diff --git a/packages/system/ouroboros/Makefile b/packages/system/ouroboros/Makefile
index 92b4ad39a..973215192 100644
--- a/packages/system/ouroboros/Makefile
+++ b/packages/system/ouroboros/Makefile
@@ -26,8 +26,8 @@ include ../../../hack/package.mk
 # and update both lines below; resolve the new image digest with
 #   crane digest ghcr.io/lexfrei/ouroboros:<new-tag>
 # and update values.yaml.
-OUROBOROS_CHART_VERSION ?= 0.7.2
-OUROBOROS_CHART_DIGEST ?= sha256:c67315551196a766aeb97cee6065083a5f4d78b67ab0377e25257e61d4615a43
+OUROBOROS_CHART_VERSION ?= 0.8.0
+OUROBOROS_CHART_DIGEST ?= sha256:b57255ef65a8eace361bf0e4eb93637e6a45315bc7744746b2e16ffa5bdd3744
 
 test:
 	helm unittest .
diff --git a/packages/system/ouroboros/charts/ouroboros/Chart.yaml b/packages/system/ouroboros/charts/ouroboros/Chart.yaml
index 5a5a204fa..ec8b5f6ee 100644
--- a/packages/system/ouroboros/charts/ouroboros/Chart.yaml
+++ b/packages/system/ouroboros/charts/ouroboros/Chart.yaml
@@ -2,7 +2,7 @@ annotations:
   artifacthub.io/category: networking
   artifacthub.io/license: BSD-3-Clause
 apiVersion: v2
-appVersion: 0.7.2
+appVersion: 0.8.0
 description: In-cluster controller + TCP proxy that fixes hairpin-NAT for Ingress
   controllers behind PROXY-protocol
 home: https://github.com/lexfrei/ouroboros
@@ -22,4 +22,4 @@ name: ouroboros
 sources:
 - https://github.com/lexfrei/ouroboros
 type: application
-version: 0.7.2
+version: 0.8.0
diff --git a/packages/system/ouroboros/charts/ouroboros/values.yaml b/packages/system/ouroboros/charts/ouroboros/values.yaml
index bc7e8b762..4da32acc2 100644
--- a/packages/system/ouroboros/charts/ouroboros/values.yaml
+++ b/packages/system/ouroboros/charts/ouroboros/values.yaml
@@ -105,8 +105,13 @@ controller:
     # alpine-based kubectl: needs a shell so the wrapper script can run.
     # rancher/kubectl is FROM scratch and StartErrors without /bin/sh.
     # alpine/kubectl is multi-arch and busybox-derived (sh + sed + kubectl).
-    repository: alpine/kubectl
-    # renovate: datasource=docker depName=alpine/kubectl
+    # Pulled via mirror.gcr.io (Google's read-only mirror for a curated set of
+    # popular Docker Hub images) to sidestep anonymous Docker Hub rate-limits on
+    # shared CI/runner IP ranges. alpine/kubectl is on the mirror's curated
+    # list; very recently cut tags may take a short window to propagate, so a
+    # Renovate-cut bump to a brand-new tag may temporarily render an image
+    # reference that 404s on pull until Google's mirror picks it up.
+    repository: mirror.gcr.io/alpine/kubectl
     tag: "1.36.0"
     pullPolicy: IfNotPresent
   # -- Informer resync period. Doubles as the worst-case event-to-reconcile
@@ -230,8 +235,13 @@ externalDns:
     # rancher/kubectl is FROM scratch with no /bin/sh — the wrapper script
     # would StartError immediately. alpine/kubectl is multi-arch and has
     # /bin/sh + kubectl + grep, which is everything the hook needs.
-    repository: alpine/kubectl
-    # renovate: datasource=docker depName=alpine/kubectl
+    # Pulled via mirror.gcr.io (Google's read-only mirror for a curated set of
+    # popular Docker Hub images) to sidestep anonymous Docker Hub rate-limits on
+    # shared CI/runner IP ranges. alpine/kubectl is on the mirror's curated
+    # list; very recently cut tags may take a short window to propagate, so a
+    # Renovate-cut bump to a brand-new tag may temporarily render an image
+    # reference that 404s on pull until Google's mirror picks it up.
+    repository: mirror.gcr.io/alpine/kubectl
     tag: "1.36.0"
     pullPolicy: IfNotPresent
 
diff --git a/packages/system/ouroboros/tests/cozystack_overrides_test.yaml b/packages/system/ouroboros/tests/cozystack_overrides_test.yaml
index 5fcf79dec..a015f9528 100644
--- a/packages/system/ouroboros/tests/cozystack_overrides_test.yaml
+++ b/packages/system/ouroboros/tests/cozystack_overrides_test.yaml
@@ -40,4 +40,4 @@ tests:
       # a Makefile bump that forgets to bump the tag (or vice versa).
       - equal:
           path: spec.template.spec.containers[0].image
-          value: ghcr.io/lexfrei/ouroboros:0.7.2@sha256:1a8479b42ed34640752df2bfe0e9ccf052448c6849826c24cab4c30e10d76393
+          value: ghcr.io/lexfrei/ouroboros:0.8.0@sha256:9fe97093056d0bd05db667831a2a6270087ee648634d594e104c2d73f8aaa8ad
diff --git a/packages/system/ouroboros/values.yaml b/packages/system/ouroboros/values.yaml
index 0182d2893..662f6d6ff 100644
--- a/packages/system/ouroboros/values.yaml
+++ b/packages/system/ouroboros/values.yaml
@@ -6,7 +6,7 @@ ouroboros:
     # Air-gapped operators must mirror both this image and the OCI chart
     # at oci://ghcr.io/lexfrei/charts/ouroboros separately. Bump the tag
     # here together with OUROBOROS_CHART_VERSION in the Makefile.
-    tag: 0.7.2@sha256:1a8479b42ed34640752df2bfe0e9ccf052448c6849826c24cab4c30e10d76393
+    tag: 0.8.0@sha256:9fe97093056d0bd05db667831a2a6270087ee648634d594e104c2d73f8aaa8ad
   controller:
     # Host scenario default: mutate the live kube-system/coredns Corefile
     # directly. The host CoreDNS on cozystack is Talos-managed and its