONFIG_HOME="${HELM_CONFIG_HOME}"
 ARG HELM_DATA_HOME="${HOME}/.local/share/helm"
 ENV HELM_DATA_HOME="${HELM_DATA_HOME}"
 
-ARG HELM_VERSION="v4.2.0"
+ARG HELM_VERSION="v4.2.1"
 ENV HELM_VERSION="${HELM_VERSION}"
 ENV HELM_BIN="/usr/local/bin/helm"
 ARG HELM_LOCATION="https://get.helm.sh"
@@ -47,8 +47,8 @@ RUN set -x && \
     curl --retry 5 --retry-connrefused -LO "${HELM_LOCATION}/${HELM_FILENAME}" && \
     echo Verifying ${HELM_FILENAME}... && \
     case ${TARGETPLATFORM} in \
-    "linux/amd64")  HELM_SHA256="97dbeb971be4ac4b27e3839976d9564c0fb35c6f3b1da89dd1e292d236af4096"  ;; \
-    "linux/arm64")  HELM_SHA256="1f8de130dfbd04de64978e7b852a7a547be1404956a366608276d2520b678670"  ;; \
+    "linux/amd64")  HELM_SHA256="479dca836e5b45e8bd222400c5591b0e3a647378f03ff96597180db97c17fdae"  ;; \
+    "linux/arm64")  HELM_SHA256="596b9a73d366c1e72ce67d595c22805480e30914593aafbc9f547694e72814db"  ;; \
     esac && \
     echo "${HELM_SHA256}  ${HELM_FILENAME}" | sha256sum -c && \
     echo Extracting ${HELM_FILENAME}... && \
diff --git a/go.mod b/go.mod
index 7b48604f..3e8afa9a 100644
--- a/go.mod
+++ b/go.mod
@@ -36,15 +36,15 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.21.0
-	helm.sh/helm/v4 v4.2.0
-	k8s.io/apimachinery v0.36.0
-	k8s.io/client-go v0.36.0
+	helm.sh/helm/v3 v3.21.1
+	helm.sh/helm/v4 v4.2.1
+	k8s.io/apimachinery v0.36.1
+	k8s.io/client-go v0.36.1
 )
 
