diff --git a/k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml
index bcee593e0..6bbfa008c 100644
--- a/k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml
+++ b/k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml
@@ -18,6 +18,6 @@ resources:
   # custom manager in .github/renovate.json (the project ships no Helm chart, only
   # these raw install manifests, so a kustomize remote resource is the install
   # path). On a bump, re-check the PDB selector still matches the upstream labels.
-  - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.11.0/deploy/ha-install.yaml
+  - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.12.0/deploy/ha-install.yaml
   - cilium-network-policy.yaml
   - pod-disruption-budget.yaml
diff --git a/scripts/render-remote-resource-exceptions.tsv b/scripts/render-remote-resource-exceptions.tsv
index 2fbd50d3e..e02b51ca4 100644
--- a/scripts/render-remote-resource-exceptions.tsv
+++ b/scripts/render-remote-resource-exceptions.tsv
@@ -8,4 +8,4 @@
 # Columns, tab-separated:  <url>  <tracking-issue>  <reason>
 https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_clusteroriginissuers.yaml	#3196	Cloudflare origin-ca-issuer CRD fetched from the moving `trunk` branch; vendoring is child (2) of #3196 and is the most urgent of the three.
 https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_originissuers.yaml	#3196	Second Cloudflare origin-ca-issuer CRD from the same moving `trunk` branch; vendored together with the row above.
-https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.11.0/deploy/ha-install.yaml	#3196	Pinned to tag v0.11.0 (no digest) and Renovate-managed; contributes ServiceAccount/ClusterRole/(Cluster)RoleBinding documents to the prod authorization surface. Vendoring is child (3) of #3196.
+https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.12.0/deploy/ha-install.yaml	#3196	Pinned to tag v0.12.0 (no digest) and Renovate-managed; contributes ServiceAccount/ClusterRole/(Cluster)RoleBinding documents to the prod authorization surface. Vendoring is child (3) of #3196.
diff --git a/scripts/rgd-template-static-scan-remote-resources.tsv b/scripts/rgd-template-static-scan-remote-resources.tsv
index 4c8e9ba98..faf4682ee 100644
--- a/scripts/rgd-template-static-scan-remote-resources.tsv
+++ b/scripts/rgd-template-static-scan-remote-resources.tsv
@@ -1,3 +1,3 @@
-https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.11.0/deploy/ha-install.yaml	60b0f27269792f72ecdc2e617d3fe908ebd2f152280edce96c1b006f5723baa3
+https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/v0.12.0/deploy/ha-install.yaml	44d74b38379d96572c434290732092f577ee4835392b36922a72c406ee406139
 https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_clusteroriginissuers.yaml	cf6af6f155cd087a1ab2a4bec68cd014f05be3cf3d0240ad331ee1fe1bec574e
 https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_originissuers.yaml	d085e763718cf34e675b62f8394e20854237b3997f825d86556659585940b170