diff --git a/README.md b/README.md
index f9a2615e..6ee97455 100644
--- a/README.md
+++ b/README.md
@@ -175,7 +175,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 ```yaml
 - name: Kafka performance gate
   id: gate
-  uses: bmscomp/kates@v1.36.0
+  uses: bmscomp/kates@v1.37.0
   with:
     api-url: ${{ vars.KATES_URL }}
     api-key: ${{ secrets.KATES_API_KEY }}
@@ -199,7 +199,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 
 Outputs: `run-id`, `grade`, and `passed` (`true` or `false`).
 
-The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.36.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
+The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.37.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
 
 ## Other clusters
 
diff --git a/charts/connect-cluster/Chart.yaml b/charts/connect-cluster/Chart.yaml
index fa1c90e4..87b26b8c 100644
--- a/charts/connect-cluster/Chart.yaml
+++ b/charts/connect-cluster/Chart.yaml
@@ -2,10 +2,9 @@ apiVersion: v2
 name: connect-cluster
 description: A Helm chart for deploying Strimzi Kafka Connect clusters
 type: application
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 2.1.25
+version: 2.1.26
 # Tracks the Kafka line the workers run, as mirror-maker2's does. The plugin
 # set is in the image; its pin is the kates.io/connect-image annotation.
 appVersion: "4.3.1"
@@ -32,6 +31,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed
       description: "The chart icon pointed at a file the repository does not have; it is now a Kates icon. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed
diff --git a/charts/connect-cluster/values.yaml b/charts/connect-cluster/values.yaml
index 630d59fa..32b570fd 100644
--- a/charts/connect-cluster/values.yaml
+++ b/charts/connect-cluster/values.yaml
@@ -55,7 +55,7 @@ imagePullPolicy: ""
 
 # -- Images the chart's own pods use
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # ── Workers ─────────────────────────────────────────────────────────────────
 # -- Number of worker replicas (seeded from autoscaling.minReplicas under an HPA)
diff --git a/charts/kafka-cluster/Chart.yaml b/charts/kafka-cluster/Chart.yaml
index 7c9c89a6..26f90b1f 100644
--- a/charts/kafka-cluster/Chart.yaml
+++ b/charts/kafka-cluster/Chart.yaml
@@ -2,11 +2,9 @@ apiVersion: v2
 name: kafka-cluster
 description: A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability
 type: application
-# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.36.0,
-# the tag the v1.36.0 release publishes; every chart that runs it pins the
-# same one.
-# Patch: the chart icon.
-version: 1.0.30
+# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.37.0,
+# the tag the v1.37.0 release publishes; every chart that runs it pins the same one.
+version: 1.0.31
 appVersion: "4.3.1"
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kafka-cluster.svg
 home: https://strimzi.io/
@@ -40,6 +38,8 @@ annotations:
   # newer; never lower it without removing the feature that set it.
   kates.io/kafka-floor: "4.2.0"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl and testImages.kafka move to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds them to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "The chart icon is now a Kates icon, served from this repository. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed
diff --git a/charts/kafka-cluster/values.yaml b/charts/kafka-cluster/values.yaml
index 7792e67d..0505b678 100644
--- a/charts/kafka-cluster/values.yaml
+++ b/charts/kafka-cluster/values.yaml
@@ -71,8 +71,8 @@ global:
 # -- Images of the Helm-test pods (tests.imageRegistry mirrors them). Pinned:
 # scripts/check-versions.sh keeps them aligned with the other charts.
 testImages:
-  kafka: "ghcr.io/bmscomp/kates-tester:1.36.0"
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kafka: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
   # -- Pull policy for test pods (empty: Kubernetes' default)
   pullPolicy: IfNotPresent
 
