diff --git a/.github/actions/helm-generic/action.yml b/.github/actions/helm-generic/action.yml
index 233d019..cd8f92e 100644
--- a/.github/actions/helm-generic/action.yml
+++ b/.github/actions/helm-generic/action.yml
@@ -137,7 +137,7 @@ runs:
     - name: Install Helm
       uses: azure/setup-helm@v5
       with:
-        version: v3.21.0
+        version: v4.2.0
 
     - name: Install kubectl
       uses: azure/setup-kubectl@v5
diff --git a/.github/workflows/ci-helm.yaml b/.github/workflows/ci-helm.yaml
index 2e4c4ec..6358a63 100644
--- a/.github/workflows/ci-helm.yaml
+++ b/.github/workflows/ci-helm.yaml
@@ -196,7 +196,7 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@v5
         with:
-          version: v3.21.0
+          version: v4.2.0
 
       - name: Helm upgrade / install
         shell: bash
diff --git a/.github/workflows/generic-gateway-chart-cicd.yml b/.github/workflows/generic-gateway-chart-cicd.yml
index ad8125b..07d7829 100644
--- a/.github/workflows/generic-gateway-chart-cicd.yml
+++ b/.github/workflows/generic-gateway-chart-cicd.yml
@@ -16,7 +16,7 @@ on:
       helm-version:
         description: Helm version to use for lint/template/package
         required: false
-        default: "3.2.4"
+        default: "4.2.0"
         type: string
       version-prefix:
         description: Version prefix in major.minor format
@@ -82,7 +82,7 @@ on:
       helm-version:
         description: Helm version to use for lint/template/package
         required: false
-        default: "3.2.4"
+        default: "4.2.0"
         type: string
       version-prefix:
         description: Version prefix in major.minor format
diff --git a/.github/workflows/helm-deploy-values.yml b/.github/workflows/helm-deploy-values.yml
index 2065ede..673ddd5 100644
--- a/.github/workflows/helm-deploy-values.yml
+++ b/.github/workflows/helm-deploy-values.yml
@@ -64,7 +64,7 @@ on:
       helm-version:
         type: string
         required: false
-        default: v3.21.0
+        default: v4.2.0
 
       kubectl-version:
         type: string
diff --git a/AGENTS.md b/AGENTS.md
index 594b861..23987f3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -71,7 +71,7 @@ Composite actions are the smallest units of work. Reusable workflows orchestrate
 | `gradle/actions/setup-gradle` | `@v4` | Do NOT use `gradle/gradle-build-action` (archived). Do NOT upgrade to v5/v6: v5 requires runner ≥ 2.327.1; v6 has commercial caching license terms |
 
 **Pinned CLI binary versions (defaults in action inputs):**
-- Helm CLI: `v3.21.0`
+- Helm CLI: `v4.2.0`
 - kubectl CLI: `v1.33.0`
 
 ---
diff --git a/README.md b/README.md
index 519999f..76f2310 100644
--- a/README.md
+++ b/README.md
@@ -529,7 +529,7 @@ Deploys a Helm chart using a **values file** from the calling repository. Useful
 | `global-environment` | | `''` | Value for `global.environment` |
 | `ingress-host` | | `''` | Ingress hostname |
 | `ingress-tls-secret` | | `''` | TLS secret name |
-| `helm-version` | | `v3.21.0` | Helm CLI version |
+| `helm-version` | | `v4.2.0` | Helm CLI version |
 | `kubectl-version` | | `v1.33.0` | kubectl CLI version |
 
 **Required secret:** `kubeconfig`
@@ -689,7 +689,7 @@ Full CI/CD pipeline for developing a **Helm chart**: lint → template render 
 | `chart-path` | | `chart` | Path to chart directory |
 | `chartmuseum-url` | | `https://charts.sf9.io/api/charts` | ChartMuseum upload endpoint |
 | `version-prefix` | | `1.0` | Semver `major.minor` prefix |
-| `helm-version` | | `v3.21.0` | Helm CLI version |
+| `helm-version` | | `v4.2.0` | Helm CLI version |
 | `update-dependencies` | | `true` | Run `helm package --dependency-update` |
 
 **Required secrets:** `registry-username`, `registry-password`
@@ -852,7 +852,7 @@ When a `build` job must pass a file to a `deploy` job:
 
 | Tool | Pinned version |
 |---|---|
-| Helm CLI | `v3.21.0` |
+| Helm CLI | `v4.2.0` |
 | kubectl CLI | `v1.33.0` |
 | `actions/checkout` | `@v6` |
 | `actions/setup-node` | `@v6` |