diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile
index 981d7b369..47eabe143 100644
--- a/packages/system/kilo/Makefile
+++ b/packages/system/kilo/Makefile
@@ -4,6 +4,9 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	sha=$$(git ls-remote https://github.com/squat/kilo refs/heads/main | awk '{print $$1}') && \
 	sed -i "/ARG VERSION/ s|=.*|=$${sha}|g" images/kilo/Dockerfile
diff --git a/packages/system/kilo/images/kilo/Dockerfile b/packages/system/kilo/images/kilo/Dockerfile
index 101863f7c..e1d5f0094 100644
--- a/packages/system/kilo/images/kilo/Dockerfile
+++ b/packages/system/kilo/images/kilo/Dockerfile
@@ -1,7 +1,7 @@
 # Build the kg binary
 FROM --platform=$BUILDPLATFORM golang:1.25 AS builder
 
-ARG VERSION=fbce60d8033da073748f5b0d6ce0f1e216f03e7f
+ARG VERSION=944dff5745d747c06555a964c2137b9a986ff6ec
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -23,14 +23,14 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \
     -a -o kgctl ./cmd/kgctl
 
 # Download CNI plugins
-FROM alpine:3.23 AS cni
+FROM alpine:3.24 AS cni
 ARG TARGETARCH
-ARG CNI_PLUGINS_VERSION=v1.9.0
+ARG CNI_PLUGINS_VERSION=v1.9.1
 RUN apk add --no-cache curl && \
     curl -Lo cni.tar.gz https://github.com/containernetworking/plugins/releases/download/$CNI_PLUGINS_VERSION/cni-plugins-linux-$TARGETARCH-$CNI_PLUGINS_VERSION.tgz && \
     tar -xf cni.tar.gz
 
-FROM alpine:3.23
+FROM alpine:3.24
 RUN apk add --no-cache ipset iptables ip6tables graphviz font-noto
 COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/
 ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh /
diff --git a/packages/system/kilo/tests/kilo_test.yaml b/packages/system/kilo/tests/kilo_test.yaml
new file mode 100644
index 000000000..d12e3a4ef
--- /dev/null
+++ b/packages/system/kilo/tests/kilo_test.yaml
@@ -0,0 +1,66 @@
+suite: kilo DaemonSet image pin and mesh-arg wiring
+
+# Pins the surface this package owns on top of the vendored squat/kilo binary:
+#   - the kilo DaemonSet pulls the first-party image from the cozystack
+#     registry (repository is the load-bearing ref re-pinned by `make image`);
+#   - the default mesh args (location granularity, transit subnet, auto MTU,
+#     cni disabled, crosssubnet encapsulation) render as the kg binary expects;
+#   - meshGranularity plumbs through verbatim, including the `cross` value that
+#     the in-repo feat-add-cross-mesh-granularity.diff teaches the image to
+#     accept (the chart passes it straight to --mesh-granularity);
+#   - the cilium compatibility overlay adds --compatibility=cilium, and the
+#     default render carries no --compatibility arg.
+
+templates:
+  - templates/kilo.yaml
+
+tests:
+  - it: "DaemonSet pulls the first-party kilo image from the cozystack registry"
+    asserts:
+      - isKind:
+          of: DaemonSet
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: "^ghcr\\.io/cozystack/cozystack/kilo:"
+
+  - it: "default mesh args render as the kg binary expects"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--cni=false"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--encapsulate=crosssubnet"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--mesh-granularity=location"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--subnet=100.66.0.0/16"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--mtu=auto"
+
+  - it: "meshGranularity=cross plumbs through to the patched binary"
+    set:
+      kilo:
+        meshGranularity: cross
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--mesh-granularity=cross"
+
+  - it: "cilium compatibility overlay adds --compatibility=cilium"
+    set:
+      kilo:
+        compatibility: cilium
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--compatibility=cilium"
+
+  - it: "no --compatibility arg in the default render"
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: "--compatibility=cilium"
diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml
index 9645fba94..56dae259f 100644
--- a/packages/system/kilo/values.yaml
+++ b/packages/system/kilo/values.yaml
@@ -1,7 +1,7 @@
 kilo:
   image:
     pullPolicy: IfNotPresent
-    tag: latest@sha256:016d054fcbb31d77ecfc8a0e7ead9f8cc01fb2f5a12b619d4fb0b7d745414df0
+    tag: v1.5.0@sha256:fe837f428504f6c6e9e4582326a3bf9cd507a9cca58c975952f5cc0b34728f63
     repository: ghcr.io/cozystack/cozystack/kilo
   transitCIDR: 100.66.0.0/16
   meshGranularity: location