diff --git a/charts/kates-chaos/Chart.yaml b/charts/kates-chaos/Chart.yaml
index f50152f5..e683a4f5 100644
--- a/charts/kates-chaos/Chart.yaml
+++ b/charts/kates-chaos/Chart.yaml
@@ -4,10 +4,9 @@ name: kates-chaos
 # PSS restricted securityContext and resources by default, so an installer or
 # GameDay image that needs root stops starting; GameDay and the tests move to
 # kates-tester, which has the shell they need.
-# Patch: images.tester moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: images.tester moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 2.4.3
+version: 2.4.4
 # Tracks the LitmusChaos execution-plane version this chart deploys.
 appVersion: "3.28.0"
 description: Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring
@@ -32,6 +31,8 @@ annotations:
   artifacthub.io/category: skip-prediction
   artifacthub.io/prerelease: "false"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "images.tester moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added
       description: "A Kates chart icon."
     - kind: changed
diff --git a/charts/kates-chaos/README.md b/charts/kates-chaos/README.md
index 3a3158b2..6c4a3ed4 100644
--- a/charts/kates-chaos/README.md
+++ b/charts/kates-chaos/README.md
@@ -74,7 +74,7 @@ helm upgrade --install chaos ./kates-chaos \
 | `images.kubectl.repository` | Image for the installer Job | `registry.k8s.io/kubectl` |
 | `images.kubectl.tag` | kubectl image tag | `v1.33.0` |
 | `images.kubectl.digest` | Pin by digest (wins over tag) | `""` |
-| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.36.0` |
+| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.37.0` |
 | `images.goRunner.repository` | Default runtime for experiments | `litmuschaos/go-runner` |
 | `images.goRunner.tag` | go-runner image tag | `3.28.0` |
 
