diff --git a/system/greenhouse-organization/Chart.yaml b/system/greenhouse-organization/Chart.yaml
index cc963796a23..11e0d04b1a9 100644
--- a/system/greenhouse-organization/Chart.yaml
+++ b/system/greenhouse-organization/Chart.yaml
@@ -3,7 +3,7 @@ name: greenhouse-organization
 description: A Helm chart for resources required for running the Greenhouse
   admin organization in Greenhouse.
 type: application
-version: 0.6.19
+version: 0.6.20
 dependencies:
   - name: secrets-injector
     repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm
diff --git a/system/greenhouse-organization/templates/alerts/prometheusrules.yaml b/system/greenhouse-organization/templates/alerts/prometheusrules.yaml
index a615eb3b0f5..cbab95c3769 100644
--- a/system/greenhouse-organization/templates/alerts/prometheusrules.yaml
+++ b/system/greenhouse-organization/templates/alerts/prometheusrules.yaml
@@ -3,6 +3,8 @@
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     app: operator
     role: alert-rules
diff --git a/system/greenhouse-organization/templates/catalogs.yaml b/system/greenhouse-organization/templates/catalogs.yaml
index 2ec437aee61..e00eeb5e11c 100644
--- a/system/greenhouse-organization/templates/catalogs.yaml
+++ b/system/greenhouse-organization/templates/catalogs.yaml
@@ -5,6 +5,8 @@ kind: Catalog
 metadata:
   name: {{ $name }}
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   {{- with $catalog.labels }}
   labels:
     {{- toYaml . | nindent 4 }}
diff --git a/system/greenhouse-organization/templates/container-image-retainer.yaml b/system/greenhouse-organization/templates/container-image-retainer.yaml
index db88412e4c1..e01f1a7d365 100644
--- a/system/greenhouse-organization/templates/container-image-retainer.yaml
+++ b/system/greenhouse-organization/templates/container-image-retainer.yaml
@@ -3,11 +3,15 @@ kind: ServiceAccount
 metadata:
   name: container-image-retainer
   namespace: greenhouse
+  annotations:
+    "helm.sh/resource-policy": keep
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 rules:
   - apiGroups:
       - ""
@@ -23,6 +27,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -36,6 +42,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   retain.sh: |
     {{- .Files.Get "etc/retain.sh" | nindent 4 }}
@@ -44,6 +52,8 @@ apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   schedule: '0 1 * * *'
   concurrencyPolicy: Forbid
diff --git a/system/greenhouse-organization/templates/dashboards/flux-dashboards.yaml b/system/greenhouse-organization/templates/dashboards/flux-dashboards.yaml
index 693e5410798..4fdb5eb15a8 100644
--- a/system/greenhouse-organization/templates/dashboards/flux-dashboards.yaml
+++ b/system/greenhouse-organization/templates/dashboards/flux-dashboards.yaml
@@ -5,6 +5,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ printf "%s-%s" $.Release.Name $path | replace ".json" "" | replace "/" "-" | trunc 63 }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     perses.dev/resource: "true"
 
diff --git a/system/greenhouse-organization/templates/organization/ccloud-ingress.yaml b/system/greenhouse-organization/templates/organization/ccloud-ingress.yaml
index 82f90ec8e1c..455b686bade 100644
--- a/system/greenhouse-organization/templates/organization/ccloud-ingress.yaml
+++ b/system/greenhouse-organization/templates/organization/ccloud-ingress.yaml
@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
+    "helm.sh/resource-policy": keep
     disco: "true"
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
diff --git a/system/greenhouse-organization/templates/organization/organization.yaml b/system/greenhouse-organization/templates/organization/organization.yaml
index 881ac053c5e..c6d8a11c325 100644
--- a/system/greenhouse-organization/templates/organization/organization.yaml
+++ b/system/greenhouse-organization/templates/organization/organization.yaml
@@ -4,6 +4,8 @@ kind: Secret
 metadata:
   name: {{ .Release.Namespace }}-auth
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 type: greenhouse.sap/orgsecret
 data:
 {{- if .Values.global.oidc.enabled }}
@@ -28,6 +30,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: registry-mirrors
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   containerRegistryConfig: |
 {{- if and .Values.organization.registryAuth .Values.organization.registryAuth.secretName }}
@@ -47,6 +51,8 @@ kind: Secret
 metadata:
   name: {{ .Values.organization.registryAuth.secretName }}
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 type: Opaque
 {{- end }}
 ---
@@ -55,6 +61,8 @@ apiVersion: greenhouse.sap/v1alpha1
 kind: Organization
 metadata:
   name: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   description: Greenhouse organization
   mappedOrgAdminIdPGroup: {{ required ".Values.teams.admin.mappedIdPGroup missing" .Values.teams.admin.mappedIdPGroup }}
diff --git a/system/greenhouse-organization/templates/organization/rbac.yaml b/system/greenhouse-organization/templates/organization/rbac.yaml
index 4aba3ed75fb..4d42ac253b5 100644
--- a/system/greenhouse-organization/templates/organization/rbac.yaml
+++ b/system/greenhouse-organization/templates/organization/rbac.yaml
@@ -2,6 +2,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: greenhouse:cluster-admin
