diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index a06fde14..983f2ab9 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -4,19 +4,31 @@
 import subprocess
 import yaml
 from typing import Tuple, Set
+from textwrap import dedent
+
 
 def run_helm_repo_add(repo_name: str, repo_url: str) -> None:
-    try:
-        subprocess.run(["helm", "repo", "add", repo_name, repo_url], check=True)
-    except subprocess.CalledProcessError as e:
-        if "already exists" in e.stderr.decode() if e.stderr else str(e):
-            pass  # Ignore "already exists" error
-        else:
-            raise
+    result = subprocess.run(
+        ["helm", "repo", "add", repo_name, repo_url, "--force-update"],
+        capture_output=True,
+        check=True,
+    )
+    if result.returncode == 0:
+        print(f"✅ Added/Updated {repo_name} ({repo_url})")
+    else:
+        print(
+            f"⚠️ There was a problem Adding/Updating {repo_name} ({repo_url}): {result.stderr}"
+        )
 
 
-def run_helm_repo_update(repo_name: str) -> None:
-    subprocess.run(["helm", "repo", "update", repo_name], check=True)
+def local_repo_list():
+    result = subprocess.run(
+        ["helm", "repo", "list", "-o", "yaml"],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return yaml.safe_load(result.stdout)
 
 
 def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str]:
@@ -25,14 +37,17 @@ def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str
         ["helm", "show", "chart", full_chart],
         capture_output=True,
         text=True,
-        check=True
+        check=True,
     )
     chart_yaml = yaml.safe_load(result.stdout)
-    return chart_yaml["version"], chart_yaml["appVersion"]
+    # Some charts don't have an appVersion and as such we fallback to a default
+    # value to not cause lookup errors.
+    return chart_yaml["version"], chart_yaml.setdefault("appVersion", "Not present")
 
 
 def process_yaml_files(top_dir: str) -> None:
     seen_repos: Set[str] = set()
+    local_repos = local_repo_list()
 
     for root, _, files in os.walk(top_dir):
         for file in files:
@@ -72,19 +87,47 @@ def process_yaml_files(top_dir: str) -> None:
                 if not repo_name or not repo_url:
                     continue
 
+                # At this point, it appears to be a Helm Chart manifest.
+
+                # Skip Vector, as we currently keep it tied to the version that the product sidecars use.abs
+                # Looking forward to swapping the transport with OTLP.
+                if chart_name == "vector":
+                    raise Exception(
+                        "Skipping vector. Ensure it is at the same version as the product sidecars"
+                    )
+                    continue
+
+                chart_version = first_doc["version"]
+                # Skip chart versions which seem to be templated.
+                if chart_version.startswith("{{"):
+                    continue
+
+                local_repo = next(
+                    (repo for repo in local_repos if repo["name"] == repo_name), None
+                )
+                if local_repo is not None:
+                    local_repo_url = local_repo["url"]
+                    if local_repo_url != repo_url:
+                        raise Exception(
+                            dedent(f"""
+                            You have a local repo named {repo_name} pointing to {local_repo_url}, but the stack/demo wants {repo_url}
+                            Either delete or update your local repo URL, or update the stack/demo repo name so it doesn't conflict
+                        """)
+                        )
+
                 if repo_name not in seen_repos:
                     run_helm_repo_add(repo_name, repo_url)
                     seen_repos.add(repo_name)
 
