@@ -282,3 +282,84 @@ EOF
   -o jsonpath='{range .items[*].spec.limits[*]}{.default.cpu}{" "}{.default.memory}{" "}{.defaultRequest.cpu}{" "}{.defaultRequest.memory}{"\n"}{end}' \
   | grep -qx '250m 128Mi 25m 128Mi'
 }
+
+@test "Deletion-protection VAP denies delete on labeled cozystack-version ConfigMap" {
+  # Locks down the contract delivered by packages/core/platform/templates/
+  # deletion-protection.yaml: a DELETE on any object carrying
+  # platform.cozystack.io/no-delete=true is rejected by the
+  # ValidatingAdmissionPolicy with the documented message, and the bypass
+  # path (remove the label, then delete) succeeds.
+  #
+  # This covers every regression the PR is meant to prevent in a single
+  # pass: capability gate inverted, binding objectSelector mistyped,
+  # validationActions flipped Deny→Warn, expression flipped false→true,
+  # label-key drift between the binding and the manifests.
+
+  # Preflight: VAP requires Kubernetes 1.30+. Skip on older clusters so
+  # the suite stays green where the capability gate intentionally elides
+  # the policy. Detect by attempting to fetch the policy by name; if the
+  # API is present, the resource will be retrievable, otherwise kubectl
+  # exits non-zero on an unknown resource type.
+  if ! kubectl api-resources --api-group=admissionregistration.k8s.io \
+       2>/dev/null | grep -qw validatingadmissionpolicies; then
+    skip "ValidatingAdmissionPolicy API not available on this cluster"
+  fi
+  kubectl get validatingadmissionpolicy cozystack-no-delete-guardrail
+
+  # The cozystack-version ConfigMap is created with the no-delete label
+  # baked in by the chart (templates/cozystack-version.yaml) and is
+  # backfilled by the migration on upgrades. Asserting the label is the
+  # precondition for the deny check below: if the label is gone the deny
+  # will not fire and the test would misreport as a pass on a regressed
+  # binding.
+  kubectl get configmap cozystack-version -n cozy-system \
+    -o jsonpath='{.metadata.labels.platform\.cozystack\.io/no-delete}' \
+    | grep -qx 'true'
+
+  # The actual deny check. Capture both stdout+stderr and exit code so a
+  # network/auth failure does not silently look like a deny success.
+  local output rc
+  output=$(kubectl delete configmap cozystack-version -n cozy-system 2>&1) \
+    && rc=0 || rc=$?
+  echo "kubectl delete exit=$rc, output=$output"
+  # Delete MUST have failed: success means the VAP regressed.
+  [ "$rc" -ne 0 ]
+  # Assert the user-facing deny message is the one this PR ships — guards
+  # against expression flipped to "true" or message reworded away from the
+  # documented bypass. The CEL message is on one line in the api-server
+  # response, so grep for the literal substring with the --namespace flag.
+  echo "$output" | grep -q 'Deletion blocked: object carries platform.cozystack.io/no-delete=true'
+  echo "$output" | grep -q -- '--namespace'
+
+  # And confirm the ConfigMap is still there — a partial deny that races
+  # tombstone creation would also be a regression.
+  kubectl get configmap cozystack-version -n cozy-system >/dev/null
+
+  # Bypass path: remove the label, delete must succeed. Re-stamp the label
+  # afterward so the cluster ends the test in the same state it started.
+  kubectl label configmap cozystack-version -n cozy-system \
+    platform.cozystack.io/no-delete- --overwrite
+  # Stash the data so we can reconstruct after delete.
+  local version
+  version=$(kubectl get configmap cozystack-version -n cozy-system \
+    -o jsonpath='{.data.version}')
+  kubectl delete configmap cozystack-version -n cozy-system
+  ! kubectl get configmap cozystack-version -n cozy-system 2>/dev/null
+  # Reconstruct: declarative apply matches the chart template at
+  # packages/core/platform/templates/cozystack-version.yaml — same label set
+  # AND the helm.sh/resource-policy: keep annotation that pins the ConfigMap
+  # across helm uninstall.
+  cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cozystack-version
+  namespace: cozy-system
+  labels:
+    platform.cozystack.io/no-delete: "true"
+  annotations:
+    helm.sh/resource-policy: keep
+data:
+  version: "${version}"
+EOF
+}
@@ -89,6 +89,17 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 		}
 	}
 
