diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml
index 75db7209..819dbb87 100644
--- a/charts/gitops-runtime/Chart.yaml
+++ b/charts/gitops-runtime/Chart.yaml
@@ -26,7 +26,8 @@ dependencies:
     condition: argo-workflows.enabled
   - name: sealed-secrets
     repository: https://bitnami.github.io/sealed-secrets
-    version: 2.18.0
+    # TODO: should be safe to upgrade to latest
+    version: 2.18.6
     condition: sealed-secrets.enabled
   - name: codefresh-tunnel-client
     repository: oci://quay.io/codefresh/charts
diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md
index 2ff30bea..7d1d822d 100644
--- a/charts/gitops-runtime/README.md
+++ b/charts/gitops-runtime/README.md
@@ -813,7 +813,7 @@ global:
 | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration |
 | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration |
 | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis |
-| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"quay.io","repository":"codefresh/sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- |
+| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.40.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- |
 | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. |
 | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false |
 | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic |
diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml
index 23999964..ac739f52 100644
--- a/charts/gitops-runtime/values.yaml
+++ b/charts/gitops-runtime/values.yaml
@@ -265,9 +265,10 @@ sealed-secrets:
   fullnameOverride: sealed-secrets-controller
   keyrenewperiod: "720h"
   image:
-    registry: 'quay.io'
-    repository: 'codefresh/sealed-secrets-controller'
-    tag: '0.36.0'
+    registry: 'docker.io'
+    repository: 'octopusdeploy/dhi-sealed-secrets-controller'
+    # NB: this overrides version 0.37.0 from bitnami chart version 2.18.6
+    tag: '0.40.0'
   resources:
     limits:
       cpu: 500m