diff --git a/charts/kates-chaos/values.yaml b/charts/kates-chaos/values.yaml
index bd408e7e..17f6e2b2 100644
--- a/charts/kates-chaos/values.yaml
+++ b/charts/kates-chaos/values.yaml
@@ -48,7 +48,7 @@ images:
   # tester — kates-tester, for GameDay and the Helm tests, whose scripts need
   # the shell the kubectl image lacks. Runs as uid 1000. Pinned to the kates
   # appVersion, like every chart's test image (scripts/check-versions.sh).
-  tester: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  tester: "ghcr.io/bmscomp/kates-tester:1.37.0"
   # go-runner — default runtime for ChaosExperiment definitions
   goRunner:
     repository: litmuschaos/go-runner
diff --git a/charts/kates-platform/Chart.yaml b/charts/kates-platform/Chart.yaml
index 1a610a46..8fb6ae2a 100644
--- a/charts/kates-platform/Chart.yaml
+++ b/charts/kates-platform/Chart.yaml
@@ -3,11 +3,9 @@ name: kates-platform
 description: Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kates-platform.svg
 type: application
-# Patch: the umbrella packs the subcharts the v1.36.0 release pins: kates
-# 0.15.7, kafka-cluster 1.0.29, connect-cluster 2.1.24, mirror-maker2 0.11.24.
-# Patch: the chart icon; the subcharts it packs change only in theirs.
-# Patch: packs kates 0.15.9.
-version: 0.8.24
+# Patch: the umbrella packs the subcharts the v1.37.0 release pins: kates
+# 0.15.10, kafka-cluster 1.0.31, connect-cluster 2.1.26, mirror-maker2 0.11.26.
+version: 0.8.25
 appVersion: "1.0.0"
 keywords:
   - kafka
@@ -44,6 +42,8 @@ dependencies:
     condition: connect-cluster.enabled
 annotations:
   artifacthub.io/changes: |
+    - kind: changed
+      description: "The umbrella moves with the v1.37.0 release: it packs kates 0.15.10, kafka-cluster 1.0.31, connect-cluster 2.1.26 and mirror-maker2 0.11.26 as they are on disk. Templates are unchanged."
     - kind: fixed
       description: "Packs kates 0.15.9, whose Kafka-namespace Role carries its podmonitors rule only where the PodMonitor API exists."
     - kind: added
diff --git a/charts/kates/Chart.yaml b/charts/kates/Chart.yaml
index 890dcd14..296f4bef 100644
--- a/charts/kates/Chart.yaml
+++ b/charts/kates/Chart.yaml
@@ -2,16 +2,14 @@ apiVersion: v2
 name: kates
 description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
-# Patch: appVersion and the image tag move to 1.36.0, the tag the v1.36.0
+# Patch: appVersion and the image tag move to 1.37.0, the tag the v1.37.0
 # release publishes.
-# Patch: the chart icon.
-# Patch: the Kafka-namespace Role's PodMonitor rule follows the cluster.
-version: 0.15.9
+version: 0.15.10
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
 # image.tag in values.yaml pinned to that release.
-appVersion: "1.36.0"
+appVersion: "1.37.0"
 keywords:
   - kafka
   - testing
@@ -30,6 +28,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "appVersion 1.37.0 and the image tag move to 1.37.0. The image takes #595 (a PodMonitor CRD that is not there, answered with a 403, no longer counts as a refused read in compliance or topology) and the zstd-jni bump #592; the release also ships the CLI fixes #589, #591, #595 and #596."
     - kind: fixed
       description: "With rbac.scope=namespace the Kafka-namespace Role carries its podmonitors rule only where the PodMonitor API exists, so a namespace admin can create it on a cluster without the Prometheus operator. helm template asks no cluster: pass --api-versions monitoring.coreos.com/v1/PodMonitor to render the rule for one that has it"
     - kind: fixed
diff --git a/charts/kates/README.md b/charts/kates/README.md
index b57dd3ce..66a16897 100644
--- a/charts/kates/README.md
+++ b/charts/kates/README.md
@@ -33,7 +33,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | Parameter | Default | Description |
 |-----------|---------|-------------|
 | `image.repository` | `ghcr.io/bmscomp/kates` | Container image name |
-| `image.tag` | `1.36.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
+| `image.tag` | `1.37.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
 | `image.pullPolicy` | `IfNotPresent` | Image pull policy |
 | `global.imageRegistry` | `""` | Prepended, with a slash, to every image the chart renders: the API, PostgreSQL, the init container, the jobs, the helm test pods and `chaos.stressImage` |
 | `imagePullSecrets`, `global.imagePullSecrets` | `[]` | Pull secrets, both lists, on every pod the chart renders. An entry is a Secret name (`regcred`) or `{name: regcred}` |
diff --git a/charts/kates/values-native.yaml b/charts/kates/values-native.yaml
index 31867455..d4b44e08 100644
--- a/charts/kates/values-native.yaml
+++ b/charts/kates/values-native.yaml
@@ -23,7 +23,7 @@
 
 image:
   # Published as <appVersion>-native alongside the JVM tag.
-  tag: "1.36.0-native"
+  tag: "1.37.0-native"
 
 # Not read by a native image — see above.
 jvm:
diff --git a/charts/kates/values.yaml b/charts/kates/values.yaml
index df7ce61c..94453340 100644
--- a/charts/kates/values.yaml
+++ b/charts/kates/values.yaml
@@ -29,7 +29,7 @@ image:
   repository: ghcr.io/bmscomp/kates
   # -- Image tag. Must be the release that carries the non-blocking health
   # endpoints the probe defaults below depend on (>= 1.22.0).
-  tag: "1.36.0"
+  tag: "1.37.0"
   # -- Image pull policy
   pullPolicy: IfNotPresent
 