 replace (
 	// kubedog's flagger dependency still imports k8s.io/api/autoscaling/v2beta2,
-	// while Helm 4.2.0 requires k8s.io/apimachinery/content.IsPathSegmentName from v0.36+.
+	// while Helm 4.2.1 requires k8s.io/apimachinery/content.IsPathSegmentName from v0.36+.
 	k8s.io/api => k8s.io/api v0.35.4
 	k8s.io/apimachinery => k8s.io/apimachinery v0.36.0
 	k8s.io/client-go => k8s.io/client-go v0.35.4
@@ -106,10 +106,10 @@ require (
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.276.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
@@ -211,7 +211,7 @@ require (
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/extism/go-sdk v1.7.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fluxcd/cli-utils v1.2.0 // indirect
+	github.com/fluxcd/cli-utils v1.2.1 // indirect
 	github.com/fluxcd/flagger v1.36.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/getsops/gopgagent v0.0.0-20241224165529-7044f28e491e // indirect
@@ -306,7 +306,7 @@ require (
 	github.com/sony/gobreaker v0.5.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
-	github.com/tetratelabs/wazero v1.11.0 // indirect
+	github.com/tetratelabs/wazero v1.12.0 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
@@ -335,27 +335,27 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/gookit/color.v1 v1.1.6 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/api v0.36.0 // indirect
-	k8s.io/apiextensions-apiserver v0.36.0 // indirect
-	k8s.io/apiserver v0.36.0 // indirect
-	k8s.io/cli-runtime v0.36.0 // indirect
-	k8s.io/component-base v0.36.0 // indirect
+	k8s.io/api v0.36.1 // indirect
+	k8s.io/apiextensions-apiserver v0.36.1 // indirect
+	k8s.io/apiserver v0.36.1 // indirect
+	k8s.io/cli-runtime v0.36.1 // indirect
+	k8s.io/component-base v0.36.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/kubectl v0.36.0 // indirect
+	k8s.io/kubectl v0.36.1 // indirect
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
-	oras.land/oras-go/v2 v2.6.0 // indirect
-	sigs.k8s.io/controller-runtime v0.24.0 // indirect
+	oras.land/oras-go/v2 v2.6.1 // indirect
+	sigs.k8s.io/controller-runtime v0.24.1 // indirect
 	sigs.k8s.io/kustomize/api v0.21.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 79073816..e1260ab5 100644
--- a/go.sum
+++ b/go.sum
@@ -310,8 +310,8 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/cli-utils v1.2.0 h1:1o07pXTMxJ/XJ1GpAbLtjdXwfCUMq4Ku1OcnvJHLohI=
-github.com/fluxcd/cli-utils v1.2.0/go.mod h1:d5HdTDdR5sCbsIbgtOQ7x7srKYwYeZORU6CD2yn4j/M=
+github.com/fluxcd/cli-utils v1.2.1 h1:ug9CicKW7H9QXnvNDapTSKuryZvWcu4Nw7pRvQa6jDY=
+github.com/fluxcd/cli-utils v1.2.1/go.mod h1:cky6M6eHvTQkoPtsuFYLIgAMYdpTCSLoor4IA6vueSw=
 github.com/fluxcd/flagger v1.36.1 h1:X2PumtNwZz9YSGaOtZLFm2zAKLgHhFkbNv8beg7ifyc=
 github.com/fluxcd/flagger v1.36.1/go.mod h1:qmtLsxheVDTI8XeCaXUxW5UCmfcSKnY9fizG9NmW/Fk=
 github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
@@ -758,8 +758,8 @@ github.com/tatsushid/go-prettytable v0.0.0-20141013043238-ed2d14c29939 h1:BhIUXV
 github.com/tatsushid/go-prettytable v0.0.0-20141013043238-ed2d14c29939/go.mod h1:omGxs4/6hNjxPKUTjmaNkPzehSnNJOJN6pMEbrlYIT4=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
-github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
-github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
+github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
+github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -897,8 +897,8 @@ golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
@@ -908,8 +908,8 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -926,8 +926,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -988,8 +988,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
@@ -1003,8 +1003,8 @@ golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1056,38 +1056,38 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.21.0 h1:9TRbaXQH+BIKLLDYlu++JsyWodS5kBBOLF7C7HY5+cs=
-helm.sh/helm/v3 v3.21.0/go.mod h1:5IvU6Ae6ruB/vasVHhnC1IU5RvqFM349vLYS1BiHqeY=
-helm.sh/helm/v4 v4.2.0 h1:J+0TmTtPK2NuS6z9Z2WOcIX0nGGJylokEZLt0fi0X4U=
-helm.sh/helm/v4 v4.2.0/go.mod h1:sDQRGAct/I/ogTvOX8QqE/8bBWuLH4BHbB3QFL5G3do=
+helm.sh/helm/v3 v3.21.1 h1:g4AE2nnAAqSEg3aSBUoqJAKpiEvAKuYeIjk6x9U+vj0=