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -26,6 +28,8 @@ kind: Role
 metadata:
   name: role:{{ .Release.Namespace }}:support
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 rules:
 - apiGroups: [""]
   resources: ["configmaps", "pods", "pods/log", "secrets"]
@@ -68,6 +72,8 @@ kind: RoleBinding
 metadata:
   name: role:{{ .Release.Namespace }}:support
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/system/greenhouse-organization/templates/organization/teams.yaml b/system/greenhouse-organization/templates/organization/teams.yaml
index 18d98d5f0a0..c10351ebaa9 100644
--- a/system/greenhouse-organization/templates/organization/teams.yaml
+++ b/system/greenhouse-organization/templates/organization/teams.yaml
@@ -6,6 +6,8 @@ kind: Team
 metadata:
   name: {{ required "Team name missing" $teamName | lower }}
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 {{ if $team.isSupportGroup }}
   labels:
     greenhouse.sap/support-group: "true"
diff --git a/system/greenhouse-organization/templates/plugins/alerts.yaml b/system/greenhouse-organization/templates/plugins/alerts.yaml
index b1f9e357dc6..d02a4c5d8d7 100644
--- a/system/greenhouse-organization/templates/plugins/alerts.yaml
+++ b/system/greenhouse-organization/templates/plugins/alerts.yaml
@@ -3,6 +3,8 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: ingress-ca-cert
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   ca.crt: {{ required "missing ingress ca cert: .Values.global.caCert" .Values.global.caCert | b64enc | quote }}
 ---
@@ -11,6 +13,8 @@ kind: Plugin
 metadata:
   name: alerts
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.alerts.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/cert-manager.yaml b/system/greenhouse-organization/templates/plugins/cert-manager.yaml
index 29e25bc4940..2ac5ee8df55 100644
--- a/system/greenhouse-organization/templates/plugins/cert-manager.yaml
+++ b/system/greenhouse-organization/templates/plugins/cert-manager.yaml
@@ -3,6 +3,8 @@ kind: Plugin
 metadata:
   name: cert-manager
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.certManager.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/digicert-issuer.yaml b/system/greenhouse-organization/templates/plugins/digicert-issuer.yaml
index e11ecfa44a4..4eb435ce7e8 100644
--- a/system/greenhouse-organization/templates/plugins/digicert-issuer.yaml
+++ b/system/greenhouse-organization/templates/plugins/digicert-issuer.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: digicert-issuer
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.digicertIssuer.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/disco.yaml b/system/greenhouse-organization/templates/plugins/disco.yaml
index ca2f03e56b8..361f6a5ff14 100644
--- a/system/greenhouse-organization/templates/plugins/disco.yaml
+++ b/system/greenhouse-organization/templates/plugins/disco.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: disco
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.disco.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/external-dns.yaml b/system/greenhouse-organization/templates/plugins/external-dns.yaml
index 0493d60644f..07f7e578815 100644
--- a/system/greenhouse-organization/templates/plugins/external-dns.yaml
+++ b/system/greenhouse-organization/templates/plugins/external-dns.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: external-dns
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.externalDns.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/gatekeeper.yaml b/system/greenhouse-organization/templates/plugins/gatekeeper.yaml
index 65f9a330e16..a6fdaa09554 100644
--- a/system/greenhouse-organization/templates/plugins/gatekeeper.yaml
+++ b/system/greenhouse-organization/templates/plugins/gatekeeper.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: gatekeeper
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.gatekeeper.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/ingress-nginx.yaml b/system/greenhouse-organization/templates/plugins/ingress-nginx.yaml
index 73d7cf81fe0..cb6820ce54d 100644
--- a/system/greenhouse-organization/templates/plugins/ingress-nginx.yaml
+++ b/system/greenhouse-organization/templates/plugins/ingress-nginx.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: ingress-nginx
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.ingress.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/k8s-gateway-api.yaml b/system/greenhouse-organization/templates/plugins/k8s-gateway-api.yaml
index d37a6d7b24e..0c9c837428e 100644
--- a/system/greenhouse-organization/templates/plugins/k8s-gateway-api.yaml
+++ b/system/greenhouse-organization/templates/plugins/k8s-gateway-api.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: k8s-gateway-api
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.k8sGatewayApi.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/kgateway-crds.yaml b/system/greenhouse-organization/templates/plugins/kgateway-crds.yaml
index c36ff567003..f2abd660dab 100644
--- a/system/greenhouse-organization/templates/plugins/kgateway-crds.yaml
+++ b/system/greenhouse-organization/templates/plugins/kgateway-crds.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: kgateway-crds
