diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2
new file mode 100644
index 00000000..e73734f7
--- /dev/null
+++ b/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2
@@ -0,0 +1,104 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app system-upgrade-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 2.3.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controllers:
+      main:
+        strategy: RollingUpdate
+        containers:
+          main:
+            image:
+              repository: docker.io/rancher/system-upgrade-controller
+              tag: v0.13.1
+            env:
+              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
+              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
+              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
+              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
+              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: docker.io/rancher/kubectl:v1.28.3
+              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
+              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
+              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
+              SYSTEM_UPGRADE_CONTROLLER_NAME: *app
+              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+        pod:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: ["ALL"]
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: node-role.kubernetes.io/control-plane
+                        operator: Exists
+          tolerations:
+            - { key: CriticalAddonsOnly, operator: Exists }
+            - { key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule }
+            - { key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule }
+            - { key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule }
+            - { key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute }
+    serviceAccount:
+      create: true
+      name: system-upgrade
+    service:
+      main:
+        enabled: false
+    persistence:
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      etc-ssl:
+        type: hostPath
+        hostPath: /etc/ssl
+        hostPathType: Directory
+        globalMounts:
+          - path: /etc/ssl
+            readOnly: true
+      etc-pki:
+        type: hostPath
+        hostPath: /etc/pki
+        hostPathType: Directory
+        globalMounts:
+          - path: /etc/pki
+            readOnly: true
+      etc-ca-certificates:
+        type: hostPath
+        hostPath: /etc/ca-certificates
+        hostPathType: Directory
+        globalMounts:
+          - path: /etc/ca-certificates
+            readOnly: true
diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2
index 5cd99097..e145962a 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2
@@ -4,19 +4,5 @@ kind: Kustomization
 resources:
   # renovate: datasource=github-releases depName=rancher/system-upgrade-controller
   - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.1/crd.yaml
-  - https://github.com/rancher/system-upgrade-controller?ref=v0.13.1
-images:
-  - name: rancher/system-upgrade-controller
-    newTag: v0.13.1
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/instance: system-upgrade-controller
-      app.kubernetes.io/name: system-upgrade-controller
-patches:
-  - patch: |
-      $patch: delete
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: system-upgrade
+  - helmrelease.yaml
+  - rbac.yaml
diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2
new file mode 100644
index 00000000..194a183c
--- /dev/null
+++ b/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2
@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: system-upgrade
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name:  system-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: system-upgrade
+    namespace: system-upgrade
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2
index 17cbc72b..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2
@@ -1,5 +1,4 @@
 ---
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
diff --git a/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2
index 2270ac3e..7b6ea1df 100644
--- a/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2
@@ -1,5 +1,4 @@
 ---
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
diff --git a/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2
index 5e098843..8ae52667 100644
--- a/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2
@@ -1,5 +1,4 @@
 ---
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: