diff --git a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
index bb66bead12..56cbbdc858 100644
--- a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
@@ -326,8 +326,11 @@ spec:
         # same-identity payload exactly one version ahead. Payload bytes stay
         # intact; creation-time identity is compared at metadata JSON precision.
         # Unproven or concurrently changed state is refused (#5419).
+        # Revision 11 also preserves newer SBOM metadata through the legacy
+        # storage codec and updates the executable dependencies. Its immutable
+        # publication and both shipped executables were verified under #5553.
         repository: ghcr.io/devantler-tech/platform-kubescape-storage
-        tag: "v0.0.297-sqlite-contention.10-f90df920acce50d6af7a3df0f95a00c02639a173@sha256:09e5868c8a20a958587ec57755c3e447fb25f3d46945e4f0da40788fd3f5ec96"
+        tag: "v0.0.297-sqlite-contention.11-ee02c6f9678b9332aed7af2bcc8c7a6686eb3552@sha256:cf539713a84613e00cd3cf9fa4c8c4f68eeb0719299fbb6ac91bca1d215e005b"
         pullPolicy: IfNotPresent
     # Hetzner CSI provisions a minimum 10Gi volume; match the PVC request
     # to avoid Helm upgrade failures from PVC shrink rejection.
diff --git a/scripts/tests/test-kubescape-storage-hotfix.sh b/scripts/tests/test-kubescape-storage-hotfix.sh
index 2ab3685915..685ebb248e 100755
--- a/scripts/tests/test-kubescape-storage-hotfix.sh
+++ b/scripts/tests/test-kubescape-storage-hotfix.sh
@@ -14,7 +14,7 @@ readonly dependency_security_patch_file="${root_dir}/k8s/bases/infrastructure/co
 readonly helm_release="${root_dir}/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml"
 readonly source_commit='b35788b68337134fc2514574cde1ba7f1225fd43'
 readonly image_repository='ghcr.io/devantler-tech/platform-kubescape-storage'
-readonly image_tag='v0.0.297-sqlite-contention.10-f90df920acce50d6af7a3df0f95a00c02639a173@sha256:09e5868c8a20a958587ec57755c3e447fb25f3d46945e4f0da40788fd3f5ec96'
+readonly image_tag='v0.0.297-sqlite-contention.11-ee02c6f9678b9332aed7af2bcc8c7a6686eb3552@sha256:cf539713a84613e00cd3cf9fa4c8c4f68eeb0719299fbb6ac91bca1d215e005b'
 
 fail() {
   printf 'FAIL: %s\n' "$1" >&2
diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt
index 9c05eabc53..3387fff3ad 100644
--- a/scripts/validate-eks-ci-role-policy/approved-surface.txt
+++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt
@@ -80,7 +80,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|tetragon 5781451a70a8dee38ed71
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|alertmanager be4e40e80964e37494dde9c1df0662a58b9b8976d2a57b9efed9c65aebdb9611
 
-helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape 6a352e2f5cb05f56d3558dcb9a11b1a56275b70c62b508f67e9c5366c79ce390
+helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape 67654a0c106caeec0ab230eaf8a845cb4f103e95d4daafd9b1b340859f1073f0
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|kyverno|kyverno b910afb7d7bcbb10e14430ec948732454c95e649bcdb71d16a3855fea07e7fbe