-                run_helm_repo_update(repo_name)
-
                 # print(f"📦 Updating {filepath} -> {repo_name}/{chart_name}")
-                new_chart_version, new_app_version = get_chart_and_app_version(repo_name, chart_name)
+                new_chart_version, new_app_version = get_chart_and_app_version(
+                    repo_name, chart_name
+                )
 
                 updated_lines = []
                 for line in raw_lines:
-                    if line.strip().startswith("version:"):
-                        new_line = f'version: {new_chart_version} # {new_app_version}\n'
+                    if line.startswith("version:"):
+                        new_line = f"version: {new_chart_version} # appVersion: {new_app_version}\n"
                         updated_lines.append(new_line)
                     else:
                         updated_lines.append(line)
@@ -95,13 +138,22 @@ def process_yaml_files(top_dir: str) -> None:
                 print(f"✅ Updated {filepath}")
 
             except Exception as e:
+                # If debugging, you can get the exception line number like this:
+                # _, _, tb = os.sys.exc_info()
+                # lineno = tb.tb_lineno
                 print(f"⚠️ Error processing {filepath}: {e}")
 
+
 if __name__ == "__main__":
-    print('⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️')
-    print('Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions')
-    print('Please judge on the skipped files if they contain a helm-chart and should be manually bumped')
-    print('The script can be improved to handle such files in the future')
-    print()
+    print(
+        dedent("""
+            ⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️
+            Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions.
+            In those cases, use quotes around templated values, or otherwise comments for templated blocks.
+
+            Please judge on the skipped files if they contain a helm-chart and should be manually bumped.
+            The script can be improved to handle such files in the future.
+        """)
+    )
 