diff --git a/charts/mirror-maker2/Chart.yaml b/charts/mirror-maker2/Chart.yaml
index c2eb3a42..ffbf6006 100644
--- a/charts/mirror-maker2/Chart.yaml
+++ b/charts/mirror-maker2/Chart.yaml
@@ -13,10 +13,9 @@ type: application
 # REMOVED. 0.10.0 froze them into the generated board and documented them as
 # inert, which left two keys that accept a number and ignore it; a release
 # setting either is now refused with the constant to edit named.
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 0.11.25
+version: 0.11.26
 # Tracks the Kafka line the MM2 Connect workers run (STRIMZI_KAFKA_VERSION).
 appVersion: "4.3.1"
 kubeVersion: ">=1.27.0-0"
@@ -43,6 +42,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed
       description: "The chart icon pointed at a file the repository does not have; it is now a Kates icon. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed
diff --git a/charts/mirror-maker2/values.yaml b/charts/mirror-maker2/values.yaml
index 93c78f34..5afd962c 100644
--- a/charts/mirror-maker2/values.yaml
+++ b/charts/mirror-maker2/values.yaml
@@ -35,7 +35,7 @@ global:
 
 # -- Images used by the Helm test pods
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # -- Number of MM2 (Connect) worker replicas
 replicas: 3
diff --git a/charts/strimzi-operator/Chart.yaml b/charts/strimzi-operator/Chart.yaml
index ca7ee3ae..ea51f6b5 100644
--- a/charts/strimzi-operator/Chart.yaml
+++ b/charts/strimzi-operator/Chart.yaml
@@ -3,10 +3,9 @@ name: strimzi-operator
 # Minor: the operator runs Strimzi's restricted pod security provider by
 # default, which rolls every Kafka pod it manages once and refuses a Kaniko
 # Connect build; the Helm tests get resources, and podLabels is new.
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 0.4.16
+version: 0.4.17
 # Tracks the Strimzi operator version this chart deploys. The CLI rewrites this
 # (and the dependency version) in a generated copy when another version is
 # selected; the repository copy is the pin.
@@ -34,6 +33,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added
       description: "A Kates chart icon."
     - kind: changed
diff --git a/charts/strimzi-operator/README.md b/charts/strimzi-operator/README.md
index 148bf335..04994c64 100644
--- a/charts/strimzi-operator/README.md
+++ b/charts/strimzi-operator/README.md
@@ -71,7 +71,7 @@ kubectl get deploy strimzi-cluster-operator -n strimzi-operator \
 | Key | Default | Description |
 |-----|---------|-------------|
 | `strimziVersion` | `1.2.0` | Builds the CRD bundle URL. Must equal `Chart.yaml` `appVersion` + dependency version. |
-| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.36.0` | Image for the CRD hook Job and Helm tests |
+| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.37.0` | Image for the CRD hook Job and Helm tests |
 | `crdUpgrade.enabled` | `true` | Apply CRDs via the pre-install/pre-upgrade hook |
 | `crdUpgrade.url` | `""` | Override the bundle URL (empty = derive from `strimziVersion`). Use an internal mirror when airgapped. |
 | `crdUpgrade.backoffLimit` | `3` | Job retries before the install/upgrade aborts |
diff --git a/charts/strimzi-operator/values.yaml b/charts/strimzi-operator/values.yaml
index df9340d8..5bef82dc 100644
--- a/charts/strimzi-operator/values.yaml
+++ b/charts/strimzi-operator/values.yaml
@@ -49,7 +49,7 @@ strimziVersion: "1.2.0"
 # tests). The operator's own image comes from the subchart.
 testImages:
   # -- kubectl image used by the CRD-upgrade hook Job and the Helm tests
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # ── Helm tests ───────────────────────────────────────────────────────────────
 tests:
diff --git a/config/litmus/experiments/consumer-latency-probe.yaml b/config/litmus/experiments/consumer-latency-probe.yaml
index 9b73b578..081f6732 100644
--- a/config/litmus/experiments/consumer-latency-probe.yaml
+++ b/config/litmus/experiments/consumer-latency-probe.yaml
@@ -83,7 +83,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # Consumer latency monitoring ConfigMap
diff --git a/config/litmus/experiments/isr-health-probe.yaml b/config/litmus/experiments/isr-health-probe.yaml
index 81d4d5f7..3a4661f0 100644
--- a/config/litmus/experiments/isr-health-probe.yaml
+++ b/config/litmus/experiments/isr-health-probe.yaml
@@ -56,7 +56,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
           
