diff --git a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
index 09cc2bc983..96994a4d1d 100644
--- a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
@@ -16,7 +16,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 2.13.0
+      version: 2.14.0
       sourceRef:
         kind: HelmRepository
         name: external-secrets
diff --git a/scripts/tests/test-tenant-kro-pull-secret.sh b/scripts/tests/test-tenant-kro-pull-secret.sh
index 7f7eb32437..1bbf600daf 100755
--- a/scripts/tests/test-tenant-kro-pull-secret.sh
+++ b/scripts/tests/test-tenant-kro-pull-secret.sh
@@ -14,7 +14,7 @@ jq '.metadata.namespace="business-site" | .metadata.labels += {
   "kro.run/instance-group":"kro.run","kro.run/instance-version":"v1alpha1",
   "kro.run/instance-kind":"Tenant","kro.run/node-id":"ghcrAuth",
   "applyset.kubernetes.io/part-of":"fictional-tenant-applyset"}' "$work/template.json" >"$work/raw.json"
-# These are the structural defaults in the pinned ExternalSecrets 2.13.0 v1 CRD.
+# These are the structural defaults in the pinned ExternalSecrets 2.14.0 v1 CRD.
 jq '.spec.target.deletionPolicy="Retain" | .spec.target.template.mergePolicy="Replace"' "$work/raw.json" >"$work/defaulted.json"
 jq -nc --slurpfile raw "$work/raw.json" --slurpfile defaults "$work/defaulted.json" '
   def request($label;$object;$old;$actor;$operation;$expected):
diff --git a/scripts/tests/test-webapp-compiler.sh b/scripts/tests/test-webapp-compiler.sh
index 9e395f7319..3cae243619 100755
--- a/scripts/tests/test-webapp-compiler.sh
+++ b/scripts/tests/test-webapp-compiler.sh
@@ -29,15 +29,15 @@ fetch_schema() {
   actual_digest="$(shasum -a 256 "$output" | cut -d ' ' -f 1)"
   [[ "$actual_digest" == "$expected_digest" ]] || { echo 'FAIL: dependency schema checksum changed' >&2; exit 1; }
 }
-[[ "$(yq -er '.spec.chart.spec.version' "${root}/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml")" == 2.13.0 ]] || {
+[[ "$(yq -er '.spec.chart.spec.version' "${root}/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml")" == 2.14.0 ]] || {
   echo 'FAIL: review Tenant schema fixtures for the new External Secrets chart' >&2; exit 1;
 }
 fetch_schema 'https://raw.githubusercontent.com/fluxcd/source-controller/v1.9.6/config/crd/bases/source.toolkit.fluxcd.io_ocirepositories.yaml' \
   80c7c6e5c8de0764cc83acd4de5c74bea8e51186085304d22cecc5f2eb35500e "${work}/oci.yaml"
 fetch_schema 'https://raw.githubusercontent.com/fluxcd/kustomize-controller/v1.9.6/config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml' \
   da23ca0e6b4c80d3d26a91583137491e147ef4ef1e2208aece0d0af4ef851974 "${work}/kustomization.yaml"
-fetch_schema 'https://raw.githubusercontent.com/external-secrets/external-secrets/v2.13.0/deploy/crds/bundle.yaml' \
-  d4da9492a6906a3834bb1f5b7367575a29b5c43411017babc7a30728f465d1ba "${work}/external-secrets.yaml"
+fetch_schema 'https://raw.githubusercontent.com/external-secrets/external-secrets/v2.14.0/deploy/crds/bundle.yaml' \
+  0dd116eb3b2ae247e2d256662d5afa4d1f3cd37d34ad6580261b15acf55b3b0d "${work}/external-secrets.yaml"
 yq -o=json -I=0 '.' "${work}/external-secrets.yaml" | jq -se '
   [.[] | select(.kind == "CustomResourceDefinition" and .metadata.name == "externalsecrets.external-secrets.io")]
   | if length == 1 then .[0] else error("expected exactly one actual ExternalSecret schema") end