- Fix secret handling by converting stringData to data before diffing (workaround for upstream Kubernetes bug)
- Prevent client‑side throttling by setting QPS and burst when impersonating service accounts in the helm controller
- Add a `--wait` flag to `flux resume` and bump component versions (kustomize v0.21.1, helm v0.17.1)