+	// Stamp the deletion-protection label so the platform VAP guards every
+	// Cozystack CRD against accidental kubectl delete.
+	for _, obj := range objects {
+		labels := obj.GetLabels()
+		if labels == nil {
+			labels = make(map[string]string)
+		}
+		labels["platform.cozystack.io/no-delete"] = "true"
+		obj.SetLabels(labels)
+	}
+
 	logger.Info("Applying Cozystack CRDs", "count", len(objects))
 	for _, obj := range objects {
 		patchOptions := &client.PatchOptions{
 
@@ -212,6 +212,77 @@ func TestInstall_appliesAllCRDs(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Install() error = %v", err)
 	}
+
+	for _, name := range []string{"packages.cozystack.io", "packagesources.cozystack.io"} {
+		applied := &unstructured.Unstructured{}
+		applied.SetGroupVersionKind(apiextensionsv1.SchemeGroupVersion.WithKind("CustomResourceDefinition"))
+		if err := fakeClient.Get(ctx, client.ObjectKey{Name: name}, applied); err != nil {
+			t.Fatalf("failed to read back applied CRD %s: %v", name, err)
+		}
+		labels := applied.GetLabels()
+		if labels["platform.cozystack.io/no-delete"] != "true" {
+			t.Errorf("CRD %s missing platform.cozystack.io/no-delete=true label; got labels=%v", name, labels)
+		}
+	}
+}
+
+// testCRDWithLabels mirrors testCRD1 but already carries a non-cozystack label.
+// Exercises the merge path in Install: the existing label must survive, and the
+// deletion-protection label must be added alongside it.
+var testCRDWithLabels = `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: packages.cozystack.io
+  labels:
+    app.kubernetes.io/managed-by: foo
+spec:
+  group: cozystack.io
+  names:
+    kind: Package
+    plural: packages
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`
+
+func TestInstall_preservesExistingLabels(t *testing.T) {
+	log.SetLogger(zap.New(zap.UseDevMode(true)))
+
+	scheme := runtime.NewScheme()
+	if err := apiextensionsv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("failed to add apiextensions to scheme: %v", err)
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithInterceptorFuncs(establishedInterceptor()).
+		Build()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	ctx = log.IntoContext(ctx, log.FromContext(context.Background()))
+
+	if err := Install(ctx, fakeClient, newCRDManifestWriter(testCRDWithLabels)); err != nil {
+		t.Fatalf("Install() error = %v", err)
+	}
+
+	applied := &unstructured.Unstructured{}
+	applied.SetGroupVersionKind(apiextensionsv1.SchemeGroupVersion.WithKind("CustomResourceDefinition"))
+	if err := fakeClient.Get(ctx, client.ObjectKey{Name: "packages.cozystack.io"}, applied); err != nil {
+		t.Fatalf("failed to read back applied CRD: %v", err)
+	}
+	labels := applied.GetLabels()
+	if labels["app.kubernetes.io/managed-by"] != "foo" {
+		t.Errorf("existing label app.kubernetes.io/managed-by=foo was lost; got labels=%v", labels)
+	}
+	if labels["platform.cozystack.io/no-delete"] != "true" {
+		t.Errorf("deletion-protection label missing after merge; got labels=%v", labels)
+	}
 }
 
 func TestInstall_noManifests(t *testing.T) {
 
@@ -149,4 +149,5 @@ spec:
         - namespace
         - cozy-system
         - cozystack.io/system=true
+        - platform.cozystack.io/no-delete=true
         - pod-security.kubernetes.io/enforce=privileged
@@ -19,6 +19,7 @@ metadata:
   name: cozy-system
   labels:
     cozystack.io/system: "true"
+    platform.cozystack.io/no-delete: "true"
     pod-security.kubernetes.io/enforce: privileged
   annotations:
     helm.sh/resource-policy: keep
 
@@ -17,6 +17,14 @@ reconcile: apply
 diff:
 	cozyhr diff --namespace $(NAMESPACE) $(NAME)
 
+# Strip the platform.cozystack.io/no-delete label from every guarded object so
+# `helm uninstall cozy-platform` (and ad-hoc deletes of protected resources)
+# is no longer denied by the deletion-protection VAP. After this runs, the
+# cluster has no guardrail until the next `helm upgrade` re-stamps the label.
+# Intended for teardown / disaster-recovery, not routine use.
+unprotect:
+	hack/unprotect.sh
+
 image: image-migrations
 
 image-migrations:
 
@@ -0,0 +1,100 @@
+#!/bin/sh
+# Strip the platform.cozystack.io/no-delete=true label from every object that
+# carries it, so `helm uninstall cozy-platform` (and ad-hoc `kubectl delete`
+# on a protected resource) is no longer denied by the deletion-protection
+# ValidatingAdmissionPolicy.
+#
+# Intended for chart teardown and disaster-recovery — NOT a routine operation.
+# After this runs, the cluster has no guardrail until the next `helm upgrade`
+# re-stamps the label.
+#
+# Idempotent: a label that is already absent is a no-op.
+#
+# The set of guarded kinds is enumerated locally rather than discovered
+# dynamically because some of the kinds may not exist in every cluster
+# (e.g. linstorcluster on a non-LINSTOR install) and kubectl returns an
+# error for unknown resource types. The per-kind get is best-effort.
+
+set -eu
+
+LABEL="platform.cozystack.io/no-delete"
+
+# Run `kubectl get` and tolerate only the "unknown resource type" error
+# (a kind that doesn't exist in this cluster — e.g. linstorcluster on a
+# non-LINSTOR install). Any other error (RBAC, wrong context, API
+# unreachable) is fatal — otherwise we'd silently report success while
+# leaving labels behind.
+#
+# Keep stdout (the resource list) and stderr (kubectl warnings, errors)
+# separate so unrelated warnings can't sneak into the loop variable.
+kubectl_get_or_skip_unknown_kind() {
+  err=$(mktemp)
+  if out=$(kubectl get "$@" 2>"$err"); then
+    rm -f "$err"
+    printf '%s\n' "$out"
+    return 0
+  fi
+  errmsg=$(cat "$err")
+  rm -f "$err"
+  case "$errmsg" in
+    *"the server doesn't have a resource type"*|\
+    *"the server could not find the requested resource"*)
+      return 0
+      ;;
+  esac
+  printf '%s\n' "$errmsg" >&2
+  return 1
+}
+
+# Cluster-scoped guarded kinds. CRDs and Namespaces sit here, plus the
+# VAP/Binding pair (which is also self-labeled) and LinstorCluster.
+CLUSTER_KINDS="
+customresourcedefinition
+clusterissuer
+namespace
+validatingadmissionpolicy
+validatingadmissionpolicybinding
+linstorcluster
+"
+
+# Namespaced guarded kinds. ConfigMap, Flux source kinds (OCI/Git), HelmRelease.
+# Both OCIRepository and GitRepository are valid platform sourceRef.kind values
+# — repository.yaml templates `kind: {{ $sourceRef.kind }}` unrestricted — so
+# either may carry the no-delete label and must be enumerated here.
+# Use --all-namespaces with -o jsonpath so we get back (ns, name) pairs and
+# can pass each to a per-object `kubectl label`.
+NS_KINDS="
+configmap
+ocirepository
+gitrepository
+helmrelease
+"
+
+echo "Removing $LABEL label from all guarded objects..."
+
+for kind in $CLUSTER_KINDS; do
+  names=$(kubectl_get_or_skip_unknown_kind "$kind" --selector="$LABEL=true" --output=name)
+  if [ -n "$names" ]; then
+    # One kubectl per resource — `kubectl label` takes the label op as the
+    # last argument, so xargs's trailing-args model would put it in the
+    # wrong position. The protected set is small (<20 objects) so the
+    # extra round-trips are negligible.
+    printf '%s\n' "$names" | while read -r ref; do
+      [ -z "$ref" ] && continue
+      kubectl label "$ref" "$LABEL-"
+    done
+  fi
+done
+
+for kind in $NS_KINDS; do
+  pairs=$(kubectl_get_or_skip_unknown_kind "$kind" --all-namespaces --selector="$LABEL=true" \
+    --output=jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}')
+  if [ -n "$pairs" ]; then
+    printf '%s\n' "$pairs" | while read -r ns name; do
+      [ -z "$name" ] && continue
+      kubectl label --namespace "$ns" "$kind" "$name" "$LABEL-"
+    done
+  fi
+done
+
+echo "Done. helm uninstall is now unblocked."
@@ -0,0 +1,49 @@
+#!/bin/sh
+# Migration 42 --> 43
+# Backfill the platform.cozystack.io/no-delete=true label on the
+# cozystack-version ConfigMap so the deletion-protection
+# ValidatingAdmissionPolicy guards it on upgraded clusters.
+#
+# On first install the chart template renders the ConfigMap with the
+# label inline. On upgrades the template skips re-rendering (lookup-if-not
+# preserves migration-managed data.version), so the label needs an
+# explicit one-shot backfill here.
+#
+# Idempotent: kubectl apply re-runs are a no-op once the ConfigMap matches
+# the declared shape. Same label set the chart bakes in at install time, so
+# the next chart-driven apply sees no diff.
+#
+# 3-way-merge note: this apply records the no-delete label in the kubectl
+# last-applied-configuration annotation under the default field manager.
+# Any future migration that re-stamps cozystack-version via the same field
+# manager MUST include the label inline (matching the chart template at
+# templates/cozystack-version.yaml) — a label-less apply by the same field
+# manager would strip it.
+
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-cozy-system}"
+DRY_RUN="${MIGRATION_DRY_RUN:-0}"
+
+MANIFEST=$(cat <<EOF
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cozystack-version
+  namespace: ${NAMESPACE}
+  labels:
+    platform.cozystack.io/no-delete: "true"
+data:
+  version: "43"
+EOF
+)
+
+if [ "$DRY_RUN" = "1" ]; then
+  echo "[dry-run] would apply:"
+  printf '%s\n' "$MANIFEST"
+  echo "Dry-run complete; version stamp not advanced"
+  exit 0
+fi
+
+printf '%s\n' "$MANIFEST" | kubectl apply --filename -
+echo "Applied configmap $NAMESPACE/cozystack-version with deletion-protection label"
@@ -23,19 +23,26 @@ if [ "$CURRENT_VERSION" -ge "$TARGET_VERSION" ]; then
   exit 0
 fi
 