           # Min ISR check - ensure partitions can still accept writes
@@ -88,7 +88,7 @@ spec:
                 criteria: "<="
                 value: "5"  # Allow up to 5 unavailable during chaos
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # ISR health monitoring ConfigMap
diff --git a/config/litmus/experiments/kafka-chaos-cronjob.yaml b/config/litmus/experiments/kafka-chaos-cronjob.yaml
index 9d8b9dfc..2d3d3989 100644
--- a/config/litmus/experiments/kafka-chaos-cronjob.yaml
+++ b/config/litmus/experiments/kafka-chaos-cronjob.yaml
@@ -58,7 +58,7 @@ spec:
       # Pre-flight check
       - name: preflight-check
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -96,7 +96,7 @@ spec:
             - name: experiment
             - name: duration
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -142,7 +142,7 @@ spec:
       # Verify cluster recovery
       - name: verify-cluster
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
diff --git a/config/litmus/experiments/kafka-gameday-workflow.yaml b/config/litmus/experiments/kafka-gameday-workflow.yaml
index 1395069b..d9e13b38 100644
--- a/config/litmus/experiments/kafka-gameday-workflow.yaml
+++ b/config/litmus/experiments/kafka-gameday-workflow.yaml
@@ -192,7 +192,7 @@ spec:
           - name: experiment-type
           - name: extra-env
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -255,7 +255,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -300,7 +300,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -333,7 +333,7 @@ spec:
     # Final report
     - name: chaos-report
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
diff --git a/config/litmus/experiments/kates-chaos-integration-job.yaml b/config/litmus/experiments/kates-chaos-integration-job.yaml
index 8b1b77fb..0ea840b2 100644
--- a/config/litmus/experiments/kates-chaos-integration-job.yaml
+++ b/config/litmus/experiments/kates-chaos-integration-job.yaml
@@ -18,7 +18,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: chaos-runner
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           env:
             - name: KATES_API_URL
diff --git a/config/litmus/experiments/producer-throughput-probe.yaml b/config/litmus/experiments/producer-throughput-probe.yaml
index ccef2227..188b3c33 100644
--- a/config/litmus/experiments/producer-throughput-probe.yaml
+++ b/config/litmus/experiments/producer-throughput-probe.yaml
@@ -45,7 +45,7 @@ spec:
                 criteria: ">="
                 value: "10.0"  # Minimum 10 records/sec
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # Standalone producer throughput ConfigMap for reuse
diff --git a/docs/book/14-recipes.md b/docs/book/14-recipes.md
index 0a53a358..da4639c8 100644
--- a/docs/book/14-recipes.md
+++ b/docs/book/14-recipes.md
@@ -710,7 +710,7 @@ jobs:
   kafka-gates:
     runs-on: ubuntu-latest
     env:
-      KATES_VERSION: v1.36.0
+      KATES_VERSION: v1.37.0
       KATES_NAMESPACE: team
       KATES_URL: http://localhost:8080
       KATES_API_KEY: ${{ secrets.KATES_API_KEY }}
diff --git a/docs/book/appendix-d-versions.md b/docs/book/appendix-d-versions.md
index 416df05a..e66bb6a7 100644
--- a/docs/book/appendix-d-versions.md
+++ b/docs/book/appendix-d-versions.md
@@ -16,18 +16,18 @@ Every version the platform pins, in one place. This table is generated from the
 | Go (CLI) | 1.26.0 | `cli/go.mod` |
 | `apicurio-registry` chart | 0.5.1 (app 3.3.0) | `charts/apicurio-registry/Chart.yaml` |
 | `cdc-postgresql` chart | 0.3.1 (app 16.15) | `charts/cdc-postgresql/Chart.yaml` |
-| `connect-cluster` chart | 2.1.25 (app 4.3.1) | `charts/connect-cluster/Chart.yaml` |
+| `connect-cluster` chart | 2.1.26 (app 4.3.1) | `charts/connect-cluster/Chart.yaml` |
 | `headlamp` chart | 0.2.3 (app 0.40.1) | `charts/headlamp/Chart.yaml` |
-| `kafka-cluster` chart | 1.0.30 (app 4.3.1) | `charts/kafka-cluster/Chart.yaml` |
+| `kafka-cluster` chart | 1.0.31 (app 4.3.1) | `charts/kafka-cluster/Chart.yaml` |
 | `kafka-common` chart | 0.1.3 (library) | `charts/kafka-common/Chart.yaml` |
 | `kafka-ui` chart | 0.3.4 (app v1.5.0) | `charts/kafka-ui/Chart.yaml` |
-| `kates-chaos` chart | 2.4.3 (app 3.28.0) | `charts/kates-chaos/Chart.yaml` |
-| `kates-platform` chart | 0.8.24 (app 1.0.0) | `charts/kates-platform/Chart.yaml` |
-| `kates` chart | 0.15.9 (app 1.36.0) | `charts/kates/Chart.yaml` |
+| `kates-chaos` chart | 2.4.4 (app 3.28.0) | `charts/kates-chaos/Chart.yaml` |
+| `kates-platform` chart | 0.8.25 (app 1.0.0) | `charts/kates-platform/Chart.yaml` |
+| `kates` chart | 0.15.10 (app 1.37.0) | `charts/kates/Chart.yaml` |
 | `legacy-kafka` chart | 0.2.2 (app 3.9.1) | `charts/legacy-kafka/Chart.yaml` |
-| `mirror-maker2` chart | 0.11.25 (app 4.3.1) | `charts/mirror-maker2/Chart.yaml` |
+| `mirror-maker2` chart | 0.11.26 (app 4.3.1) | `charts/mirror-maker2/Chart.yaml` |
 | `monitoring` chart | 1.8.1 (app 82.4.3) | `charts/monitoring/Chart.yaml` |
-| `strimzi-operator` chart | 0.4.16 (app 1.2.0) | `charts/strimzi-operator/Chart.yaml` |
+| `strimzi-operator` chart | 0.4.17 (app 1.2.0) | `charts/strimzi-operator/Chart.yaml` |
 | `velero` chart | 11.3.6 (app 1.17.1) | `charts/velero/Chart.yaml` |
 <!-- version-matrix:end -->
 
