diff --git a/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml
index 22d0e41..f0bd318 100644
--- a/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml
@@ -25,18 +25,22 @@ jenkins:
     # not a hand-picked subset.
     #
     # kubernetes-client-api added explicitly (not part of the chart's
-    # default list) — kubernetes:4353.vb_47977da_9417 requires
-    # kubernetes-client-api >= 7.3.1-256.v788a_0b_787114 (confirmed via
-    # https://plugins.jenkins.io/kubernetes/dependencies/), but left
-    # unpinned it resolved to an older version at image-build time,
-    # producing `NoSuchMethodError:
+    # default list) — kubernetes originally pinned at 4353.vb_47977da_9417
+    # required kubernetes-client-api >= 7.3.1-256.v788a_0b_787114
+    # (confirmed via https://plugins.jenkins.io/kubernetes/dependencies/),
+    # but left unpinned it resolved to an older version at image-build
+    # time, producing `NoSuchMethodError:
     # ConfigBuilder.withMasterUrl(String)` on every agent launch attempt
     # — pods provisioned fine but the controller crashed trying to
     # actually connect the agent (Reaper.preLaunch -> KubernetesCloud.connect
     # -> KubernetesFactoryAdapter.createClient), so builds hung forever at
-    # "Still waiting to schedule task".
+    # "Still waiting to schedule task". kubernetes itself later bumped to
+    # 4437.v3a_18554d3f32 (updated via the Jenkins UI, then pinned here
+    # to match so a future restart doesn't silently revert it) — same
+    # kubernetes-client-api floor, and this exact pairing is what got a
+    # real build through checkout successfully.
     installPlugins:
-      - kubernetes:4353.vb_47977da_9417
+      - kubernetes:4437.v3a_18554d3f32
       - kubernetes-client-api:7.3.1-256.v788a_0b_787114
       - workflow-aggregator:608.v67378e9d3db_1
       - git:5.7.0