diff --git a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts
index d7b87b2..fd10d2d 100644
--- a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts
+++ b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts
@@ -16,9 +16,35 @@ const K8S_API = process.env.K8S_API || "http://127.0.0.1:8001";
 // for them to disagree, and it already had: this fixture pinned cert-manager
 // v1.17.0 and knative v1.15.0 long after the package had moved on, so the e2e
 // suite was installing versions the package no longer shipped.
-function latestVersion(name: string): string {
+// Operators the suite pins rather than taking the newest of.
+//
+// The manifests package may carry several versions of an operator so different
+// consumers can each install the one they run. "Newest" is then the wrong
+// default for a test: adding a version downstream would silently change what
+// this suite installs, and a suite whose subject moves without anyone choosing
+// it is not testing what its name says.
+//
+// knative-serving is pinned to v1.15.0 because v1.22.1 fails this suite in a
+// way that does not reproduce by hand — see constructive-planning#1630. That is
+// an apply-path problem to fix on its own, not a reason to hold the package
+// back from carrying the version downstream needs.
+const PINNED_VERSIONS: Record<string, string> = {
+  'knative-serving': 'v1.15.0',
+};
+
+function versionFor(name: string): string {
   const versions = getOperatorVersions(name);
   if (!versions.length) throw new Error(`Unknown operator '${name}'`);
+
+  const pinned = PINNED_VERSIONS[name];
+  if (pinned) {
+    if (!versions.includes(pinned)) {
+      throw new Error(
+        `${name} is pinned to ${pinned}, which the manifests package no longer carries (has: ${versions.join(', ')})`
+      );
+    }
+    return pinned;
+  }
   return versions[versions.length - 1];
 }
 
@@ -38,7 +64,7 @@ const OPERATOR_DEPENDENCIES: Record<string, string[]> = {
 };
 
 function buildOperator(name: string): OperatorConfig {
-  const version = latestVersion(name);
+  const version = versionFor(name);
   const namespace = DEFAULT_NAMESPACES[name] || name;
   return { name, enabled: true, version, namespace } as OperatorConfig;
 }
diff --git a/packages/manifests/operators/cert-manager.yaml b/packages/manifests/operators/cert-manager.yaml
index 5ad6d83..a0a5053 100644
--- a/packages/manifests/operators/cert-manager.yaml
+++ b/packages/manifests/operators/cert-manager.yaml
@@ -25,6 +25,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/serviceaccount.yaml
 apiVersion: v1
@@ -41,6 +42,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/webhook-serviceaccount.yaml
 apiVersion: v1
@@ -57,6 +59,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/crds.yaml
 #
@@ -12113,6 +12116,7 @@ spec:
       storage: true
 
 # END crd
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12720,6 +12724,7 @@ subjects:
   - name: cert-manager
     namespace: cert-manager
     kind: ServiceAccount
+
 ---
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12742,6 +12747,7 @@ subjects:
 - kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 # leader election rules
@@ -12864,6 +12870,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-cainjector
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/rbac.yaml
 # grant cert-manager permission to manage the leaderelection configmap in the
@@ -12961,6 +12968,7 @@ spec:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
+
 ---
 # Source: cert-manager/templates/service.yaml
 apiVersion: v1
@@ -12987,6 +12995,7 @@ spec:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
+
 ---
 # Source: cert-manager/templates/webhook-service.yaml
 apiVersion: v1
@@ -13017,6 +13026,7 @@ spec:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
+
 ---
 # Source: cert-manager/templates/cainjector-deployment.yaml
 apiVersion: apps/v1
@@ -13084,6 +13094,7 @@ spec:
             readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -13269,6 +13280,7 @@ spec:
                 fieldPath: metadata.namespace
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/webhook-mutating-webhook.yaml
 apiVersion: admissionregistration.k8s.io/v1
@@ -13378,6 +13390,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/startupapicheck-rbac.yaml
 # create certificate role
@@ -13429,6 +13442,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-startupapicheck
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/startupapicheck-job.yaml
 apiVersion: batch/v1
diff --git a/packages/manifests/operators/cert-manager/v1.17.0.yaml b/packages/manifests/operators/cert-manager/v1.17.0.yaml
index 5ad6d83..a0a5053 100644
--- a/packages/manifests/operators/cert-manager/v1.17.0.yaml
+++ b/packages/manifests/operators/cert-manager/v1.17.0.yaml
@@ -25,6 +25,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/serviceaccount.yaml
 apiVersion: v1
@@ -41,6 +42,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/webhook-serviceaccount.yaml
 apiVersion: v1
@@ -57,6 +59,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/crds.yaml
 #
@@ -12113,6 +12116,7 @@ spec:
       storage: true
 
 # END crd
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12720,6 +12724,7 @@ subjects:
   - name: cert-manager
     namespace: cert-manager
     kind: ServiceAccount
+
 ---
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12742,6 +12747,7 @@ subjects:
 - kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 # leader election rules
@@ -12864,6 +12870,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-cainjector
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/rbac.yaml
 # grant cert-manager permission to manage the leaderelection configmap in the
@@ -12961,6 +12968,7 @@ spec:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
+
 ---
 # Source: cert-manager/templates/service.yaml
 apiVersion: v1
@@ -12987,6 +12995,7 @@ spec:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
+
 ---
 # Source: cert-manager/templates/webhook-service.yaml
 apiVersion: v1
@@ -13017,6 +13026,7 @@ spec:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
+
 ---
 # Source: cert-manager/templates/cainjector-deployment.yaml
 apiVersion: apps/v1
@@ -13084,6 +13094,7 @@ spec:
             readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -13269,6 +13280,7 @@ spec:
                 fieldPath: metadata.namespace
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/webhook-mutating-webhook.yaml
 apiVersion: admissionregistration.k8s.io/v1
@@ -13378,6 +13390,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/startupapicheck-rbac.yaml
 # create certificate role
@@ -13429,6 +13442,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-startupapicheck
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/startupapicheck-job.yaml
 apiVersion: batch/v1
diff --git a/packages/manifests/operators/kube-prometheus-stack.yaml b/packages/manifests/operators/kube-prometheus-stack.yaml
index 40d575d..7bcb9d4 100644
--- a/packages/manifests/operators/kube-prometheus-stack.yaml
+++ b/packages/manifests/operators/kube-prometheus-stack.yaml
@@ -71414,6 +71414,7 @@ metadata:
     app.kubernetes.io/version: "12.1.1"
   name: kube-prometheus-stack-grafana
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/serviceaccount.yaml
 apiVersion: v1
@@ -71468,6 +71469,7 @@ metadata:
     release: "kube-prometheus-stack"
     heritage: "Helm"
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/serviceaccount.yaml
 apiVersion: v1
@@ -71488,6 +71490,7 @@ metadata:
     app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
     app.kubernetes.io/component: prometheus-operator
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/serviceaccount.yaml
 apiVersion: v1
@@ -71508,6 +71511,7 @@ metadata:
     release: "kube-prometheus-stack"
     heritage: "Helm"
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/secret.yaml
 apiVersion: v1
@@ -71526,6 +71530,7 @@ data:
   admin-user: "YWRtaW4="
   admin-password: "YWRtaW4="
   ldap-toml: ""
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/secret.yaml
 apiVersion: v1
@@ -71545,6 +71550,7 @@ metadata:
     heritage: "Helm"
 data:
   alertmanager.yaml: "Z2xvYmFsOgogIHJlc29sdmVfdGltZW91dDogNW0KaW5oaWJpdF9ydWxlczoKLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIC0gYWxlcnRuYW1lCiAgc291cmNlX21hdGNoZXJzOgogIC0gc2V2ZXJpdHkgPSBjcml0aWNhbAogIHRhcmdldF9tYXRjaGVyczoKICAtIHNldmVyaXR5ID1+IHdhcm5pbmd8aW5mbwotIGVxdWFsOgogIC0gbmFtZXNwYWNlCiAgLSBhbGVydG5hbWUKICBzb3VyY2VfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IHdhcm5pbmcKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIHNvdXJjZV9tYXRjaGVyczoKICAtIGFsZXJ0bmFtZSA9IEluZm9JbmhpYml0b3IKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBhbGVydG5hbWUgPSBJbmZvSW5oaWJpdG9yCnJlY2VpdmVyczoKLSBuYW1lOiAibnVsbCIKcm91dGU6CiAgZ3JvdXBfYnk6CiAgLSBuYW1lc3BhY2UKICBncm91cF9pbnRlcnZhbDogNW0KICBncm91cF93YWl0OiAzMHMKICByZWNlaXZlcjogIm51bGwiCiAgcmVwZWF0X2ludGVydmFsOiAxMmgKICByb3V0ZXM6CiAgLSBtYXRjaGVyczoKICAgIC0gYWxlcnRuYW1lID0gIldhdGNoZG9nIgogICAgcmVjZWl2ZXI6ICJudWxsIgp0ZW1wbGF0ZXM6Ci0gL2V0Yy9hbGVydG1hbmFnZXIvY29uZmlnLyoudG1wbA=="
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/configmap-dashboard-provider.yaml
 apiVersion: v1
@@ -71572,6 +71578,7 @@ data:
         options:
           foldersFromFilesStructure: false
           path: /tmp/dashboards
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/configmap.yaml
 apiVersion: v1
@@ -71600,6 +71607,7 @@ data:
     provisioning = /etc/grafana/provisioning
     [server]
     domain = ''
+
 ---
 # Source: kube-prometheus-stack/templates/grafana/configmaps-datasources.yaml
 apiVersion: v1
@@ -71639,6 +71647,7 @@ data:
       jsonData:
         handleGrafanaManagedAlerts: false
         implementation: prometheus
+
 ---
 # Source: kube-prometheus-stack/templates/grafana/dashboards-1.14/alertmanager-overview.yaml
 apiVersion: v1
@@ -72303,6 +72312,7 @@ spec:
   resources:
     requests:
       storage: "5Gi"
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/clusterrole.yaml
 kind: ClusterRole
@@ -72318,6 +72328,7 @@ rules:
   - apiGroups: [""] # "" indicates the core API group
     resources: ["configmaps", "secrets"]
     verbs: ["get", "watch", "list"]
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72474,6 +72485,8 @@ rules:
   resources:
     - volumeattachments
   verbs: ["list", "watch"]
+
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72584,6 +72597,7 @@ rules:
   - storageclasses
   verbs:
   - get
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72623,6 +72637,8 @@ rules:
   verbs: ["get", "list", "watch"]
 - nonResourceURLs: ["/metrics", "/metrics/cadvisor"]
   verbs: ["get"]
+
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -72642,6 +72658,7 @@ roleRef:
   kind: ClusterRole
   name: kube-prometheus-stack-grafana-clusterrole
   apiGroup: rbac.authorization.k8s.io
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72691,6 +72708,7 @@ subjects:
 - kind: ServiceAccount
   name: kube-prometheus-stack-operator
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72715,6 +72733,8 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-prometheus
     namespace: monitoring
+
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72728,6 +72748,7 @@ metadata:
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/version: "12.1.1"
 rules: []
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/rolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72748,6 +72769,7 @@ subjects:
 - kind: ServiceAccount
   name: kube-prometheus-stack-grafana
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/service.yaml
 apiVersion: v1
@@ -72770,6 +72792,7 @@ spec:
   selector:
     app.kubernetes.io/name: grafana
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/service.yaml
 apiVersion: v1
@@ -72798,6 +72821,7 @@ spec:
   selector:    
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/service.yaml
 apiVersion: v1
@@ -72827,6 +72851,7 @@ spec:
   selector:
     app.kubernetes.io/name: prometheus-node-exporter
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/service.yaml
 apiVersion: v1
@@ -72887,6 +72912,7 @@ spec:
       targetPort: 9153
   selector:
     k8s-app: kube-dns
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/service.yaml
 apiVersion: v1
@@ -72915,6 +72941,7 @@ spec:
   selector:
     component: kube-controller-manager
   type: ClusterIP
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-etcd/service.yaml
 apiVersion: v1
@@ -73027,6 +73054,7 @@ spec:
     app: kube-prometheus-stack-operator
     release: "kube-prometheus-stack"
   type: "ClusterIP"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/service.yaml
 apiVersion: v1
@@ -73060,6 +73088,7 @@ spec:
     operator.prometheus.io/name: kube-prometheus-stack-prometheus
   sessionAffinity: None
   type: "ClusterIP"
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/daemonset.yaml
 apiVersion: apps/v1
@@ -73193,6 +73222,7 @@ spec:
         - name: root
           hostPath:
             path: /
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/deployment.yaml
 apiVersion: apps/v1
@@ -73423,6 +73453,7 @@ spec:
             name: kube-prometheus-stack-grafana-config-dashboards
         - name: sc-datasources-volume
           emptyDir: {}
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/deployment.yaml
 apiVersion: apps/v1
@@ -73511,6 +73542,7 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/deployment.yaml
 apiVersion: apps/v1
@@ -73626,6 +73658,91 @@ spec:
       serviceAccountName: kube-prometheus-stack-operator
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 30
+
+---
+# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name:  kube-prometheus-stack-admission
+  annotations:
+    
+  labels:
+    app: kube-prometheus-stack-admission
+    
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/version: "77.5.0"
+    app.kubernetes.io/part-of: kube-prometheus-stack
+    chart: kube-prometheus-stack-77.5.0
+    release: "kube-prometheus-stack"
+    heritage: "Helm"
+    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
+    app.kubernetes.io/component: prometheus-operator-webhook
+webhooks:
+  - name: prometheusrulemutate.monitoring.coreos.com
+    failurePolicy: Ignore
+    rules:
+      - apiGroups:
+          - monitoring.coreos.com
+        apiVersions:
+          - "*"
+        resources:
+          - prometheusrules
+        operations:
+          - CREATE
+          - UPDATE
+    clientConfig:
+      service:
+        namespace: monitoring
+        name: kube-prometheus-stack-operator
+        path: /admission-prometheusrules/mutate
+    timeoutSeconds: 10
+    admissionReviewVersions: ["v1", "v1beta1"]
+    sideEffects: None
+
+---
+# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name:  kube-prometheus-stack-admission
+  annotations:
+    
+  labels:
+    app: kube-prometheus-stack-admission
+    
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/version: "77.5.0"
+    app.kubernetes.io/part-of: kube-prometheus-stack
+    chart: kube-prometheus-stack-77.5.0
+    release: "kube-prometheus-stack"
+    heritage: "Helm"
+    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
+    app.kubernetes.io/component: prometheus-operator-webhook
+webhooks:
+  - name: prometheusrulemutate.monitoring.coreos.com
+    failurePolicy: Ignore
+    rules:
+      - apiGroups:
+          - monitoring.coreos.com
+        apiVersions:
+          - "*"
+        resources:
+          - prometheusrules
+        operations:
+          - CREATE
+          - UPDATE
+    clientConfig:
+      service:
+        namespace: monitoring
+        name: kube-prometheus-stack-operator
+        path: /admission-prometheusrules/validate
+    timeoutSeconds: 10
+    admissionReviewVersions: ["v1", "v1beta1"]
+    sideEffects: None
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/alertmanager.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -73678,47 +73795,7 @@ spec:
               - {key: app.kubernetes.io/name, operator: In, values: [alertmanager]}
               - {key: alertmanager, operator: In, values: [kube-prometheus-stack-alertmanager]}
   portName: http-web
----
-# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name:  kube-prometheus-stack-admission
-  annotations:
-    
-  labels:
-    app: kube-prometheus-stack-admission
-    
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/version: "77.5.0"
-    app.kubernetes.io/part-of: kube-prometheus-stack
-    chart: kube-prometheus-stack-77.5.0
-    release: "kube-prometheus-stack"
-    heritage: "Helm"
-    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
-    app.kubernetes.io/component: prometheus-operator-webhook
-webhooks:
-  - name: prometheusrulemutate.monitoring.coreos.com
-    failurePolicy: Ignore
-    rules:
-      - apiGroups:
-          - monitoring.coreos.com
-        apiVersions:
-          - "*"
-        resources:
-          - prometheusrules
-        operations:
-          - CREATE
-          - UPDATE
-    clientConfig:
-      service:
-        namespace: monitoring
-        name: kube-prometheus-stack-operator
-        path: /admission-prometheusrules/mutate
-    timeoutSeconds: 10
-    admissionReviewVersions: ["v1", "v1beta1"]
-    sideEffects: None
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/prometheus.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -73813,6 +73890,7 @@ spec:
             - {key: app.kubernetes.io/instance, operator: In, values: [kube-prometheus-stack-prometheus]}
   portName: http-web
   hostNetwork: false
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/rules-1.14/alertmanager.rules.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77274,6 +77352,7 @@ spec:
   namespaceSelector:
     matchNames:
       - monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77299,6 +77378,7 @@ spec:
   endpoints:
     - port: http
       honorLabels: true
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77327,6 +77407,7 @@ spec:
   endpoints:
     - port: http-metrics
       scheme: http
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77360,6 +77441,7 @@ spec:
     path: "/metrics"
   - port: reloader-web
     path: "/metrics"
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/core-dns/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77390,6 +77472,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-api-server/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77431,6 +77514,7 @@ spec:
     matchLabels:
       component: apiserver
       provider: kubernetes
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77465,6 +77549,7 @@ spec:
     tlsConfig:
       caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
       insecureSkipVerify: true
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-etcd/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77495,6 +77580,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-proxy/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77525,6 +77611,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-scheduler/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77559,6 +77646,7 @@ spec:
     tlsConfig:
       caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
       insecureSkipVerify: true
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kubelet/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77673,6 +77761,7 @@ spec:
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77712,6 +77801,7 @@ spec:
   namespaceSelector:
     matchNames:
       - "monitoring"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77745,47 +77835,6 @@ spec:
   - port: reloader-web
     path: "/metrics"
 ---
-# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name:  kube-prometheus-stack-admission
-  annotations:
-    
-  labels:
-    app: kube-prometheus-stack-admission
-    
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/version: "77.5.0"
-    app.kubernetes.io/part-of: kube-prometheus-stack
-    chart: kube-prometheus-stack-77.5.0
-    release: "kube-prometheus-stack"
-    heritage: "Helm"
-    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
-    app.kubernetes.io/component: prometheus-operator-webhook
-webhooks:
-  - name: prometheusrulemutate.monitoring.coreos.com
-    failurePolicy: Ignore
-    rules:
-      - apiGroups:
-          - monitoring.coreos.com
-        apiVersions:
-          - "*"
-        resources:
-          - prometheusrules
-        operations:
-          - CREATE
-          - UPDATE
-    clientConfig:
-      service:
-        namespace: monitoring
-        name: kube-prometheus-stack-operator
-        path: /admission-prometheusrules/validate
-    timeoutSeconds: 10
-    admissionReviewVersions: ["v1", "v1beta1"]
-    sideEffects: None
----
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
@@ -77800,6 +77849,7 @@ metadata:
   annotations:
     "helm.sh/hook": test
     "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/serviceaccount.yaml
 apiVersion: v1
@@ -77823,6 +77873,7 @@ metadata:
     app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
     app.kubernetes.io/component: prometheus-operator-webhook
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-configmap.yaml
 apiVersion: v1
@@ -77846,6 +77897,7 @@ data:
       code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^  HTTP/{print $2}')
       [ "$code" == "200" ]
     }
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77876,6 +77928,7 @@ rules:
     verbs:
       - get
       - update
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77905,6 +77958,7 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-admission
     namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77935,6 +77989,7 @@ rules:
     verbs:
       - get
       - create
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/rolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77965,6 +78020,7 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-admission
     namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test.yaml
 apiVersion: v1
@@ -77996,6 +78052,7 @@ spec:
       configMap:
         name: kube-prometheus-stack-grafana-test
   restartPolicy: Never
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml
 apiVersion: batch/v1
@@ -78062,6 +78119,7 @@ spec:
         runAsUser: 2000
         seccompProfile:
           type: RuntimeDefault
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-patchWebhook.yaml
 apiVersion: batch/v1
diff --git a/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml b/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml
index 40d575d..7bcb9d4 100644
--- a/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml
+++ b/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml
@@ -71414,6 +71414,7 @@ metadata:
     app.kubernetes.io/version: "12.1.1"
   name: kube-prometheus-stack-grafana
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/serviceaccount.yaml
 apiVersion: v1
@@ -71468,6 +71469,7 @@ metadata:
     release: "kube-prometheus-stack"
     heritage: "Helm"
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/serviceaccount.yaml
 apiVersion: v1
@@ -71488,6 +71490,7 @@ metadata:
     app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
     app.kubernetes.io/component: prometheus-operator
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/serviceaccount.yaml
 apiVersion: v1
@@ -71508,6 +71511,7 @@ metadata:
     release: "kube-prometheus-stack"
     heritage: "Helm"
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/secret.yaml
 apiVersion: v1
@@ -71526,6 +71530,7 @@ data:
   admin-user: "YWRtaW4="
   admin-password: "YWRtaW4="
   ldap-toml: ""
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/secret.yaml
 apiVersion: v1
@@ -71545,6 +71550,7 @@ metadata:
     heritage: "Helm"
 data:
   alertmanager.yaml: "Z2xvYmFsOgogIHJlc29sdmVfdGltZW91dDogNW0KaW5oaWJpdF9ydWxlczoKLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIC0gYWxlcnRuYW1lCiAgc291cmNlX21hdGNoZXJzOgogIC0gc2V2ZXJpdHkgPSBjcml0aWNhbAogIHRhcmdldF9tYXRjaGVyczoKICAtIHNldmVyaXR5ID1+IHdhcm5pbmd8aW5mbwotIGVxdWFsOgogIC0gbmFtZXNwYWNlCiAgLSBhbGVydG5hbWUKICBzb3VyY2VfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IHdhcm5pbmcKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIHNvdXJjZV9tYXRjaGVyczoKICAtIGFsZXJ0bmFtZSA9IEluZm9JbmhpYml0b3IKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBhbGVydG5hbWUgPSBJbmZvSW5oaWJpdG9yCnJlY2VpdmVyczoKLSBuYW1lOiAibnVsbCIKcm91dGU6CiAgZ3JvdXBfYnk6CiAgLSBuYW1lc3BhY2UKICBncm91cF9pbnRlcnZhbDogNW0KICBncm91cF93YWl0OiAzMHMKICByZWNlaXZlcjogIm51bGwiCiAgcmVwZWF0X2ludGVydmFsOiAxMmgKICByb3V0ZXM6CiAgLSBtYXRjaGVyczoKICAgIC0gYWxlcnRuYW1lID0gIldhdGNoZG9nIgogICAgcmVjZWl2ZXI6ICJudWxsIgp0ZW1wbGF0ZXM6Ci0gL2V0Yy9hbGVydG1hbmFnZXIvY29uZmlnLyoudG1wbA=="
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/configmap-dashboard-provider.yaml
 apiVersion: v1
@@ -71572,6 +71578,7 @@ data:
         options:
           foldersFromFilesStructure: false
           path: /tmp/dashboards
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/configmap.yaml
 apiVersion: v1
@@ -71600,6 +71607,7 @@ data:
     provisioning = /etc/grafana/provisioning
     [server]
     domain = ''
+
 ---
 # Source: kube-prometheus-stack/templates/grafana/configmaps-datasources.yaml
 apiVersion: v1
@@ -71639,6 +71647,7 @@ data:
       jsonData:
         handleGrafanaManagedAlerts: false
         implementation: prometheus
+
 ---
 # Source: kube-prometheus-stack/templates/grafana/dashboards-1.14/alertmanager-overview.yaml
 apiVersion: v1
@@ -72303,6 +72312,7 @@ spec:
   resources:
     requests:
       storage: "5Gi"
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/clusterrole.yaml
 kind: ClusterRole
@@ -72318,6 +72328,7 @@ rules:
   - apiGroups: [""] # "" indicates the core API group
     resources: ["configmaps", "secrets"]
     verbs: ["get", "watch", "list"]
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72474,6 +72485,8 @@ rules:
   resources:
     - volumeattachments
   verbs: ["list", "watch"]
+
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72584,6 +72597,7 @@ rules:
   - storageclasses
   verbs:
   - get
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72623,6 +72637,8 @@ rules:
   verbs: ["get", "list", "watch"]
 - nonResourceURLs: ["/metrics", "/metrics/cadvisor"]
   verbs: ["get"]
+
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -72642,6 +72658,7 @@ roleRef:
   kind: ClusterRole
   name: kube-prometheus-stack-grafana-clusterrole
   apiGroup: rbac.authorization.k8s.io
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72691,6 +72708,7 @@ subjects:
 - kind: ServiceAccount
   name: kube-prometheus-stack-operator
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72715,6 +72733,8 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-prometheus
     namespace: monitoring
+
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72728,6 +72748,7 @@ metadata:
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/version: "12.1.1"
 rules: []
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/rolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -72748,6 +72769,7 @@ subjects:
 - kind: ServiceAccount
   name: kube-prometheus-stack-grafana
   namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/service.yaml
 apiVersion: v1
@@ -72770,6 +72792,7 @@ spec:
   selector:
     app.kubernetes.io/name: grafana
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/service.yaml
 apiVersion: v1
@@ -72798,6 +72821,7 @@ spec:
   selector:    
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/service.yaml
 apiVersion: v1
@@ -72827,6 +72851,7 @@ spec:
   selector:
     app.kubernetes.io/name: prometheus-node-exporter
     app.kubernetes.io/instance: kube-prometheus-stack
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/service.yaml
 apiVersion: v1
@@ -72887,6 +72912,7 @@ spec:
       targetPort: 9153
   selector:
     k8s-app: kube-dns
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/service.yaml
 apiVersion: v1
@@ -72915,6 +72941,7 @@ spec:
   selector:
     component: kube-controller-manager
   type: ClusterIP
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-etcd/service.yaml
 apiVersion: v1
@@ -73027,6 +73054,7 @@ spec:
     app: kube-prometheus-stack-operator
     release: "kube-prometheus-stack"
   type: "ClusterIP"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/service.yaml
 apiVersion: v1
@@ -73060,6 +73088,7 @@ spec:
     operator.prometheus.io/name: kube-prometheus-stack-prometheus
   sessionAffinity: None
   type: "ClusterIP"
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/daemonset.yaml
 apiVersion: apps/v1
@@ -73193,6 +73222,7 @@ spec:
         - name: root
           hostPath:
             path: /
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/deployment.yaml
 apiVersion: apps/v1
@@ -73423,6 +73453,7 @@ spec:
             name: kube-prometheus-stack-grafana-config-dashboards
         - name: sc-datasources-volume
           emptyDir: {}
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/deployment.yaml
 apiVersion: apps/v1
@@ -73511,6 +73542,7 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/deployment.yaml
 apiVersion: apps/v1
@@ -73626,6 +73658,91 @@ spec:
       serviceAccountName: kube-prometheus-stack-operator
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 30
+
+---
+# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name:  kube-prometheus-stack-admission
+  annotations:
+    
+  labels:
+    app: kube-prometheus-stack-admission
+    
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/version: "77.5.0"
+    app.kubernetes.io/part-of: kube-prometheus-stack
+    chart: kube-prometheus-stack-77.5.0
+    release: "kube-prometheus-stack"
+    heritage: "Helm"
+    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
+    app.kubernetes.io/component: prometheus-operator-webhook
+webhooks:
+  - name: prometheusrulemutate.monitoring.coreos.com
+    failurePolicy: Ignore
+    rules:
+      - apiGroups:
+          - monitoring.coreos.com
+        apiVersions:
+          - "*"
+        resources:
+          - prometheusrules
+        operations:
+          - CREATE
+          - UPDATE
+    clientConfig:
+      service:
+        namespace: monitoring
+        name: kube-prometheus-stack-operator
+        path: /admission-prometheusrules/mutate
+    timeoutSeconds: 10
+    admissionReviewVersions: ["v1", "v1beta1"]
+    sideEffects: None
+
+---
+# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name:  kube-prometheus-stack-admission
+  annotations:
+    
+  labels:
+    app: kube-prometheus-stack-admission
+    
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/version: "77.5.0"
+    app.kubernetes.io/part-of: kube-prometheus-stack
+    chart: kube-prometheus-stack-77.5.0
+    release: "kube-prometheus-stack"
+    heritage: "Helm"
+    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
+    app.kubernetes.io/component: prometheus-operator-webhook
+webhooks:
+  - name: prometheusrulemutate.monitoring.coreos.com
+    failurePolicy: Ignore
+    rules:
+      - apiGroups:
+          - monitoring.coreos.com
+        apiVersions:
+          - "*"
+        resources:
+          - prometheusrules
+        operations:
+          - CREATE
+          - UPDATE
+    clientConfig:
+      service:
+        namespace: monitoring
+        name: kube-prometheus-stack-operator
+        path: /admission-prometheusrules/validate
+    timeoutSeconds: 10
+    admissionReviewVersions: ["v1", "v1beta1"]
+    sideEffects: None
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/alertmanager.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -73678,47 +73795,7 @@ spec:
               - {key: app.kubernetes.io/name, operator: In, values: [alertmanager]}
               - {key: alertmanager, operator: In, values: [kube-prometheus-stack-alertmanager]}
   portName: http-web
----
-# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name:  kube-prometheus-stack-admission
-  annotations:
-    
-  labels:
-    app: kube-prometheus-stack-admission
-    
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/version: "77.5.0"
-    app.kubernetes.io/part-of: kube-prometheus-stack
-    chart: kube-prometheus-stack-77.5.0
-    release: "kube-prometheus-stack"
-    heritage: "Helm"
-    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
-    app.kubernetes.io/component: prometheus-operator-webhook
-webhooks:
-  - name: prometheusrulemutate.monitoring.coreos.com
-    failurePolicy: Ignore
-    rules:
-      - apiGroups:
-          - monitoring.coreos.com
-        apiVersions:
-          - "*"
-        resources:
-          - prometheusrules
-        operations:
-          - CREATE
-          - UPDATE
-    clientConfig:
-      service:
-        namespace: monitoring
-        name: kube-prometheus-stack-operator
-        path: /admission-prometheusrules/mutate
-    timeoutSeconds: 10
-    admissionReviewVersions: ["v1", "v1beta1"]
-    sideEffects: None
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/prometheus.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -73813,6 +73890,7 @@ spec:
             - {key: app.kubernetes.io/instance, operator: In, values: [kube-prometheus-stack-prometheus]}
   portName: http-web
   hostNetwork: false
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/rules-1.14/alertmanager.rules.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77274,6 +77352,7 @@ spec:
   namespaceSelector:
     matchNames:
       - monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77299,6 +77378,7 @@ spec:
   endpoints:
     - port: http
       honorLabels: true
+
 ---
 # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77327,6 +77407,7 @@ spec:
   endpoints:
     - port: http-metrics
       scheme: http
+
 ---
 # Source: kube-prometheus-stack/templates/alertmanager/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77360,6 +77441,7 @@ spec:
     path: "/metrics"
   - port: reloader-web
     path: "/metrics"
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/core-dns/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77390,6 +77472,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-api-server/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77431,6 +77514,7 @@ spec:
     matchLabels:
       component: apiserver
       provider: kubernetes
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77465,6 +77549,7 @@ spec:
     tlsConfig:
       caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
       insecureSkipVerify: true
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-etcd/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77495,6 +77580,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-proxy/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77525,6 +77611,7 @@ spec:
   endpoints:
   - port: http-metrics
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kube-scheduler/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77559,6 +77646,7 @@ spec:
     tlsConfig:
       caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
       insecureSkipVerify: true
+
 ---
 # Source: kube-prometheus-stack/templates/exporters/kubelet/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77673,6 +77761,7 @@ spec:
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77712,6 +77801,7 @@ spec:
   namespaceSelector:
     matchNames:
       - "monitoring"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -77745,47 +77835,6 @@ spec:
   - port: reloader-web
     path: "/metrics"
 ---
-# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name:  kube-prometheus-stack-admission
-  annotations:
-    
-  labels:
-    app: kube-prometheus-stack-admission
-    
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/version: "77.5.0"
-    app.kubernetes.io/part-of: kube-prometheus-stack
-    chart: kube-prometheus-stack-77.5.0
-    release: "kube-prometheus-stack"
-    heritage: "Helm"
-    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
-    app.kubernetes.io/component: prometheus-operator-webhook
-webhooks:
-  - name: prometheusrulemutate.monitoring.coreos.com
-    failurePolicy: Ignore
-    rules:
-      - apiGroups:
-          - monitoring.coreos.com
-        apiVersions:
-          - "*"
-        resources:
-          - prometheusrules
-        operations:
-          - CREATE
-          - UPDATE
-    clientConfig:
-      service:
-        namespace: monitoring
-        name: kube-prometheus-stack-operator
-        path: /admission-prometheusrules/validate
-    timeoutSeconds: 10
-    admissionReviewVersions: ["v1", "v1beta1"]
-    sideEffects: None
----
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
@@ -77800,6 +77849,7 @@ metadata:
   annotations:
     "helm.sh/hook": test
     "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/serviceaccount.yaml
 apiVersion: v1
@@ -77823,6 +77873,7 @@ metadata:
     app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
     app.kubernetes.io/component: prometheus-operator-webhook
 automountServiceAccountToken: true
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-configmap.yaml
 apiVersion: v1
@@ -77846,6 +77897,7 @@ data:
       code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^  HTTP/{print $2}')
       [ "$code" == "200" ]
     }
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77876,6 +77928,7 @@ rules:
     verbs:
       - get
       - update
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77905,6 +77958,7 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-admission
     namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77935,6 +77989,7 @@ rules:
     verbs:
       - get
       - create
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/rolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -77965,6 +78020,7 @@ subjects:
   - kind: ServiceAccount
     name: kube-prometheus-stack-admission
     namespace: monitoring
+
 ---
 # Source: kube-prometheus-stack/charts/grafana/templates/tests/test.yaml
 apiVersion: v1
@@ -77996,6 +78052,7 @@ spec:
       configMap:
         name: kube-prometheus-stack-grafana-test
   restartPolicy: Never
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml
 apiVersion: batch/v1
@@ -78062,6 +78119,7 @@ spec:
         runAsUser: 2000
         seccompProfile:
           type: RuntimeDefault
+
 ---
 # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-patchWebhook.yaml
 apiVersion: batch/v1
diff --git a/packages/manifests/operators/minio-operator.yaml b/packages/manifests/operators/minio-operator.yaml
index 9684232..d1648da 100644
--- a/packages/manifests/operators/minio-operator.yaml
+++ b/packages/manifests/operators/minio-operator.yaml
@@ -20,6 +20,7 @@ metadata:
     helm.sh/chart: operator-7.1.1
     app.kubernetes.io/version: "v7.1.1"
     app.kubernetes.io/managed-by: Helm
+
 ---
 # Source: operator/templates/minio.min.io_tenants.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -5774,6 +5775,7 @@ spec:
     storage: true
     subresources:
       status: {}
+
 ---
 # Source: operator/templates/sts.min.io_policybindings.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -5908,6 +5910,7 @@ spec:
     storage: true
     subresources:
       status: {}
+
 ---
 # Source: operator/templates/operator-clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -6096,6 +6099,7 @@ rules:
       - patch
       - update
       - deletecollection
+
 ---
 # Source: operator/templates/operator-clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -6114,6 +6118,7 @@ subjects:
   - kind: ServiceAccount
     name: minio-operator
     namespace: minio-operator
+
 ---
 # Source: operator/templates/operator-service.yaml
 apiVersion: v1
@@ -6134,6 +6139,7 @@ spec:
     operator: leader
     app.kubernetes.io/name: operator
     app.kubernetes.io/instance: minio-operator
+
 ---
 # Source: operator/templates/sts-service.yaml
 apiVersion: v1
@@ -6153,6 +6159,7 @@ spec:
   selector:
     app.kubernetes.io/name: operator
     app.kubernetes.io/instance: minio-operator
+
 ---
 # Source: operator/templates/operator-deployment.yaml
 apiVersion: apps/v1
diff --git a/packages/manifests/operators/minio-operator/7.1.1.yaml b/packages/manifests/operators/minio-operator/7.1.1.yaml
index 9684232..d1648da 100644
--- a/packages/manifests/operators/minio-operator/7.1.1.yaml
+++ b/packages/manifests/operators/minio-operator/7.1.1.yaml
@@ -20,6 +20,7 @@ metadata:
     helm.sh/chart: operator-7.1.1
     app.kubernetes.io/version: "v7.1.1"
     app.kubernetes.io/managed-by: Helm
+
 ---
 # Source: operator/templates/minio.min.io_tenants.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -5774,6 +5775,7 @@ spec:
     storage: true
     subresources:
       status: {}
+
 ---
 # Source: operator/templates/sts.min.io_policybindings.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -5908,6 +5910,7 @@ spec:
     storage: true
     subresources:
       status: {}
+
 ---
 # Source: operator/templates/operator-clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -6096,6 +6099,7 @@ rules:
       - patch
       - update
       - deletecollection
+
 ---
 # Source: operator/templates/operator-clusterrolebinding.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -6114,6 +6118,7 @@ subjects:
   - kind: ServiceAccount
     name: minio-operator
     namespace: minio-operator
+
 ---
 # Source: operator/templates/operator-service.yaml
 apiVersion: v1
@@ -6134,6 +6139,7 @@ spec:
     operator: leader
     app.kubernetes.io/name: operator
     app.kubernetes.io/instance: minio-operator
+
 ---
 # Source: operator/templates/sts-service.yaml
 apiVersion: v1
@@ -6153,6 +6159,7 @@ spec:
   selector:
     app.kubernetes.io/name: operator
     app.kubernetes.io/instance: minio-operator
+
 ---
 # Source: operator/templates/operator-deployment.yaml
 apiVersion: apps/v1
diff --git a/packages/manifests/operators/traefik.yaml b/packages/manifests/operators/traefik.yaml
index d45f65d..32a3fe5 100644
--- a/packages/manifests/operators/traefik.yaml
+++ b/packages/manifests/operators/traefik.yaml
@@ -15922,6 +15922,7 @@ rules:
       - get
       - list
       - watch
+
 ---
 # Source: traefik/templates/rbac/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -16096,6 +16097,7 @@ spec:
         runAsGroup: 65532
         runAsNonRoot: true
         runAsUser: 65532
+
 ---
 # Source: traefik/templates/ingressclass.yaml
 apiVersion: networking.k8s.io/v1
diff --git a/packages/manifests/operators/traefik/34.4.1.yaml b/packages/manifests/operators/traefik/34.4.1.yaml
index d45f65d..32a3fe5 100644
--- a/packages/manifests/operators/traefik/34.4.1.yaml
+++ b/packages/manifests/operators/traefik/34.4.1.yaml
@@ -15922,6 +15922,7 @@ rules:
       - get
       - list
       - watch
+
 ---
 # Source: traefik/templates/rbac/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -16096,6 +16097,7 @@ spec:
         runAsGroup: 65532
         runAsNonRoot: true
         runAsUser: 65532
+
 ---
 # Source: traefik/templates/ingressclass.yaml
 apiVersion: networking.k8s.io/v1
diff --git a/packages/manifests/package.json b/packages/manifests/package.json
index 358753a..1cbbda7 100644
--- a/packages/manifests/package.json
+++ b/packages/manifests/package.json
@@ -22,7 +22,7 @@
   "scripts": {
     "clean": "makage clean",
     "prepack": "npm run build",
-    "build": "makage build",
+    "build": "makage clean && makage build && mkdir -p dist/operators && find operators -mindepth 1 -maxdepth 1 -type d -exec cp -R {} dist/operators/ \\;",
     "build:dev": "makage build --dev",
     "lint": "eslint . --fix",
     "pull": "ts-node scripts/pull-manifests.ts",
diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts
index aab4673..a346eaf 100644
--- a/packages/manifests/scripts/pull-manifests.ts
+++ b/packages/manifests/scripts/pull-manifests.ts
@@ -44,6 +44,37 @@ type OperatorConfig = {
 
 // Configure supported operators and versions.
