diff --git a/packages/core/platform/sources/velero.yaml b/packages/core/platform/sources/velero.yaml
index 2374e8473..acfb4d2bd 100644
--- a/packages/core/platform/sources/velero.yaml
+++ b/packages/core/platform/sources/velero.yaml
@@ -21,3 +21,4 @@ spec:
         privileged: true
         namespace: cozy-velero
         releaseName: velero
+        upgradeCRDs: CreateReplace
diff --git a/packages/core/platform/tests/sources_velero_crds_test.yaml b/packages/core/platform/tests/sources_velero_crds_test.yaml
new file mode 100644
index 000000000..a48ad53c8
--- /dev/null
+++ b/packages/core/platform/tests/sources_velero_crds_test.yaml
@@ -0,0 +1,22 @@
+suite: velero applies CRD updates on upgrade
+# velero evolves its CRD schema between versions (v1.18 adds the Queued and
+# ReadyToStart backup phases). Helm never upgrades CRDs shipped in crds/, and
+# the velero package disables the chart's upgrade-crds Job, so the PackageSource
+# must opt into CreateReplace; without it the server binary upgrades while the
+# live CRDs stay at first-install state, the apiserver rejects the new phases,
+# and backups sit in New while the HelmRelease stays green. Pin the policy so an
+# upgrade cannot silently regress.
+templates:
+  - templates/sources.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: velero PackageSource sets upgradeCRDs to CreateReplace
+    documentSelector:
+      path: metadata.name
+      value: cozystack.velero
+    asserts:
+      - equal:
+          path: spec.variants[0].components[0].install.upgradeCRDs
+          value: CreateReplace
diff --git a/packages/system/velero/tests/velero_test.yaml b/packages/system/velero/tests/velero_test.yaml
index 182bd4027..44177de01 100644
--- a/packages/system/velero/tests/velero_test.yaml
+++ b/packages/system/velero/tests/velero_test.yaml
@@ -26,11 +26,10 @@ tests:
           path: spec.template.spec.initContainers[1].image
           value: quay.io/kubevirt/kubevirt-velero-plugin:v0.9.0
 
-  # Cozystack disables the upgrade-crds Job (upgradeCRDs: false) because CRDs
-  # ship via the chart's crds/ directory, making the Job redundant. (The old
-  # kubectl-image-compatibility rationale is obsolete in velero 12.x, where the
-  # Job now runs the velero image natively.) Pin that invariant — it silently
-  # regressed once.
+  # Cozystack disables the upgrade-crds Job (upgradeCRDs: false): CRD lifecycle
+  # is owned by the generated HelmRelease (upgradeCRDs: CreateReplace on the
+  # velero PackageSource), making the Job redundant. Pin that invariant — it
+  # silently regressed once.
   - it: does not emit the upgrade-crds Job when upgradeCRDs is disabled
     template: charts/velero/templates/upgrade-crds/upgrade-crds.yaml
     asserts:
diff --git a/packages/system/velero/values.yaml b/packages/system/velero/values.yaml
index 07476feed..a2c54e615 100644
--- a/packages/system/velero/values.yaml
+++ b/packages/system/velero/values.yaml
@@ -1,8 +1,8 @@
 velero:
-  # Disable the upgrade-crds Job: CRDs ship via the chart's crds/ directory, so
-  # the Job is redundant. (The old kubectl-image-compatibility rationale is
-  # obsolete in velero 12.x — the Job now runs the velero image natively, not a
-  # kubectl one — but it stays disabled because cozystack manages CRDs via crds/.)
+  # Disable the upgrade-crds Job: CRD lifecycle is owned by the generated
+  # HelmRelease instead (upgradeCRDs: CreateReplace on the velero PackageSource),
+  # which applies the chart's crds/ directory on install and on every upgrade,
+  # so the Job is redundant.
   upgradeCRDs: false
   initContainers:
     - name: velero-plugin-for-aws