     process_yaml_files(".")
diff --git a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
index 96dcd8f0..21f3cdd9 100644
--- a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
@@ -18,5 +18,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
index d572d736..4df65e9a 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
@@ -5,7 +5,7 @@ metadata:
   name: airflow
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
 spec:
   image:
     productVersion: 3.2.2
diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
index a0530541..520e5eff 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
@@ -23,5 +23,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
index e7dccbac..3e5d3ed1 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
@@ -15,5 +15,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
index 94f672e4..d33f7d83 100644
--- a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
@@ -16,5 +16,5 @@ spec:
       namespace: minio
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/stacks/_templates/argo-cd.yaml b/stacks/_templates/argo-cd.yaml
index 2cb43fd9..87730d33 100644
--- a/stacks/_templates/argo-cd.yaml
+++ b/stacks/_templates/argo-cd.yaml
@@ -4,16 +4,16 @@ name: argo-cd
 repo:
   name: argo-cd
   url: https://argoproj.github.io/argo-helm
-version: 9.4.10 # v3.3.3
+version: 10.1.3 # appVersion: v3.4.5
 options:
   global:
     additionalLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   configs:
     secret:
diff --git a/stacks/_templates/minio-distributed-small-tls/values.yaml b/stacks/_templates/minio-distributed-small-tls/values.yaml
index 25b926f2..9fbdb1e6 100644
--- a/stacks/_templates/minio-distributed-small-tls/values.yaml
+++ b/stacks/_templates/minio-distributed-small-tls/values.yaml
@@ -1,19 +1,19 @@
 ---
 additionalLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 podLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 rootUser: admin
 rootPassword: adminadmin
diff --git a/stacks/_templates/minio-distributed-tls/values.yaml b/stacks/_templates/minio-distributed-tls/values.yaml
index a122c521..d601af57 100644
--- a/stacks/_templates/minio-distributed-tls/values.yaml
+++ b/stacks/_templates/minio-distributed-tls/values.yaml
@@ -1,19 +1,19 @@
 ---
 additionalLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 podLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 rootUser: admin
 rootPassword: adminadmin
diff --git a/stacks/_templates/minio.yaml b/stacks/_templates/minio.yaml
index c1a0cbca..135558ad 100644
--- a/stacks/_templates/minio.yaml
+++ b/stacks/_templates/minio.yaml
@@ -4,26 +4,26 @@ name: minio
 repo:
   name: minio
   url: https://charts.min.io/
-version: 5.4.0 # RELEASE.2024-12-18T13-15-44Z
+version: 5.4.0 # appVersion: RELEASE.2024-12-18T13-15-44Z
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   rootUser: admin
-  rootPassword: {{ minioAdminPassword }}
+  rootPassword: "{{ minioAdminPassword }}"
   mode: standalone
   persistence:
     size: 10Gi
diff --git a/stacks/_templates/opensearch-dashboards.yaml b/stacks/_templates/opensearch-dashboards.yaml
index 2b86f755..f7826afd 100644
--- a/stacks/_templates/opensearch-dashboards.yaml
+++ b/stacks/_templates/opensearch-dashboards.yaml
@@ -4,18 +4,18 @@ name: opensearch-dashboards
 repo:
   name: opensearch-dashboards
   url: https://opensearch-project.github.io/helm-charts
-version: {{ opensearchVersion }}
+version: "{{ opensearchVersion }}"
 options:
   image:
     repository: oci.stackable.tech/sdp/opensearch-dashboards
     tag: "{{ opensearchVersion }}-stackable{{ stackableReleaseVersion }}"
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   service:
     type: NodePort
@@ -25,11 +25,11 @@ options:
       stackable.tech/logging-credentials-secret: opensearch-user
     labels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   opensearchHosts: null # Use the discovery ConfigMap instead
   extraEnvs:
diff --git a/stacks/_templates/postgresql-airflow.yaml b/stacks/_templates/postgresql-airflow.yaml
index 96a688c6..4350d0c3 100644
--- a/stacks/_templates/postgresql-airflow.yaml
+++ b/stacks/_templates/postgresql-airflow.yaml
@@ -4,15 +4,15 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: airflow
diff --git a/stacks/_templates/postgresql-druid.yaml b/stacks/_templates/postgresql-druid.yaml
index 12d99761..a5efa578 100644
--- a/stacks/_templates/postgresql-druid.yaml
+++ b/stacks/_templates/postgresql-druid.yaml
@@ -4,15 +4,15 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: druid
diff --git a/stacks/_templates/postgresql-hive-iceberg.yaml b/stacks/_templates/postgresql-hive-iceberg.yaml
index 1ce8cce4..01984159 100644
--- a/stacks/_templates/postgresql-hive-iceberg.yaml
+++ b/stacks/_templates/postgresql-hive-iceberg.yaml
@@ -4,15 +4,15 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: hive
diff --git a/stacks/_templates/postgresql-hive.yaml b/stacks/_templates/postgresql-hive.yaml
index a1de1e2c..4b623157 100644
--- a/stacks/_templates/postgresql-hive.yaml
+++ b/stacks/_templates/postgresql-hive.yaml
@@ -4,15 +4,15 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: hive
diff --git a/stacks/_templates/postgresql-superset.yaml b/stacks/_templates/postgresql-superset.yaml
index 747458f7..f20013ad 100644
--- a/stacks/_templates/postgresql-superset.yaml
+++ b/stacks/_templates/postgresql-superset.yaml
@@ -4,15 +4,15 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: superset
diff --git a/stacks/_templates/postgresql-timescaledb.yaml b/stacks/_templates/postgresql-timescaledb.yaml
index 246f2846..74be8a3f 100644
--- a/stacks/_templates/postgresql-timescaledb.yaml
+++ b/stacks/_templates/postgresql-timescaledb.yaml
@@ -4,15 +4,15 @@ name: timescaledb-single
 repo:
   name: timescale
   url: https://charts.timescale.com/
-version: 0.33.1
+version: 0.33.1 # appVersion: Not present
 options:
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   replicaCount: 1
   secrets:
diff --git a/stacks/_templates/vector-aggregator.yaml b/stacks/_templates/vector-aggregator.yaml
index 4b247aa7..af99ee79 100644
--- a/stacks/_templates/vector-aggregator.yaml
+++ b/stacks/_templates/vector-aggregator.yaml
@@ -8,19 +8,19 @@ version: 0.52.0 # app version 0.55.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   role: Aggregator
   customConfig:
@@ -49,7 +49,7 @@ options:
         auth:
           strategy: basic
           user: admin
-          password: {{ openSearchAdminPassword }}
+          password: "{{ openSearchAdminPassword }}"
   envFrom:
     - configMapRef:
         name: opensearch
diff --git a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
index 90b798d9..0f2cd25e 100644
--- a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
+++ b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
@@ -5,11 +5,11 @@ metadata:
   name: sealed-secrets-key
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
 stringData:
   # Generated on 2025/04/12
diff --git a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
index 8fd6d945..7d5ca771 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
@@ -9,7 +9,7 @@ repo:
 # Special care should be taken during testing when this version was bumped.
 # There might be cases where this needs to be dropped back, because the chart
 # is not compatible with other components of the stack/images used.
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:
@@ -41,11 +41,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     profileList:
       - display_name: "Default"
diff --git a/stacks/jupyterhub-keycloak/jupyterhub.yaml b/stacks/jupyterhub-keycloak/jupyterhub.yaml
index 5025800a..59aec283 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub.yaml
@@ -8,7 +8,7 @@ repo:
 # Special care should be taken during testing when this version was bumped.
 # There might be cases where this needs to be dropped back, because the chart
 # is not compatible with other components of the stack/images used.
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:
@@ -19,7 +19,7 @@ options:
           - isla.williams
       GenericOAuthenticator:
         client_id: jupyterhub
-        client_secret: {{jupyterhubClientPassword}}
+        client_secret: "{{jupyterhubClientPassword}}"
         username_claim: preferred_username
         scope:
           - openid
@@ -149,11 +149,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     initContainers:
       - name: download-notebook
@@ -199,29 +199,29 @@ options:
           cpu:
             display_name: CPU
             choices:
-{% for cpu in ["1","2","4","8","16","32"] %}
+# {% for cpu in ["1","2","4","8","16","32"] %}
               "{{cpu}}":
                 display_name: "{{cpu}}"
                 kubespawner_override:
-                  cpu_guarantee: {{cpu}}
-                  cpu_limit: {{cpu}}
-{% endfor %}
+                  cpu_guarantee: "{{cpu}}"
+                  cpu_limit: "{{cpu}}"
+# {% endfor %}
           memory:
             display_name: Memory
             choices:
-{% for memory in ["1","2","4","8","16","32","64","128"] %}
+# {% for memory in ["1","2","4","8","16","32","64","128"] %}
               "{{memory}} GB":
                 display_name: "{{memory}} GB"
                 kubespawner_override:
                   mem_guarantee: "{{memory}}G"
                   mem_limit: "{{memory}}G"
-{% endfor %}
+# {% endfor %}
           image:
             display_name: Image
             choices:
-{% for image in ["quay.io/jupyter/pyspark-notebook:python-3.11.9", "quay.io/jupyter/pyspark-notebook:spark-3.5.2"] %}
+# {% for image in ["quay.io/jupyter/pyspark-notebook:python-3.11.9", "quay.io/jupyter/pyspark-notebook:spark-3.5.2"] %}
               "{{image}}":
                 display_name: "{{image}}"
                 kubespawner_override:
                   image: "{{image}}"
-{% endfor %}
+# {% endfor %}
diff --git a/stacks/monitoring/prometheus.yaml b/stacks/monitoring/prometheus.yaml
index 5a7edba3..962ba6a5 100644
--- a/stacks/monitoring/prometheus.yaml
+++ b/stacks/monitoring/prometheus.yaml
@@ -4,19 +4,19 @@ name: kube-prometheus-stack
 repo:
   name: prometheus-community
   url: https://prometheus-community.github.io/helm-charts
-version: 82.10.3 # 0.89.0
+version: 87.12.2 # appVersion: v0.92.1
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   prometheusOperator:
     kubeletService:
-      namespace: {{ NAMESPACE }}
+      namespace: "{{ NAMESPACE }}"
   prometheus:
     prometheusSpec:
       storageSpec:
@@ -33,7 +33,7 @@ options:
     grafana.ini:
       analytics:
         check_for_updates: false
-    adminPassword: {{ grafanaAdminPassword }}
+    adminPassword: "{{ grafanaAdminPassword }}"
     persistence:
       enabled: true
       size: 10Gi
diff --git a/stacks/observability/grafana-admin-credentials.yaml b/stacks/observability/grafana-admin-credentials.yaml
index c8037bd2..26a71cf1 100644
--- a/stacks/observability/grafana-admin-credentials.yaml
+++ b/stacks/observability/grafana-admin-credentials.yaml
@@ -5,4 +5,4 @@ metadata:
   name: grafana-admin-credentials
 stringData:
   admin-user: admin
-  admin-password: {{ grafanaAdminPassword }}
+  admin-password: "{{ grafanaAdminPassword }}"
diff --git a/stacks/observability/grafana-loki.yaml b/stacks/observability/grafana-loki.yaml
index 04296da7..1ac6551e 100644
--- a/stacks/observability/grafana-loki.yaml
+++ b/stacks/observability/grafana-loki.yaml
@@ -3,12 +3,12 @@
 releaseName: loki
 name: loki
 repo:
-  name: loki
-  url: https://grafana.github.io/helm-charts
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
-# helm repo add grafana https://grafana.github.io/helm-charts --force-update
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
 # helm search repo grafana/loki
-version: 6.54.0 # 3.6.7
+version: 18.4.2 # appVersion: 3.7.3
 options:
   deploymentMode: SingleBinary
   singleBinary:
diff --git a/stacks/observability/grafana-tempo.yaml b/stacks/observability/grafana-tempo.yaml
index 2b6eca17..4685be09 100644
--- a/stacks/observability/grafana-tempo.yaml
+++ b/stacks/observability/grafana-tempo.yaml
@@ -3,23 +3,21 @@
 releaseName: tempo
 name: tempo
 repo:
-  name: tempo
-  url: https://grafana.github.io/helm-charts
-# Watch out for https://github.com/grafana/helm-charts/issues/3417
-# Workaround at: https://github.com/grafana/helm-charts/issues/3660#issuecomment-3007113458
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
-# helm repo add grafana https://grafana.github.io/helm-charts --force-update
-# helm search repo grafana/tempo
-version: 1.24.4 # 2.9.0
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
+# helm search repo grafana-community/tempo
+version: 2.2.3 # appVersion: 2.10.7
 options:
   global:
     commonLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   tempo:
     receivers:
diff --git a/stacks/observability/grafana.yaml b/stacks/observability/grafana.yaml
index 1e8b8333..2e5467f0 100644
--- a/stacks/observability/grafana.yaml
+++ b/stacks/observability/grafana.yaml
@@ -4,20 +4,20 @@
 releaseName: grafana
 name: grafana
 repo:
-  name: grafana
+  name: grafana-community
   url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
 # helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
 # helm search repo grafana-community/grafana
-version: 11.3.2 # 12.4.1
+version: 12.7.2 # appVersion: 13.1.0
 options:
   extraLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   admin:
