diff --git a/.github/workflows/agent-ci.yaml b/.github/workflows/agent-ci.yaml
index 10cc7f8..20e6d79 100644
--- a/.github/workflows/agent-ci.yaml
+++ b/.github/workflows/agent-ci.yaml
@@ -42,6 +42,20 @@ jobs:
           cache-dependency-path: agent/go.sum
       - name: Run tests
         run: make -C agent test
+      # `make test` first regenerates the CRDs, RBAC and deepcopy code, then
+      # runs `go fmt`. Whatever they change must be committed: an edited API
+      # type or RBAC marker, a controller-gen bump, or unformatted code.
+      - name: Check make test left the tree clean
+        if: ${{ !cancelled() }}
+        run: |
+          git diff
+          test -z "$(git status --porcelain)" || { git status --porcelain; exit 1; }
+      # Nothing else runs kustomize, so a kustomize bump would go untested.
+      - name: Build the manifests with kustomize
+        if: ${{ !cancelled() }}
+        run: |
+          make -C agent kustomize
+          agent/bin/kustomize build agent/config/default > /dev/null
 
   image:
     runs-on: ubuntu-latest
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b30b7a3..f0ed4b9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -59,8 +59,8 @@ make -C rpm rpm EL=9        # build both RPMs into rpm/_build/
 
 - **Generated code is committed.** After touching the API types or the RBAC
   markers, run `make -C agent manifests generate` and commit the result. CI
-  regenerates it before running the tests but does not fail on an uncommitted
-  diff, so a stale CRD reaches `main` unnoticed if you skip this.
+  regenerates it before running the tests, and fails if the result differs
+  from what is committed. A controller-gen bump needs the same step.
 - **Logging**: `logr` through controller-runtime, with the `logcheck` linter
   enforcing balanced key-value pairs. Log a value once, at the level that owns
   it: the reconciler logs outcomes, the packages it calls return errors.
diff --git a/agent/.custom-gcl.yml b/agent/.custom-gcl.yml
index d9ae33b..c9f7c02 100644
--- a/agent/.custom-gcl.yml
+++ b/agent/.custom-gcl.yml
@@ -3,7 +3,8 @@
 # with all the plugins listed below.
 #
 # See: https://golangci-lint.run/plugins/module-plugins/
-version: v2.12.2
+# renovate: datasource=github-releases depName=golangci/golangci-lint
+version: v2.14.0
 plugins:
   # logcheck validates structured logging calls and parameters (e.g., balanced key-value pairs)
   - module: "sigs.k8s.io/logtools"
diff --git a/agent/AGENTS.md b/agent/AGENTS.md
index 58377a3..a5c2390 100644
--- a/agent/AGENTS.md
+++ b/agent/AGENTS.md
@@ -44,8 +44,8 @@ Never hand-edit these; regenerate them instead:
   scaffolding
 
 They come from the markers in the Go sources, so change the marker, run
-`make manifests generate`, and commit the result. Nothing in CI catches a stale
-one; [../CONTRIBUTING.md](../CONTRIBUTING.md#agent-go) says why.
+`make manifests generate`, and commit the result. CI fails on a stale one, see
+[../CONTRIBUTING.md](../CONTRIBUTING.md#agent-go).
 
 Leave the `+kubebuilder:scaffold:*` comments alone. They are insertion points
 for the kubebuilder CLI, in `cmd/manager/main.go`, `internal/controller/suite_test.go`
diff --git a/agent/Makefile b/agent/Makefile
index 13ea8a7..0600df1 100644
--- a/agent/Makefile
+++ b/agent/Makefile
@@ -1,7 +1,9 @@
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
 # YEAR defines the year value used for substituting the YEAR placeholder in the boilerplate header.
-YEAR ?= $(shell date +%Y)
+# Fixed to the year the project started: the current year would rewrite
+# every generated header each January, and CI fails on a changed tree.
+YEAR ?= 2026
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -206,7 +208,9 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 
 ## Tool Versions
+# renovate: datasource=go depName=sigs.k8s.io/kustomize/kustomize/v5
 KUSTOMIZE_VERSION ?= v5.8.1
+# renovate: datasource=go depName=sigs.k8s.io/controller-tools
 CONTROLLER_TOOLS_VERSION ?= v0.21.0
 
 #ENVTEST_VERSION is the controller-runtime version to use for setup-envtest, derived from go.mod
@@ -219,7 +223,8 @@ ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; \
   [ -n "$$v" ] || { echo "Set ENVTEST_K8S_VERSION manually (k8s.io/api replace has no tag)" >&2; exit 1; }; \
   printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/')
 
-GOLANGCI_LINT_VERSION ?= v2.12.2
+# renovate: datasource=github-releases depName=golangci/golangci-lint
+GOLANGCI_LINT_VERSION ?= v2.14.0
 # The kind release also pins the Kubernetes version of the e2e cluster, through
 # its default node image.
 # renovate: datasource=github-releases depName=kubernetes-sigs/kind
diff --git a/agent/internal/puller/puller_test.go b/agent/internal/puller/puller_test.go
index 6604481..70bf30d 100644
--- a/agent/internal/puller/puller_test.go
+++ b/agent/internal/puller/puller_test.go
@@ -1132,8 +1132,7 @@ func TestRemotePullRejectsARegistrySignedByAnUnknownCA(t *testing.T) {
 	if !errors.Is(err, ErrPull) {
 		t.Fatalf("err = %v, want ErrPull", err)
 	}
-	var unknown x509.UnknownAuthorityError
-	if !errors.As(err, &unknown) {
+	if _, ok := errors.AsType[x509.UnknownAuthorityError](err); !ok {
 		t.Errorf("err = %v, want an unknown authority", err)
 	}
 }