diff --git a/bootstrap/helmfile.d/00-crds.yaml b/bootstrap/helmfile.d/00-crds.yaml
index 793180a16..322e9cbf4 100644
--- a/bootstrap/helmfile.d/00-crds.yaml
+++ b/bootstrap/helmfile.d/00-crds.yaml
@@ -22,7 +22,7 @@ releases:
   - name: external-secrets
     namespace: external-secrets
     chart: oci://ghcr.io/external-secrets/charts/external-secrets
-    version: 0.20.2
+    version: 0.20.3
 
   - name: envoy-gateway
     namespace: network
diff --git a/kubernetes/apps/external-secrets/external-secrets/app/ocirepository.yaml b/kubernetes/apps/external-secrets/external-secrets/app/ocirepository.yaml
index 3760e2967..0fd82fce9 100644
--- a/kubernetes/apps/external-secrets/external-secrets/app/ocirepository.yaml
+++ b/kubernetes/apps/external-secrets/external-secrets/app/ocirepository.yaml
@@ -10,5 +10,5 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.20.2
+    tag: 0.20.3
   url: oci://ghcr.io/external-secrets/charts/external-secrets