diff --git a/docs/kafka-cluster-runbook.md b/docs/kafka-cluster-runbook.md
index 3fb99872..54903316 100644
--- a/docs/kafka-cluster-runbook.md
+++ b/docs/kafka-cluster-runbook.md
@@ -10,7 +10,7 @@ kubectl -n $NS get kafka $CLUSTER -o jsonpath='{range .status.conditions[*]}{.ty
 kubectl -n $NS get kafkanodepools,pods -l strimzi.io/cluster=$CLUSTER
 # A client shell with the platform's backend credentials:
 kubectl -n $NS run kcat --rm -it --restart=Never --labels kates.io/test-pod=true \
-  --image=ghcr.io/bmscomp/kates-tester:1.36.0 -- bash
+  --image=ghcr.io/bmscomp/kates-tester:1.37.0 -- bash
 ```
 
 Inside that shell, `/opt/kafka/bin/kafka-topics.sh --bootstrap-server $CLUSTER-kafka-bootstrap:9092 --command-config client.properties …` answers most partition questions; `kafka-metadata-quorum.sh … describe --status` answers quorum questions.
diff --git a/docs/registry/kates-tester.md b/docs/registry/kates-tester.md
index 9476d6d7..a885bc1f 100644
--- a/docs/registry/kates-tester.md
+++ b/docs/registry/kates-tester.md
@@ -98,8 +98,8 @@ Override it like any other value:
 