     existingSecret: grafana-admin-credentials
@@ -30,14 +30,14 @@ options:
       datasources:
         - name: Loki
           type: loki
-          url: http://loki.{{ NAMESPACE }}.svc.cluster.local:3100
+          url: "http://loki.{{ NAMESPACE }}.svc.cluster.local:3100"
           access: proxy
           isDefault: false
           jsonData:
             tlsAuthWithCACert: false
         - name: Tempo
           type: tempo
-          url: http://tempo.{{ NAMESPACE }}.svc.cluster.local:3200
+          url: "http://tempo.{{ NAMESPACE }}.svc.cluster.local:3200"
           access: proxy
           isDefault: false
           jsonData:
diff --git a/stacks/observability/jaeger.yaml b/stacks/observability/jaeger.yaml
index 59a5638a..64ab2e0c 100644
--- a/stacks/observability/jaeger.yaml
+++ b/stacks/observability/jaeger.yaml
@@ -9,15 +9,15 @@ repo:
 # To find the latest version:
 # helm repo add jaegertracing https://jaegertracing.github.io/helm-charts --force-update
 # helm search repo jaegertracing/jaeger
-version: 4.5.0 # 2.15.1
+version: 4.11.1 # appVersion: 2.19.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   provisionDataStore:
     cassandra: false
diff --git a/stacks/observability/opentelemetry-operator.yaml b/stacks/observability/opentelemetry-operator.yaml
index a61d6b57..bc768bc2 100644
--- a/stacks/observability/opentelemetry-operator.yaml
+++ b/stacks/observability/opentelemetry-operator.yaml
@@ -6,15 +6,15 @@ repo:
   name: opentelemetry-operator
   url: https://open-telemetry.github.io/opentelemetry-helm-charts
 # Find the newest chart at https://github.com/open-telemetry/opentelemetry-helm-charts/releases
-version: 0.107.0 # 0.146.0
+version: 0.119.0 # appVersion: 0.154.0
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   admissionWebhooks:
     certManager:
diff --git a/stacks/signal-processing/grafana.yaml b/stacks/signal-processing/grafana.yaml
index 3d453979..2462d723 100644
--- a/stacks/signal-processing/grafana.yaml
+++ b/stacks/signal-processing/grafana.yaml
@@ -2,22 +2,25 @@
 releaseName: grafana
 name: grafana
 repo:
-  name: grafana
-  url: https://grafana.github.io/helm-charts
-version: 10.5.15 # 12.3.1
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
+# To find the latest version:
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
+# helm search repo grafana-community/grafana
+version: 12.7.2 # appVersion: 13.1.0
 options:
   extraLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   grafana.ini:
     analytics:
       check_for_updates: false
-  adminPassword: {{ grafanaAdminPassword }}
+  adminPassword: "{{ grafanaAdminPassword }}"
   persistence:
     enabled: true
     size: 10Gi
@@ -44,10 +47,10 @@ options:
       datasources:
         - name: postgres
           type: postgres
-          url: postgresql-timescaledb.{{ NAMESPACE }}.svc.cluster.local:5432
+          url: "postgresql-timescaledb.{{ NAMESPACE }}.svc.cluster.local:5432"
           user: admin
           secureJsonData:
-            password: {{ postgresAdminPassword }}
+            password: "{{ postgresAdminPassword }}"
           jsonData:
             database: tsdb
             sslmode: 'require'
diff --git a/stacks/signal-processing/jupyterhub.yaml b/stacks/signal-processing/jupyterhub.yaml
index c479ad6d..2f586b51 100644
--- a/stacks/signal-processing/jupyterhub.yaml
+++ b/stacks/signal-processing/jupyterhub.yaml
@@ -4,7 +4,7 @@ name: jupyterhub
 repo:
   name: jupyterhub
   url: https://jupyterhub.github.io/helm-chart/
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:
@@ -12,16 +12,16 @@ options:
         allowed_users:
           - admin
       DummyAuthenticator:
-        password: {{ jupyterHubAdminPassword }}
+        password: "{{ jupyterHubAdminPassword }}"
       JupyterHub:
         authenticator_class: dummy
     labels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   proxy:
     service:
@@ -45,11 +45,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     initContainers:
       - name: download-notebook
diff --git a/stacks/signal-processing/secrets.yaml b/stacks/signal-processing/secrets.yaml
index 2265fb38..2ce5be5b 100644
--- a/stacks/signal-processing/secrets.yaml
+++ b/stacks/signal-processing/secrets.yaml
@@ -5,4 +5,4 @@ metadata:
   name: timescale-admin-credentials
 stringData:
   username: admin
-  password: {{ postgresAdminPassword }}
+  password: "{{ postgresAdminPassword }}"