+helm.sh/helm/v3 v3.21.1/go.mod h1:MUakFviBniZhRL89rFwl6XZZHorArkWCTIKKX7ugTq0=
+helm.sh/helm/v4 v4.2.1 h1:esMHK7az2udPJvsRLA1EsxB7lJwqXcsb3biYnlFIjrg=
+helm.sh/helm/v4 v4.2.1/go.mod h1:dp3ihfy1AhCLKANDaPETmVWhqPkOmwvJtpK/biHfopE=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/api v0.35.4 h1:P7nFYKl5vo9AGUp1Z+Pmd3p2tA7bX2wbFWCvDeRv988=
 k8s.io/api v0.35.4/go.mod h1:yl4lqySWOgYJJf9RERXKUwE9g2y+CkuwG+xmcOK8wXU=
-k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
-k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
+k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
+k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
 k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
 k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
-k8s.io/apiserver v0.36.0 h1:Jg5OFAENUACByUCg15CmhZAYrr5ZyJ+jodyA1mHl3YE=
-k8s.io/apiserver v0.36.0/go.mod h1:mHvwdHf+qKEm+1/hYm756SV+oREOKSPnsjagOpx6Vho=
-k8s.io/cli-runtime v0.36.0 h1:HNxciQpQMMOKS0/GiUXcKDyA6J2FDILJj9NmP2BZrTg=
-k8s.io/cli-runtime v0.36.0/go.mod h1:KObkknK9Ro5LYX+1RdiKc7C8CvGg4aX+V/Zv+E8WPHA=
+k8s.io/apiserver v0.36.1 h1:iMS5V+rPUertv5P9RaqJgmHHTuh4quWpoxchvMUY+JY=
+k8s.io/apiserver v0.36.1/go.mod h1:Cby1PbLWztu0GDOxoO6iFOyyqIsziHNEW+w9zVQ22Kw=
+k8s.io/cli-runtime v0.36.1 h1:yuC/BGnnj1YYPh6D1P+pZnzinCs6DvMq86yAeNqoqzM=
+k8s.io/cli-runtime v0.36.1/go.mod h1:ZQWHGt8xAF7KnviB79vX0lYNyUUqKIpU+LQg7exuFAw=
 k8s.io/client-go v0.35.4 h1:DN6fyaGuzK64UvnKO5fOA6ymSjvfGAnCAHAR0C66kD8=
 k8s.io/client-go v0.35.4/go.mod h1:2Pg9WpsS4NeOpoYTfHHfMxBG8zFMSAUi4O/qoiJC3nY=
-k8s.io/component-base v0.36.0 h1:hFjEktssxiJhrK1zfybkH4kJOi8iZuF+mIDCqS5+jRo=
-k8s.io/component-base v0.36.0/go.mod h1:JZvIfcNHk+uck+8LhJzhSBtydWXaZNQwX2OdL+Mnwsk=
+k8s.io/component-base v0.36.1 h1:iG6GsELftXqTNG9HG6kiVjatSgAw1sf5pJ6R5a6N0kA=
+k8s.io/component-base v0.36.1/go.mod h1:nf9XPlntRdqO6WMeEWAA5F93Y4ICZQdeT9GeqLDB3JI=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
 k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/kubectl v0.36.0 h1:hEGr8NvIm2Wjqs2Xy48Uzmvo6lpHdGKlLyMvau2gTms=
-k8s.io/kubectl v0.36.0/go.mod h1:iDe8aV5BEi45W8k+5n71I2pJ/nwE0PHDu+/2cejzYoo=
+k8s.io/kubectl v0.36.1 h1:96HqS9twIdHM0MlJLTwbo14b9kUKPkOzZ4tlRDLv4qI=
+k8s.io/kubectl v0.36.1/go.mod h1:/DGPAIewKsFWF9VFgGvkPhao2Ev4SNuE3BioZo8yPbk=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
-oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
-sigs.k8s.io/controller-runtime v0.24.0 h1:Ck6N2LdS8Lovy1o25BB4r1xjvLEKUl1s2o9kU+KWDE4=
-sigs.k8s.io/controller-runtime v0.24.0/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
+oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=
+oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk=
+sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
+sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
diff --git a/pkg/app/init.go b/pkg/app/init.go
index af80a5db..fc79a883 100644
--- a/pkg/app/init.go
+++ b/pkg/app/init.go
@@ -20,7 +20,7 @@ import (
 const (
 	HelmRequiredVersion            = "v3.18.6" // Minimum required version (supports Helm 3.x and 4.x)
 	HelmDiffRecommendedVersion     = "v3.15.8"
-	HelmRecommendedVersion         = "v4.2.0" // Recommended Helm 4 version
+	HelmRecommendedVersion         = "v4.2.1" // Recommended Helm 4 version
 	HelmSecretsRecommendedVersion  = "v4.7.4" // v4.7.0+ works with both Helm 3 (single plugin) and Helm 4 (split plugin architecture)
 	HelmGitRecommendedVersion      = "v1.3.0"
 	HelmS3RecommendedVersion       = "v0.16.3"
diff --git a/test/e2e/template/helmfile/snapshot_test.go b/test/e2e/template/helmfile/snapshot_test.go
index eeb58341..c39e5ee3 100644
--- a/test/e2e/template/helmfile/snapshot_test.go
+++ b/test/e2e/template/helmfile/snapshot_test.go
@@ -29,6 +29,9 @@ var (
 	chartGitFullPathRegex = regexp.MustCompile(`chart=.*git\.ref=.*/charts/.*`)
 	// helm short version regex. e.g. v3.10.2+g50f003e
 	helmShortVersionRegex = regexp.MustCompile(`v\d+\.\d+\.\d+\+[a-z0-9]+`)
+	// OCI digest regex. e.g. Digest: sha256:abc123...
+	// The digest is non-deterministic because helm packages include build timestamps.
+	ociDigestRegex = regexp.MustCompile(`Digest: sha256:[0-9a-f]*`)
 )
 
 type Config struct {
@@ -358,7 +361,7 @@ func testHelmfileTemplateWithBuildCommand(t *testing.T, GoYamlV3 bool) {
 			defer cancel()
 
 			args := []string{"-f", inputFile}
-			// Add --oci-plain-http flag for tests using local Docker registry (Helm 4 requirement)
+			// Add --oci-plain-http flag for tests using local Docker registry (required for HTTP-only OCI registries)
 			if config.LocalDockerRegistry.Enabled {
 				args = append(args, "--oci-plain-http")
 			}
@@ -400,6 +403,10 @@ func testHelmfileTemplateWithBuildCommand(t *testing.T, GoYamlV3 bool) {
 				gotStr = strings.ReplaceAll(gotStr, fmt.Sprintf("localhost:%d", hostPort), "localhost:$REGISTRY_PORT")
 				gotStr = strings.ReplaceAll(gotStr, fmt.Sprintf("oci__localhost_%d", hostPort), "oci__localhost_$REGISTRY_PORT")
 
+				// Normalize OCI digest values that change between test runs because
+				// helm packages include build timestamps making each digest unique.
+				gotStr = ociDigestRegex.ReplaceAllString(gotStr, "Digest: sha256:$$DIGEST")
+
 				sc := bufio.NewScanner(strings.NewReader(gotStr))
 				for sc.Scan() {
 					if !strings.HasPrefix(sc.Text(), "Templating ") {
@@ -505,6 +512,46 @@ func isHelm4(t *testing.T) bool {
 	return os.Getenv("HELMFILE_HELM4") == "1"
 }
 
+// requiresPlainHTTPForOCI returns true if the current Helm binary requires the --plain-http
+// flag when pushing to or pulling from HTTP-only OCI registries.
+// Helm 4.x always requires this flag. Helm 3.21+ also requires it due to stricter
+// security checks that reject scheme downgrades from HTTPS to HTTP.
+func requiresPlainHTTPForOCI(t *testing.T) bool {
+	t.Helper()
+
+	helmBinary := os.Getenv("HELM_BIN")
+	if helmBinary == "" {
+		helmBinary = "helm"
+	}
+
+	cmd := exec.Command(helmBinary, "version", "--template={{.Version}}")
+	output, err := cmd.CombinedOutput()
+	if err == nil {
+		version := string(output)
+		// Helm 4.x requires --plain-http
+		if len(version) > 2 && version[0] == 'v' && version[1] == '4' {
+			return true
+		}
+		// Helm 3.21+ requires --plain-http for HTTP-only OCI registries
+		// Version format: v3.21.1+g8d45f12
+		if len(version) > 4 && version[0] == 'v' && version[1] == '3' && version[2] == '.' {
+			rest := version[3:] // "21.1+g..." or "10.2+g..."
+			dotIdx := strings.Index(rest, ".")
+			if dotIdx > 0 {
+				minor, parseErr := strconv.Atoi(rest[:dotIdx])
+				if parseErr == nil && minor >= 21 {
+					return true
+				}
+			}
+		}
+		return false
+	}
+
+	// Fallback: default to true (require --plain-http) when version detection fails,
+	// as any Helm that supports `helm push` also supports --plain-http.
+	return true
+}
+
 // installTestPlugin copies a test plugin directory to the helm plugins directory
 func installTestPlugin(t *testing.T, helmPluginsDir, pluginName, sourcePath string) {
 	t.Helper()
@@ -576,9 +623,9 @@ func copyDir(src, dst string) error {
 func execHelmPush(t *testing.T, tgzPath, remoteUrl string) (string, error) {
 	t.Helper()
 
