diff --git a/kubernetes/infrastructure/openbao/helmrelease.yaml b/kubernetes/infrastructure/openbao/helmrelease.yaml
index 95575b0b..f588a5ea 100644
--- a/kubernetes/infrastructure/openbao/helmrelease.yaml
+++ b/kubernetes/infrastructure/openbao/helmrelease.yaml
@@ -24,7 +24,7 @@ spec:
       # window. The StatefulSet rolls one pod at a time (updateStrategyType
       # below). Undo after a pod has run the new server = restore the
       # snapshot, not a git revert.
-      version: ">=0.30.4 <0.31.0"
+      version: ">=0.30.6 <0.31.0"
       sourceRef:
         kind: HelmRepository
         name: openbao
diff --git a/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml b/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
index 2b41f6aa..0ade458a 100644
--- a/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
+++ b/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
@@ -45,7 +45,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: snapshot
-              image: quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf # same image as the server — bao CLI included
+              image: quay.io/openbao/openbao:2.7.2@sha256:5046911075e137e154ce49ab051502f4ec7cf367d484ae4a4dce665d9b90561f # same image as the server — bao CLI included
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities: