diff --git a/.github/actions/kind-e2e-setup/action.yml b/.github/actions/kind-e2e-setup/action.yml
index 97c058fe..d1dcd0f4 100644
--- a/.github/actions/kind-e2e-setup/action.yml
+++ b/.github/actions/kind-e2e-setup/action.yml
@@ -54,7 +54,7 @@ runs:
     - name: Install kind and helm
       shell: bash
       env:
-        HELM_VERSION: v3.17.3
+        HELM_VERSION: v3.21.4
       run: |
         set -euo pipefail
         mkdir -p ~/.cache/kind
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c4377fd4..0d02ee74 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -128,7 +128,7 @@ jobs:
         run: bash hack/test/demo_04_samples_kustomize_test.sh
       - name: Install Helm
         env:
-          HELM_VERSION: v3.17.3
+          HELM_VERSION: v3.21.4
         run: bash hack/install-helm.sh
       - name: Ensure yq is available
         run: |
@@ -279,7 +279,7 @@ jobs:
           version: 3.51.1
       - name: Install Helm
         env:
-          HELM_VERSION: v3.17.3
+          HELM_VERSION: v3.21.4
         run: bash hack/install-helm.sh
       - name: Install helm-unittest plugin
         run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.5.1
diff --git a/Taskfile.yml b/Taskfile.yml
index a5b88531..7a99a10f 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -26,7 +26,7 @@ vars:
   # renovate: datasource=github-releases depName=fe3dback/go-arch-lint
   GO_ARCH_LINT_VERSION: v1.15.0
   # renovate: datasource=github-releases depName=helm/helm
-  HELM_VERSION: v3.17.3
+  HELM_VERSION: v3.21.4
   # renovate: datasource=github-releases depName=norwoodj/helm-docs
   HELM_DOCS_VERSION: v1.14.2
   HELM_DOCS_BIN: "{{.BIN_DIR}}/helm-docs"
diff --git a/hack/install-helm.sh b/hack/install-helm.sh
index d5161c77..119265f5 100755
--- a/hack/install-helm.sh
+++ b/hack/install-helm.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # Install a pinned Helm 3 release with SHA256-verified tarball download.
 # Checksums from https://get.helm.sh/helm-${VERSION}-${OS}-${ARCH}.tar.gz.sha256
-# Usage: HELM_VERSION=v3.17.3 hack/install-helm.sh
+# Usage: HELM_VERSION=v3.21.4 hack/install-helm.sh
 set -euo pipefail
 
-VERSION="${HELM_VERSION:-v3.17.3}"
+VERSION="${HELM_VERSION:-v3.21.4}"
 
 OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
 ARCH="$(uname -m)"
diff --git a/renovate.json b/renovate.json
index 2c8c5ab4..0e40c1fa 100644
--- a/renovate.json
+++ b/renovate.json
@@ -110,6 +110,11 @@
     {
       "matchManagers": ["custom.regex"],
       "groupName": "pinned build tools"
+    },
+    {
+      "description": "Keep every Helm pin on one version. The azure/setup-helm input in release.yaml is seen by the github-actions manager while the annotated HELM_VERSION pins are seen by the custom manager, so without this they land in different groups and drift apart -- which is exactly how release.yaml reached v3.21.4 while CI stayed on v3.17.3. Both resolve to depName helm/helm.",
+      "matchDepNames": ["helm/helm"],
+      "groupName": "helm"
     }
   ]
 }