 ```yaml
 testImages:
-  kubectl: ghcr.io/bmscomp/kates-tester:1.36.0
-  kafka:   ghcr.io/bmscomp/kates-tester:1.36.0
+  kubectl: ghcr.io/bmscomp/kates-tester:1.37.0
+  kafka:   ghcr.io/bmscomp/kates-tester:1.37.0
 ```
 
 ---
@@ -155,7 +155,7 @@ docker run --rm -it -v "$HOME/.kube:/home/kates/.kube:ro" \
 
 | Tag | Meaning |
 |---|---|
-| `1.36.0` | Release version — what the charts pin |
+| `1.37.0` | Release version — what the charts pin |
 | `latest` | Latest default-branch build |
 | `sha-<short-sha>` | Exact commit |
 
diff --git a/docs/registry/kates.md b/docs/registry/kates.md
index 728c6e9e..74661338 100644
--- a/docs/registry/kates.md
+++ b/docs/registry/kates.md
@@ -43,8 +43,8 @@ unhealthy on `/api/health` — which is expected, not a bug. See
 
 | Tag pattern | What it is |
 |---|---|
-| `1.36.0`, `1.36`, `1` | JVM build — Eclipse Temurin 21 JRE |
-| `1.36.0-native`, … | GraalVM native build — ahead-of-time compiled, UBI 9 minimal |
+| `1.37.0`, `1.37`, `1` | JVM build — Eclipse Temurin 21 JRE |
+| `1.37.0-native`, … | GraalVM native build — ahead-of-time compiled, UBI 9 minimal |
 | `latest` | Latest default-branch build (JVM) |
 | `<short-sha>` | Exact commit |
 
@@ -54,7 +54,7 @@ are signed with [cosign](https://docs.sigstore.dev/).
 
 ### Which variant should you run?
 
-|  | JVM (`1.36.0`) | Native (`1.36.0-native`) |
+|  | JVM (`1.37.0`) | Native (`1.37.0-native`) |
 |---|---|---|
 | Start-up | Seconds | Milliseconds |
 | Memory floor | Higher | Substantially lower |
@@ -68,7 +68,7 @@ it, so the chart's `jvm.options` are silently inert. Its heap comes from the def
 chart's `containerArgs`) or by passing arguments to `docker run`:
 
 ```
-docker run --rm ghcr.io/bmscomp/kates:1.36.0-native -XX:MaximumHeapSizePercent=50
+docker run --rm ghcr.io/bmscomp/kates:1.37.0-native -XX:MaximumHeapSizePercent=50
 ```
 
 Rule of thumb: **JVM for sustained benchmarking**, where JIT warm-up pays for itself over a
diff --git a/kates/k8s/deployment.yaml b/kates/k8s/deployment.yaml
index 4d05f5cc..4ef695a0 100644
--- a/kates/k8s/deployment.yaml
+++ b/kates/k8s/deployment.yaml
@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: kates
-        image: ghcr.io/bmscomp/kates:1.36.0
+        image: ghcr.io/bmscomp/kates:1.37.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/server.json b/server.json
index 14d0a0d6..c79675a0 100644
--- a/server.json
+++ b/server.json
@@ -3,7 +3,7 @@
   "name": "io.github.bmscomp/kates",
   "title": "Kates MCP Server",
   "description": "Read-only Model Context Protocol (MCP) server for Apache Kafka cluster diagnostics, benchmark run analysis, chaos dry-run previews, and security posture audits.",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "websiteUrl": "https://bmscomp.github.io/kates/",
   "repository": {
     "url": "https://github.com/bmscomp/kates",
@@ -13,8 +13,8 @@
   "packages": [
     {
       "registryType": "mcpb",
-      "identifier": "https://github.com/bmscomp/kates/releases/download/v1.36.0/kates-linux-amd64.tar.gz",
-      "version": "1.36.0",
+      "identifier": "https://github.com/bmscomp/kates/releases/download/v1.37.0/kates-linux-amd64.tar.gz",
+      "version": "1.37.0",
       "transport": {
         "type": "stdio"
       },