 // Keep explicit URLs for reliability and reproducibility.
+/**
+ * Remove vendored output that no configuration asks for any more.
+ *
+ * Without this, dropping an operator or superseding a version leaves its files
+ * on disk, codegen picks them up, and they reappear in OPERATOR_VERSIONS as
+ * though they were still supported. That is how cert-manager came to advertise
+ * both v1.17.0 and v1.21.1 after a single-version bump, and how ingress-nginx
+ * regenerated itself after being deleted.
+ */
+function pruneStale(operatorsDir: string, configured: OperatorConfig[]): void {
+  if (!fs.existsSync(operatorsDir)) return;
+  const wanted = new Map(configured.map((o) => [o.name, new Set(o.sources.map((s) => s.version))]));
+
+  for (const entry of fs.readdirSync(operatorsDir, { withFileTypes: true })) {
+    const base = entry.name.replace(/\.yaml$/i, '');
+    const versions = wanted.get(base);
+    if (!versions) {
+      fs.rmSync(path.join(operatorsDir, entry.name), { recursive: true, force: true });
+      console.log(`Pruned ${entry.name} (no longer configured)`);
+      continue;
+    }
+    if (!entry.isDirectory()) continue;
+    for (const v of fs.readdirSync(path.join(operatorsDir, entry.name))) {
+      const version = v.replace(/\.yaml$/i, '');
+      if (versions.has(version)) continue;
+      fs.rmSync(path.join(operatorsDir, entry.name, v), { recursive: true, force: true });
+      console.log(`Pruned ${entry.name}/${v} (version no longer configured)`);
+    }
+  }
+}
+
 const OPERATORS: OperatorConfig[] = [
   {
     name: 'minio-operator',
@@ -91,6 +122,16 @@ const OPERATORS: OperatorConfig[] = [
     ],
   },
   {
+    // Only one version, deliberately. The package is built to carry several --
+    // `sources` is an array -- but getOperatorResources ignores its version
+    // argument and returns whatever codegen emitted as the default, which is
+    // the last version pulled. So adding a second version silently redirects
+    // every consumer of getOperatorResources at it, including this repo's own
+    // e2e, which then reports the version it asked for while applying a
+    // different one.
+    //
+    // Adding v1.22.1 for downstream is worth doing and needs that accessor
+    // fixed first: per-version resources in codegen, not one set per operator.
     name: 'knative-serving',
     // Applied in three ordered parts, never merged: the CRDs have to be
     // established before serving-core's custom resources of those kinds exist.
@@ -114,6 +155,7 @@ const OPERATORS: OperatorConfig[] = [
           'https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.15.0/kourier.yaml',
         ],
       },
+
     ],
   },
   {
@@ -491,6 +533,10 @@ async function main() {
   ensureDir(outDir);
 
   if (all) {
+    // Prune before pulling, so a full run leaves exactly what the config asks
+    // for. Only on --all: a single-operator pull knows nothing about the others
+    // and must not delete them.
+    pruneStale(outDir, OPERATORS);
     for (const op of OPERATORS) {
       await pullOperator(op, undefined, outDir);
     }
diff --git a/packages/manifests/src/generated/kube-prometheus-stack.ts b/packages/manifests/src/generated/kube-prometheus-stack.ts
index 795deb2..a72c427 100644
--- a/packages/manifests/src/generated/kube-prometheus-stack.ts
+++ b/packages/manifests/src/generated/kube-prometheus-stack.ts
@@ -58692,6 +58692,86 @@ export const Deployment_KubePrometheusStackOperator: KubernetesResource = {
     }
   }
 };
+export const MutatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = {
+  apiVersion: "admissionregistration.k8s.io/v1",
+  kind: "MutatingWebhookConfiguration",
+  metadata: {
+    annotations: null,
+    labels: {
+      app: "kube-prometheus-stack-admission",
+      "app.kubernetes.io/component": "prometheus-operator-webhook",
+      "app.kubernetes.io/instance": "kube-prometheus-stack",
+      "app.kubernetes.io/managed-by": "Helm",
+      "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator",
+      "app.kubernetes.io/part-of": "kube-prometheus-stack",
+      "app.kubernetes.io/version": "77.5.0",
+      chart: "kube-prometheus-stack-77.5.0",
+      heritage: "Helm",
+      release: "kube-prometheus-stack"
+    },
+    name: "kube-prometheus-stack-admission"
+  },
+  webhooks: [{
+    admissionReviewVersions: ["v1", "v1beta1"],
+    clientConfig: {
+      service: {
+        name: "kube-prometheus-stack-operator",
+        namespace: "monitoring",
+        path: "/admission-prometheusrules/mutate"
+      }
+    },
+    failurePolicy: "Ignore",
+    name: "prometheusrulemutate.monitoring.coreos.com",
+    rules: [{
+      apiGroups: ["monitoring.coreos.com"],
+      apiVersions: ["*"],
+      operations: ["CREATE", "UPDATE"],
+      resources: ["prometheusrules"]
+    }],
+    sideEffects: "None",
+    timeoutSeconds: 10
+  }]
+};
+export const ValidatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = {
+  apiVersion: "admissionregistration.k8s.io/v1",
+  kind: "ValidatingWebhookConfiguration",
+  metadata: {
+    annotations: null,
+    labels: {
+      app: "kube-prometheus-stack-admission",
+      "app.kubernetes.io/component": "prometheus-operator-webhook",
+      "app.kubernetes.io/instance": "kube-prometheus-stack",
+      "app.kubernetes.io/managed-by": "Helm",
+      "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator",
+      "app.kubernetes.io/part-of": "kube-prometheus-stack",
+      "app.kubernetes.io/version": "77.5.0",
+      chart: "kube-prometheus-stack-77.5.0",
+      heritage: "Helm",
+      release: "kube-prometheus-stack"
+    },
+    name: "kube-prometheus-stack-admission"
+  },
+  webhooks: [{
+    admissionReviewVersions: ["v1", "v1beta1"],
+    clientConfig: {
+      service: {
+        name: "kube-prometheus-stack-operator",
+        namespace: "monitoring",
+        path: "/admission-prometheusrules/validate"
+      }
+    },
+    failurePolicy: "Ignore",
+    name: "prometheusrulemutate.monitoring.coreos.com",
+    rules: [{
+      apiGroups: ["monitoring.coreos.com"],
+      apiVersions: ["*"],
+      operations: ["CREATE", "UPDATE"],
+      resources: ["prometheusrules"]
+    }],
+    sideEffects: "None",
+    timeoutSeconds: 10
+  }]
+};
 export const Alertmanager_KubePrometheusStackAlertmanager: KubernetesResource = {
   apiVersion: "monitoring.coreos.com/v1",
   kind: "Alertmanager",
@@ -58758,46 +58838,6 @@ export const Alertmanager_KubePrometheusStackAlertmanager: KubernetesResource =
     version: "v0.28.1"
   }
 };
-export const MutatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = {
-  apiVersion: "admissionregistration.k8s.io/v1",
-  kind: "MutatingWebhookConfiguration",
-  metadata: {
-    annotations: null,
-    labels: {
-      app: "kube-prometheus-stack-admission",
-      "app.kubernetes.io/component": "prometheus-operator-webhook",
-      "app.kubernetes.io/instance": "kube-prometheus-stack",
-      "app.kubernetes.io/managed-by": "Helm",
-      "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator",