-	// Helm 4 requires --plain-http for HTTP-only OCI registries (not HTTPS with self-signed certs)
+	// Helm 3.21+ and Helm 4 require --plain-http for HTTP-only OCI registries
 	args := []string{"push", tgzPath, remoteUrl}
-	if isHelm4(t) {
+	if requiresPlainHTTPForOCI(t) {
 		args = append(args, "--plain-http")
 	}
 	out := execHelm(t, args...)
diff --git a/test/e2e/template/helmfile/testdata/snapshot/issue_473_oci_chart_url_fetch/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/issue_473_oci_chart_url_fetch/output-helm4.yaml
new file mode 100644
index 00000000..c668d7c5
--- /dev/null
+++ b/test/e2e/template/helmfile/testdata/snapshot/issue_473_oci_chart_url_fetch/output-helm4.yaml
@@ -0,0 +1,4 @@
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
+
diff --git a/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull/output-helm4.yaml
new file mode 100644
index 00000000..b4d00a8f
--- /dev/null
+++ b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull/output-helm4.yaml
@@ -0,0 +1,15 @@
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
+
+Templating release=foo, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+  namespace: default
+data:
+  foo: FOO
+
diff --git a/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_direct/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_direct/output-helm4.yaml
new file mode 100644
index 00000000..5ee316fc
--- /dev/null
+++ b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_direct/output-helm4.yaml
@@ -0,0 +1,30 @@
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
+
+Templating release=foo, chart=$HELMFILE_CACHE_HOME/oci__localhost_$REGISTRY_PORT/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: foo
+
+Templating release=bar, chart=$HELMFILE_CACHE_HOME/oci__localhost_$REGISTRY_PORT/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bar
+  namespace: ns2
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: bar
+
diff --git a/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once/output-helm4.yaml
new file mode 100644
index 00000000..eac963da
--- /dev/null
+++ b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once/output-helm4.yaml
@@ -0,0 +1,73 @@
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
+
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.0.1
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.0.1
+Digest: sha256:$DIGEST
+
+Templating release=foo, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: foo
+
+Templating release=bar, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bar
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: bar
+
+Templating release=release-no-default-ns, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-no-default-ns
+  namespace: no-default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-no-default-ns
+
+Templating release=second-version-of-chart, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.0.1/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: second-version-of-chart
+  namespace: foobar
+  annotations:
+    chart-version: 0.0.1
+data:
+  values: second-version-of-chart
+
+Templating release=first-release-version-of-chart, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: first-release-version-of-chart
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: first-release-version-of-chart
+
diff --git a/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once2/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once2/output-helm4.yaml
new file mode 100644
index 00000000..7074ea9b
--- /dev/null
+++ b/test/e2e/template/helmfile/testdata/snapshot/oci_chart_pull_once2/output-helm4.yaml
@@ -0,0 +1,69 @@
+Pulling localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
+
+Templating release=release-0, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-0
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-0
+
+Templating release=release-1, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-1
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-1
+
+Templating release=release-2, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-2
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-2
+
+Templating release=release-3, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-3
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-3
+
+Templating release=release-4, chart=$HELMFILE_CACHE_HOME/myrepo/raw/0.1.0/raw
+---
+# Source: raw/templates/resources.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: release-4
+  namespace: default
+  annotations:
+    chart-version: 0.1.0
+data:
+  values: release-4
+
diff --git a/test/e2e/template/helmfile/testdata/snapshot/oci_need/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/oci_need/output-helm4.yaml
index 7825808f..f04e334b 100644
--- a/test/e2e/template/helmfile/testdata/snapshot/oci_need/output-helm4.yaml
+++ b/test/e2e/template/helmfile/testdata/snapshot/oci_need/output-helm4.yaml
@@ -1,6 +1,8 @@
 Building dependency release=foo, chart=$WD/temp1/foo
 Saving 1 charts
 Downloading raw from repo oci://localhost:$REGISTRY_PORT/myrepo
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
 Deleting outdated charts
 
 Templating release=foo, chart=$WD/temp1/foo
diff --git a/test/e2e/template/helmfile/testdata/snapshot/postrenderer/output-helm4.yaml b/test/e2e/template/helmfile/testdata/snapshot/postrenderer/output-helm4.yaml
index 5a255f07..ba813e5c 100644
--- a/test/e2e/template/helmfile/testdata/snapshot/postrenderer/output-helm4.yaml
+++ b/test/e2e/template/helmfile/testdata/snapshot/postrenderer/output-helm4.yaml
@@ -2,6 +2,8 @@ Building dependency release=foo, chart=$WD/testdata/charts/raw-0.1.0
 Building dependency release=baz, chart=$WD/temp1/baz
 Saving 1 charts
 Downloading raw from repo oci://localhost:$REGISTRY_PORT/myrepo
+Pulled: localhost:$REGISTRY_PORT/myrepo/raw:0.1.0
+Digest: sha256:$DIGEST
 Deleting outdated charts
 
 Templating release=foo, chart=$WD/testdata/charts/raw-0.1.0