diff --git a/.github/workflows/operator-release.yml b/.github/workflows/operator-release.yml
index ab6ed4c33..4c8b45f29 100644
--- a/.github/workflows/operator-release.yml
+++ b/.github/workflows/operator-release.yml
@@ -184,3 +184,34 @@ jobs:
           labels: |
             release
             automated
+
+  sync-gh-pages-version:
+    # Keeps gh-pages' docs version in sync with releases. Pushes directly
+    # (gh-pages has no branch protection) using secrets.PAT, which also
+    # triggers gh-pages to build and deploy the site.
+    runs-on: ubuntu-latest
+    needs: [prepare, release-helm]
+    if: needs.prepare.outputs.is_canonical == 'true'
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout gh-pages
+        uses: actions/checkout@v7
+        with:
+          ref: gh-pages
+          token: ${{ secrets.PAT }}
+      - name: Update docs version
+        run: |
+          TAG="${{ needs.prepare.outputs.tag }}"
+          CONFIG="config/_default/config.toml"
+          sed -i "s/^  latest_version = \"[^\"]*\"/  latest_version = \"${TAG}\"/" "$CONFIG"
+          sed -i "s/^  version = \"[^\"]*\"/  version = \"${TAG}\"/" "$CONFIG"
+          if git diff --quiet -- "$CONFIG"; then
+            echo "Docs version already up to date; nothing to push."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add "$CONFIG"
+          git commit -m "Update docs version to ${TAG}"
+          git push origin gh-pages
diff --git a/README.md b/README.md
index 2efb5939e..bdd9e05c3 100644
--- a/README.md
+++ b/README.md
@@ -91,7 +91,7 @@ spec:
     replicas: 1
     image:
         repository: ghcr.io/adobe/zookeeper-operator/zookeeper
-        tag: 3.8.4-0.2.15-adobe-20250923
+        tag: 3.8.4-0.2.15-adobe-20260423
     persistence:
         reclaimPolicy: Delete
 EOF
@@ -124,11 +124,9 @@ kubectl apply -f https://raw.githubusercontent.com/adobe/koperator/refs/heads/ma
 
 > 📦 **View available versions**: [ghcr.io/adobe/helm-charts/kafka-operator](https://github.com/adobe/koperator/pkgs/container/helm-charts%2Fkafka-operator/versions)
 
-```sh
-# Install the latest release
-helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator --namespace=kafka --create-namespace --skip-crds
+OCI registries have no floating "latest" tag, so `--version` is required (replace with your desired version, see available versions above):
 
-# Or install a specific version (replace with desired version)
+```sh
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator --version 0.28.0-adobe-20260622 --namespace=kafka --create-namespace --skip-crds
 ```
 
diff --git a/charts/kafka-operator/README.md b/charts/kafka-operator/README.md
index 7e64b0deb..10883dd9b 100644
--- a/charts/kafka-operator/README.md
+++ b/charts/kafka-operator/README.md
@@ -25,12 +25,9 @@ previous step - without it, Helm's own CRD install can conflict with the `kubect
 
 > 📦 **View available versions**: [ghcr.io/adobe/helm-charts/kafka-operator](https://github.com/adobe/koperator/pkgs/container/helm-charts%2Fkafka-operator/versions)
 
-```bash
-# Install the latest release
-helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --namespace=kafka --create-namespace --skip-crds
+OCI registries have no floating "latest" tag, so `--version` is required (see available versions above):
 
-# Or install a specific version
+```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
   --version 0.28.0-adobe-20260622 --namespace=kafka --create-namespace --skip-crds
 ```
@@ -38,20 +35,16 @@ helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
 To install the operator using an already installed cert-manager:
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
+  --version 0.28.0-adobe-20260622 \
   --set certManager.namespace=<your cert manager namespace> --namespace=kafka --create-namespace --skip-crds
 ```
 
 ## Upgrading the chart
 
 To upgrade the chart since the helm 3 limitation you have to set a value as well to keep your CRDs.
-If this value is not set your CRDs might be deleted.
+If this value is not set your CRDs might be deleted. `--version` is required, same as for install.
 
 ```bash
-# Upgrade to latest version
-helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --namespace=kafka
-
-# Upgrade to specific version
 helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
   --version 0.28.0-adobe-20260622 --namespace=kafka
 ```
diff --git a/charts/kafka-operator/README.md.gotmpl b/charts/kafka-operator/README.md.gotmpl
index 971bc1280..1518d1ddf 100644
--- a/charts/kafka-operator/README.md.gotmpl
+++ b/charts/kafka-operator/README.md.gotmpl
@@ -25,12 +25,9 @@ previous step - without it, Helm's own CRD install can conflict with the `kubect
 
 > 📦 **View available versions**: [ghcr.io/adobe/helm-charts/kafka-operator](https://github.com/adobe/koperator/pkgs/container/helm-charts%2Fkafka-operator/versions)
 
-```bash
-# Install the latest release
-helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --namespace=kafka --create-namespace --skip-crds
+OCI registries have no floating "latest" tag, so `--version` is required (see available versions above):
 
-# Or install a specific version
+```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
   --version 0.28.0-adobe-20260622 --namespace=kafka --create-namespace --skip-crds
 ```
@@ -38,20 +35,16 @@ helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
 To install the operator using an already installed cert-manager:
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
+  --version 0.28.0-adobe-20260622 \
   --set certManager.namespace=<your cert manager namespace> --namespace=kafka --create-namespace --skip-crds
 ```
 
 ## Upgrading the chart
 
 To upgrade the chart since the helm 3 limitation you have to set a value as well to keep your CRDs.
-If this value is not set your CRDs might be deleted.
+If this value is not set your CRDs might be deleted. `--version` is required, same as for install.
 
 ```bash
-# Upgrade to latest version
-helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --namespace=kafka
-
-# Upgrade to specific version
 helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
   --version 0.28.0-adobe-20260622 --namespace=kafka
 ```
diff --git a/renovate.json b/renovate.json
index e8a68f1ad..a0942e8da 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "forkProcessing": "enabled",
+  "baseBranchPatterns": ["master", "gh-pages"],
   "extends": [
     ":dependencyDashboard",
     ":ignoreUnstable",
@@ -19,7 +20,8 @@
       "customType": "regex",
       "managerFilePatterns": [
         "/(^|/)Makefile$/",
-        "/(^|/)Dockerfile$/"
+        "/(^|/)Dockerfile$/",
+        "/(^|/)\\.github/workflows/regenerate-crd-docs\\.yaml$/"
       ],
       "matchStrings": [
         "(?<depName>[A-Z][A-Z0-9_]*)_VERSION\\s*=\\s*(?<currentValue>[^\\s]+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s*depName=(?<packageName>[^\\s]+)(?:\\s*extractVersion=(?<extractVersion>[^\\s]+))?"
@@ -68,8 +70,9 @@
       "matchManagers": [
         "gomod"
       ],
+      "matchBaseBranches": ["master"],
       "enabled": false,
-      "description": "Disable Go module updates - handled by automated workflow: .github/workflows/update-go-deps.yml"
+      "description": "Disable Go module updates on master - handled by automated workflow: .github/workflows/update-go-deps.yml. gh-pages' go.mod is Hugo Modules (theme deps like docsy), not app code, so it stays enabled there."
     },
     {
       "matchCategories": [