diff --git a/.github/actions/env-setup/action.yaml b/.github/actions/env-setup/action.yaml
index 462d8fa4c..4ce02ee3a 100644
--- a/.github/actions/env-setup/action.yaml
+++ b/.github/actions/env-setup/action.yaml
@@ -57,8 +57,10 @@ runs:
         chmod +x kubectl
         sudo mv kubectl /usr/local/bin/
 
-        # Install helm using the official script
+        # Install helm using the official script, pinned so CI catches
+        # Helm-version-specific template regressions 
         echo "Installing Helm using official script..."
+        export DESIRED_VERSION=v3.6.3
         curl -fsSL --retry 3 -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
         chmod 700 get_helm.sh
         ./get_helm.sh
diff --git a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml
index e9836baa3..cfa17f023 100644
--- a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml
+++ b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml
@@ -162,13 +162,19 @@ spec:
   versionPriority: 10
   insecureSkipTLSVerify: {{ not .Values.multicluster.clusterGateway.secureTLS.enabled }}
   {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
-  {{- /* Preserve an already-valid caBundle on upgrade so we don't reset it to the
+  {{- /* Preserve an already-valid caBundle on upgrade so we don't reset it to  the
          Cg== placeholder before the patch Job re-runs 
          $apiSvc is the existing APIService looked up above; fall back to the
          placeholder only on fresh install or when it still holds the placeholder. */}}
   {{- $caBundle := "Cg==" }}
-  {{- if and $apiSvc $apiSvc.spec (hasKey $apiSvc.spec "caBundle") (ne $apiSvc.spec.caBundle "Cg==") }}
-  {{- $caBundle = $apiSvc.spec.caBundle }}
+  {{- if $apiSvc }}
+    {{- if $apiSvc.spec }}
+      {{- if hasKey $apiSvc.spec "caBundle" }}
+        {{- if ne $apiSvc.spec.caBundle "Cg==" }}
+          {{- $caBundle = $apiSvc.spec.caBundle }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
   {{- end }}
   caBundle: {{ $caBundle }}
   {{ end }}