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.kgatewayCrds.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/kgateway.yaml b/system/greenhouse-organization/templates/plugins/kgateway.yaml
index 6a2dc9da470..8b4a331595c 100644
--- a/system/greenhouse-organization/templates/plugins/kgateway.yaml
+++ b/system/greenhouse-organization/templates/plugins/kgateway.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: kgateway
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.kgateway.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/kube-monitoring.yaml b/system/greenhouse-organization/templates/plugins/kube-monitoring.yaml
index 81a8e0dbd33..a63000685b9 100644
--- a/system/greenhouse-organization/templates/plugins/kube-monitoring.yaml
+++ b/system/greenhouse-organization/templates/plugins/kube-monitoring.yaml
@@ -4,6 +4,8 @@ kind: ConfigMap
 metadata:
   name: flux-system
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   config.yaml: |
     spec:
@@ -171,6 +173,8 @@ type: Opaque
 metadata:
   name: thanos-metrics-objectstore
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   thanos.yaml: {{ toYaml .Values.monitoring.thanosObjectstoreConfig | b64enc | quote }}
 ---
@@ -179,6 +183,8 @@ kind: Plugin
 metadata:
   name: kube-monitoring
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.monitoring.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/logs.yaml b/system/greenhouse-organization/templates/plugins/logs.yaml
index 0e157e11ba8..ec740f54b24 100644
--- a/system/greenhouse-organization/templates/plugins/logs.yaml
+++ b/system/greenhouse-organization/templates/plugins/logs.yaml
@@ -6,6 +6,8 @@ kind: Secret
 metadata:
   name: otel-basic-auth-users
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.openTelemetry.supportGroup | default .Values.global.supportGroup }}
 data:
@@ -20,6 +22,8 @@ kind: Plugin
 metadata:
   name: logs-greenhouse
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.openTelemetry.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/logshipping.yaml b/system/greenhouse-organization/templates/plugins/logshipping.yaml
index 5bd7dda4fa7..c246adf3342 100644
--- a/system/greenhouse-organization/templates/plugins/logshipping.yaml
+++ b/system/greenhouse-organization/templates/plugins/logshipping.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: logshipper-greenhouse
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.logshipping.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/permission-manager.yaml b/system/greenhouse-organization/templates/plugins/permission-manager.yaml
index f7502dc4a7e..e1dd70d226e 100644
--- a/system/greenhouse-organization/templates/plugins/permission-manager.yaml
+++ b/system/greenhouse-organization/templates/plugins/permission-manager.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: permission-manager
   namespace: greenhouse
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   pluginDefinitionRef:
     name: permission-manager
diff --git a/system/greenhouse-organization/templates/plugins/perses.yaml b/system/greenhouse-organization/templates/plugins/perses.yaml
index 15f8779e213..361155e5062 100644
--- a/system/greenhouse-organization/templates/plugins/perses.yaml
+++ b/system/greenhouse-organization/templates/plugins/perses.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: perses
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.perses.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/repo-guard.yaml b/system/greenhouse-organization/templates/plugins/repo-guard.yaml
index ba3c42087df..6fb5e67ee3e 100644
--- a/system/greenhouse-organization/templates/plugins/repo-guard.yaml
+++ b/system/greenhouse-organization/templates/plugins/repo-guard.yaml
@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: repo-guard
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/shoot-grafter.yaml b/system/greenhouse-organization/templates/plugins/shoot-grafter.yaml
index d718371178d..397958db25c 100644
--- a/system/greenhouse-organization/templates/plugins/shoot-grafter.yaml
+++ b/system/greenhouse-organization/templates/plugins/shoot-grafter.yaml
@@ -9,6 +9,8 @@ apiVersion: greenhouse.sap/v1alpha1
 kind: Plugin
 metadata:
   name: shoot-grafter
+  annotations:
+    "helm.sh/resource-policy": keep
 labels:
     "greenhouse.sap/owned-by": {{ .Values.shootgrafter.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/plugins/thanos.yaml b/system/greenhouse-organization/templates/plugins/thanos.yaml
index 649587239be..5a8614d1b76 100644
--- a/system/greenhouse-organization/templates/plugins/thanos.yaml
+++ b/system/greenhouse-organization/templates/plugins/thanos.yaml
@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: thanos
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.thanos.supportGroup | default .Values.global.supportGroup }}
 spec:
diff --git a/system/greenhouse-organization/templates/secret-kube-extensions.yaml b/system/greenhouse-organization/templates/secret-kube-extensions.yaml
index c4bee80ac70..152256a02ee 100644
--- a/system/greenhouse-organization/templates/secret-kube-extensions.yaml
+++ b/system/greenhouse-organization/templates/secret-kube-extensions.yaml
@@ -3,6 +3,8 @@ kind: Secret
 metadata:
   name: github-app-secret-sci
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     greenhouse.sap/owned-by: containers
 type: Opaque