-# Run migrations sequentially from current version to target version
+# Run migrations sequentially from current version to target version.
+# Every version below TARGET_VERSION must have a corresponding migration file
+# baked into the image — the release build rebuilds the migrations image from
+# the same source tree that carries the files and restamps the digest in the
+# same commit, so image and targetVersion are always consistent at release
+# time. A missing file therefore indicates a packaging mistake (digest
+# advanced without the file landing) and must fail loudly rather than stall
+# the cluster at a stale version.
 for i in $(seq $CURRENT_VERSION $((TARGET_VERSION - 1))); do
-  if [ -f "/migrations/$i" ]; then
-    echo "Running migration $i"
-    chmod +x /migrations/$i
-    /migrations/$i || {
-      echo "Migration $i failed"
-      exit 1
-    }
-    echo "Migration $i completed successfully"
-  else
-    echo "Migration $i not found, skipping"
+  if [ ! -f "/migrations/$i" ]; then
+    echo "Migration $i not found in image — refusing to advance past a missing migration" >&2
+    exit 1
   fi
+  echo "Running migration $i"
+  chmod +x /migrations/$i
+  /migrations/$i || {
+    echo "Migration $i failed"
+    exit 1
+  }
+  echo "Migration $i completed successfully"
 done
 
 echo "All migrations completed successfully"