diff --git a/helm-overrides/gke-toolshed-prd-usc1/argocd-admin-prd/custom-values.yaml b/helm-overrides/gke-toolshed-prd-usc1/argocd-admin-prd/custom-values.yaml
index 73c7da4..7889b1c 100644
--- a/helm-overrides/gke-toolshed-prd-usc1/argocd-admin-prd/custom-values.yaml
+++ b/helm-overrides/gke-toolshed-prd-usc1/argocd-admin-prd/custom-values.yaml
@@ -4,9 +4,18 @@ argo-cd:
   # Installed once by hand with `helm install argocd-admin-prd` (namespace
   # "argocd"), then manages itself through the argocd Application in
   # devops-infra-argo-config-gcp, whose nameOverride matches that release.
-  global:
-    image:
-      tag: "v2.13.8"
+  # Deliberately no image tag pin, unlike the homelab: the chart's own
+  # appVersion (v3.5.2) governs, so the image cannot drift from the chart.
+  # A pin that outlives its chart is close to the failure this upgrade
+  # fixes — software older than the cluster it manages.
+  #
+  # Upgraded from chart 7.7.23 / Argo CD v2.13.8. Three v3 behaviour changes
+  # apply to this deployment, none of which needs a values change today:
+  #   - logs RBAC is now enforced, so an account that reads pod logs needs
+  #     an explicit `logs, get` policy. jenkins-ci below only syncs.
+  #   - update/delete no longer inherit to an application's sub-resources.
+  #   - resource tracking moves from labels to annotations, so the first
+  #     sync after the upgrade re-stamps every managed resource.
 
   # SSO still deferred, same as the homelab.
   dex:
@@ -65,8 +74,10 @@ argo-cd:
       maxReplicas: 3
       targetCPUUtilizationPercentage: 70
       targetMemoryUtilizationPercentage: null
-    extraArgs:
-      - --insecure
+    # --insecure is NOT set here as an extra arg: configs.params below
+    # carries server.insecure, which is the supported way to express it and
+    # is what the chart renders into argocd-cmd-params-cm. Setting both
+    # works but leaves two places to disagree.
     ingress:
       enabled: true
       ingressClassName: contour
@@ -79,12 +90,30 @@ argo-cd:
         cpu: 200m
         memory: 256Mi
 
+  # applicationSet.enabled no longer exists in this chart, and there is no
+  # replacement: unlike dex and notifications below, the ApplicationSet
+  # controller's Deployment has no conditional at all. replicas: 0 is the
+  # only lever — the Deployment exists but runs nothing. Carrying the old
+  # `enabled: false` forward would have quietly started the controller,
+  # since Helm ignores unknown keys.
+  #
+  # Nothing here uses the ApplicationSet CRD; Applications are rendered by
+  # generic-argo-apps-chart instead.
   applicationSet:
-    enabled: false
+    replicas: 0
   notifications:
     enabled: false
 
   configs:
+    # Contour terminates TLS in front of Argo CD; leaving Argo CD's own TLS
+    # on as well produces a redirect loop. This renders into
+    # argocd-cmd-params-cm, which the server actually reads.
+    #
+    # This file previously expressed it as server.extraArgs: [--insecure],
+    # inherited from the homelab. Both work, but only one should exist, and
+    # the rendered ConfigMap is the thing to check when it looks wrong.
+    params:
+      server.insecure: true
     cm:
       url: "http://argocd.35.238.248.203.nip.io"
       timeout.reconciliation: 3m
diff --git a/helm-templates/argo-cd/Chart.lock b/helm-templates/argo-cd/Chart.lock
index 2c58630..f5a7f1b 100644
--- a/helm-templates/argo-cd/Chart.lock
+++ b/helm-templates/argo-cd/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 7.7.23
-digest: sha256:5d5bb5374bd6a589b5a070a2e48bb1dd211e3871c31af9700297575c84e6f70e
-generated: "2026-08-31T06:40:31.347755+05:30"
+  version: 10.8.4
+digest: sha256:bf31d2cce073a775bf05ec90b74ae45625df5fb6774323a9139d4f8a1be2440a
+generated: "2026-09-12T15:22:56.688354+05:30"
diff --git a/helm-templates/argo-cd/Chart.yaml b/helm-templates/argo-cd/Chart.yaml
index 66a753f..8581ca6 100644
--- a/helm-templates/argo-cd/Chart.yaml
+++ b/helm-templates/argo-cd/Chart.yaml
@@ -3,5 +3,14 @@ name: argocd
 version: 1.0.0
 dependencies:
   - name: argo-cd
-    version: 7.7.23
+    # Argo CD v3.5.2. Bumped from 7.7.23 (v2.13.8), which was older than
+    # this cluster: it diffs against a Kubernetes schema compiled into its
+    # own binary, and GKE 1.35 has fields that schema predates
+    # (status.terminatingReplicas, beta since 1.33), which aborted the diff
+    # on every server-side-apply app. ServerSideDiff works around that; this
+    # removes the cause.
+    #
+    # Not a drop-in: see the 2.x -> 3.0 notes in this cluster's
+    # argocd-admin-prd/custom-values.yaml for what changed in behaviour.
+    version: 10.8.4
     repository: https://argoproj.github.io/argo-helm
diff --git a/helm-templates/argo-cd/charts/argo-cd-10.8.4.tgz b/helm-templates/argo-cd/charts/argo-cd-10.8.4.tgz
new file mode 100644
index 0000000..4f09d60
Binary files /dev/null and b/helm-templates/argo-cd/charts/argo-cd-10.8.4.tgz differ
diff --git a/helm-templates/argo-cd/charts/argo-cd-7.7.23.tgz b/helm-templates/argo-cd/charts/argo-cd-7.7.23.tgz
deleted file mode 100644
index 446e1eb..0000000
Binary files a/helm-templates/argo-cd/charts/argo-cd-7.7.23.tgz and /dev/null differ