-      "app.kubernetes.io/part-of": "kube-prometheus-stack",
-      "app.kubernetes.io/version": "77.5.0",
-      chart: "kube-prometheus-stack-77.5.0",
-      heritage: "Helm",
-      release: "kube-prometheus-stack"
-    },
-    name: "kube-prometheus-stack-admission"
-  },
-  webhooks: [{
-    admissionReviewVersions: ["v1", "v1beta1"],
-    clientConfig: {
-      service: {
-        name: "kube-prometheus-stack-operator",
-        namespace: "monitoring",
-        path: "/admission-prometheusrules/mutate"
-      }
-    },
-    failurePolicy: "Ignore",
-    name: "prometheusrulemutate.monitoring.coreos.com",
-    rules: [{
-      apiGroups: ["monitoring.coreos.com"],
-      apiVersions: ["*"],
-      operations: ["CREATE", "UPDATE"],
-      resources: ["prometheusrules"]
-    }],
-    sideEffects: "None",
-    timeoutSeconds: 10
-  }]
-};
 export const Prometheus_KubePrometheusStackPrometheus: KubernetesResource = {
   apiVersion: "monitoring.coreos.com/v1",
   kind: "Prometheus",
@@ -62496,46 +62536,6 @@ export const ServiceMonitor_KubePrometheusStackPrometheus: KubernetesResource =
     }
   }
 };
-export const ValidatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = {
-  apiVersion: "admissionregistration.k8s.io/v1",
-  kind: "ValidatingWebhookConfiguration",
-  metadata: {
-    annotations: null,
-    labels: {
-      app: "kube-prometheus-stack-admission",
-      "app.kubernetes.io/component": "prometheus-operator-webhook",
-      "app.kubernetes.io/instance": "kube-prometheus-stack",
-      "app.kubernetes.io/managed-by": "Helm",
-      "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator",
-      "app.kubernetes.io/part-of": "kube-prometheus-stack",
-      "app.kubernetes.io/version": "77.5.0",
-      chart: "kube-prometheus-stack-77.5.0",
-      heritage: "Helm",
-      release: "kube-prometheus-stack"
-    },
-    name: "kube-prometheus-stack-admission"
-  },
-  webhooks: [{
-    admissionReviewVersions: ["v1", "v1beta1"],
-    clientConfig: {
-      service: {
-        name: "kube-prometheus-stack-operator",
-        namespace: "monitoring",
-        path: "/admission-prometheusrules/validate"
-      }
-    },
-    failurePolicy: "Ignore",
-    name: "prometheusrulemutate.monitoring.coreos.com",
-    rules: [{
-      apiGroups: ["monitoring.coreos.com"],
-      apiVersions: ["*"],
-      operations: ["CREATE", "UPDATE"],
-      resources: ["prometheusrules"]
-    }],
-    sideEffects: "None",
-    timeoutSeconds: 10
-  }]
-};
 export const ServiceAccount_KubePrometheusStackGrafanaTest: KubernetesResource = {
   apiVersion: "v1",
   kind: "ServiceAccount",
@@ -62903,7 +62903,7 @@ export const Job_KubePrometheusStackAdmissionPatch: KubernetesResource = {
     ttlSecondsAfterFinished: 60
   }
 };
-export const resources: ReadonlyArray<KubernetesResource> = [Namespace_Monitoring, CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom, CustomResourceDefinition_AlertmanagersMonitoringCoreosCom, CustomResourceDefinition_PodmonitorsMonitoringCoreosCom, CustomResourceDefinition_ProbesMonitoringCoreosCom, CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom, CustomResourceDefinition_PrometheusesMonitoringCoreosCom, CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom, CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom, CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom, CustomResourceDefinition_ThanosrulersMonitoringCoreosCom, ServiceAccount_KubePrometheusStackGrafana, ServiceAccount_KubePrometheusStackKubeStateMetrics, ServiceAccount_KubePrometheusStackPrometheusNodeExporter, ServiceAccount_KubePrometheusStackAlertmanager, ServiceAccount_KubePrometheusStackOperator, ServiceAccount_KubePrometheusStackPrometheus, Secret_KubePrometheusStackGrafana, Secret_AlertmanagerKubePrometheusStackAlertmanager, ConfigMap_KubePrometheusStackGrafanaConfigDashboards, ConfigMap_KubePrometheusStackGrafana, ConfigMap_KubePrometheusStackGrafanaDatasource, ConfigMap_KubePrometheusStackAlertmanagerOverview, ConfigMap_KubePrometheusStackApiserver, ConfigMap_KubePrometheusStackClusterTotal, ConfigMap_KubePrometheusStackControllerManager, ConfigMap_KubePrometheusStackEtcd, ConfigMap_KubePrometheusStackGrafanaOverview, ConfigMap_KubePrometheusStackK8sCoredns, ConfigMap_KubePrometheusStackK8sResourcesCluster, ConfigMap_KubePrometheusStackK8sResourcesMulticluster, ConfigMap_KubePrometheusStackK8sResourcesNamespace, ConfigMap_KubePrometheusStackK8sResourcesNode, ConfigMap_KubePrometheusStackK8sResourcesPod, ConfigMap_KubePrometheusStackK8sResourcesWorkload, ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace, ConfigMap_KubePrometheusStackKubelet, ConfigMap_KubePrometheusStackNamespaceByPod, ConfigMap_KubePrometheusStackNamespaceByWorkload, ConfigMap_KubePrometheusStackNodeClusterRsrcUse, ConfigMap_KubePrometheusStackNodeRsrcUse, ConfigMap_KubePrometheusStackNodesAix, ConfigMap_KubePrometheusStackNodesDarwin, ConfigMap_KubePrometheusStackNodes, ConfigMap_KubePrometheusStackPersistentvolumesusage, ConfigMap_KubePrometheusStackPodTotal, ConfigMap_KubePrometheusStackPrometheus, ConfigMap_KubePrometheusStackProxy, ConfigMap_KubePrometheusStackScheduler, ConfigMap_KubePrometheusStackWorkloadTotal, PersistentVolumeClaim_KubePrometheusStackGrafana, ClusterRole_KubePrometheusStackGrafanaClusterrole, ClusterRole_KubePrometheusStackKubeStateMetrics, ClusterRole_KubePrometheusStackOperator, ClusterRole_KubePrometheusStackPrometheus, ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding, ClusterRoleBinding_KubePrometheusStackKubeStateMetrics, ClusterRoleBinding_KubePrometheusStackOperator, ClusterRoleBinding_KubePrometheusStackPrometheus, Role_KubePrometheusStackGrafana, RoleBinding_KubePrometheusStackGrafana, Service_KubePrometheusStackGrafana, Service_KubePrometheusStackKubeStateMetrics, Service_KubePrometheusStackPrometheusNodeExporter, Service_KubePrometheusStackAlertmanager, Service_KubePrometheusStackCoredns, Service_KubePrometheusStackKubeControllerManager, Service_KubePrometheusStackKubeEtcd, Service_KubePrometheusStackKubeProxy, Service_KubePrometheusStackKubeScheduler, Service_KubePrometheusStackOperator, Service_KubePrometheusStackPrometheus, DaemonSet_KubePrometheusStackPrometheusNodeExporter, Deployment_KubePrometheusStackGrafana, Deployment_KubePrometheusStackKubeStateMetrics, Deployment_KubePrometheusStackOperator, Alertmanager_KubePrometheusStackAlertmanager, MutatingWebhookConfiguration_KubePrometheusStackAdmission, Prometheus_KubePrometheusStackPrometheus, PrometheusRule_KubePrometheusStackAlertmanagerRules, PrometheusRule_KubePrometheusStackConfigReloaders, PrometheusRule_KubePrometheusStackEtcd, PrometheusRule_KubePrometheusStackGeneralRules, PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss, PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy, PrometheusRule_KubePrometheusStackK8sRulesContainerResource, PrometheusRule_KubePrometheusStackK8sRulesPodOwner, PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules, PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules, PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules, PrometheusRule_KubePrometheusStackKubeApiserverSlos, PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules, PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules, PrometheusRule_KubePrometheusStackKubeSchedulerRules, PrometheusRule_KubePrometheusStackKubeStateMetrics, PrometheusRule_KubePrometheusStackKubeletRules, PrometheusRule_KubePrometheusStackKubernetesApps, PrometheusRule_KubePrometheusStackKubernetesResources, PrometheusRule_KubePrometheusStackKubernetesStorage, PrometheusRule_KubePrometheusStackKubernetesSystemApiserver, PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager, PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy, PrometheusRule_KubePrometheusStackKubernetesSystemKubelet, PrometheusRule_KubePrometheusStackKubernetesSystemScheduler, PrometheusRule_KubePrometheusStackKubernetesSystem, PrometheusRule_KubePrometheusStackNodeExporterRules, PrometheusRule_KubePrometheusStackNodeExporter, PrometheusRule_KubePrometheusStackNodeNetwork, PrometheusRule_KubePrometheusStackNodeRules, PrometheusRule_KubePrometheusStackPrometheusOperator, PrometheusRule_KubePrometheusStackPrometheus, ServiceMonitor_KubePrometheusStackGrafana, ServiceMonitor_KubePrometheusStackKubeStateMetrics, ServiceMonitor_KubePrometheusStackPrometheusNodeExporter, ServiceMonitor_KubePrometheusStackAlertmanager, ServiceMonitor_KubePrometheusStackCoredns, ServiceMonitor_KubePrometheusStackApiserver, ServiceMonitor_KubePrometheusStackKubeControllerManager, ServiceMonitor_KubePrometheusStackKubeEtcd, ServiceMonitor_KubePrometheusStackKubeProxy, ServiceMonitor_KubePrometheusStackKubeScheduler, ServiceMonitor_KubePrometheusStackKubelet, ServiceMonitor_KubePrometheusStackOperator, ServiceMonitor_KubePrometheusStackPrometheus, ValidatingWebhookConfiguration_KubePrometheusStackAdmission, ServiceAccount_KubePrometheusStackGrafanaTest, ServiceAccount_KubePrometheusStackAdmission, ConfigMap_KubePrometheusStackGrafanaTest, ClusterRole_KubePrometheusStackAdmission, ClusterRoleBinding_KubePrometheusStackAdmission, Role_KubePrometheusStackAdmission, RoleBinding_KubePrometheusStackAdmission, Pod_KubePrometheusStackGrafanaTest, Job_KubePrometheusStackAdmissionCreate, Job_KubePrometheusStackAdmissionPatch];
+export const resources: ReadonlyArray<KubernetesResource> = [Namespace_Monitoring, CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom, CustomResourceDefinition_AlertmanagersMonitoringCoreosCom, CustomResourceDefinition_PodmonitorsMonitoringCoreosCom, CustomResourceDefinition_ProbesMonitoringCoreosCom, CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom, CustomResourceDefinition_PrometheusesMonitoringCoreosCom, CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom, CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom, CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom, CustomResourceDefinition_ThanosrulersMonitoringCoreosCom, ServiceAccount_KubePrometheusStackGrafana, ServiceAccount_KubePrometheusStackKubeStateMetrics, ServiceAccount_KubePrometheusStackPrometheusNodeExporter, ServiceAccount_KubePrometheusStackAlertmanager, ServiceAccount_KubePrometheusStackOperator, ServiceAccount_KubePrometheusStackPrometheus, Secret_KubePrometheusStackGrafana, Secret_AlertmanagerKubePrometheusStackAlertmanager, ConfigMap_KubePrometheusStackGrafanaConfigDashboards, ConfigMap_KubePrometheusStackGrafana, ConfigMap_KubePrometheusStackGrafanaDatasource, ConfigMap_KubePrometheusStackAlertmanagerOverview, ConfigMap_KubePrometheusStackApiserver, ConfigMap_KubePrometheusStackClusterTotal, ConfigMap_KubePrometheusStackControllerManager, ConfigMap_KubePrometheusStackEtcd, ConfigMap_KubePrometheusStackGrafanaOverview, ConfigMap_KubePrometheusStackK8sCoredns, ConfigMap_KubePrometheusStackK8sResourcesCluster, ConfigMap_KubePrometheusStackK8sResourcesMulticluster, ConfigMap_KubePrometheusStackK8sResourcesNamespace, ConfigMap_KubePrometheusStackK8sResourcesNode, ConfigMap_KubePrometheusStackK8sResourcesPod, ConfigMap_KubePrometheusStackK8sResourcesWorkload, ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace, ConfigMap_KubePrometheusStackKubelet, ConfigMap_KubePrometheusStackNamespaceByPod, ConfigMap_KubePrometheusStackNamespaceByWorkload, ConfigMap_KubePrometheusStackNodeClusterRsrcUse, ConfigMap_KubePrometheusStackNodeRsrcUse, ConfigMap_KubePrometheusStackNodesAix, ConfigMap_KubePrometheusStackNodesDarwin, ConfigMap_KubePrometheusStackNodes, ConfigMap_KubePrometheusStackPersistentvolumesusage, ConfigMap_KubePrometheusStackPodTotal, ConfigMap_KubePrometheusStackPrometheus, ConfigMap_KubePrometheusStackProxy, ConfigMap_KubePrometheusStackScheduler, ConfigMap_KubePrometheusStackWorkloadTotal, PersistentVolumeClaim_KubePrometheusStackGrafana, ClusterRole_KubePrometheusStackGrafanaClusterrole, ClusterRole_KubePrometheusStackKubeStateMetrics, ClusterRole_KubePrometheusStackOperator, ClusterRole_KubePrometheusStackPrometheus, ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding, ClusterRoleBinding_KubePrometheusStackKubeStateMetrics, ClusterRoleBinding_KubePrometheusStackOperator, ClusterRoleBinding_KubePrometheusStackPrometheus, Role_KubePrometheusStackGrafana, RoleBinding_KubePrometheusStackGrafana, Service_KubePrometheusStackGrafana, Service_KubePrometheusStackKubeStateMetrics, Service_KubePrometheusStackPrometheusNodeExporter, Service_KubePrometheusStackAlertmanager, Service_KubePrometheusStackCoredns, Service_KubePrometheusStackKubeControllerManager, Service_KubePrometheusStackKubeEtcd, Service_KubePrometheusStackKubeProxy, Service_KubePrometheusStackKubeScheduler, Service_KubePrometheusStackOperator, Service_KubePrometheusStackPrometheus, DaemonSet_KubePrometheusStackPrometheusNodeExporter, Deployment_KubePrometheusStackGrafana, Deployment_KubePrometheusStackKubeStateMetrics, Deployment_KubePrometheusStackOperator, MutatingWebhookConfiguration_KubePrometheusStackAdmission, ValidatingWebhookConfiguration_KubePrometheusStackAdmission, Alertmanager_KubePrometheusStackAlertmanager, Prometheus_KubePrometheusStackPrometheus, PrometheusRule_KubePrometheusStackAlertmanagerRules, PrometheusRule_KubePrometheusStackConfigReloaders, PrometheusRule_KubePrometheusStackEtcd, PrometheusRule_KubePrometheusStackGeneralRules, PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss, PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy, PrometheusRule_KubePrometheusStackK8sRulesContainerResource, PrometheusRule_KubePrometheusStackK8sRulesPodOwner, PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules, PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules, PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules, PrometheusRule_KubePrometheusStackKubeApiserverSlos, PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules, PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules, PrometheusRule_KubePrometheusStackKubeSchedulerRules, PrometheusRule_KubePrometheusStackKubeStateMetrics, PrometheusRule_KubePrometheusStackKubeletRules, PrometheusRule_KubePrometheusStackKubernetesApps, PrometheusRule_KubePrometheusStackKubernetesResources, PrometheusRule_KubePrometheusStackKubernetesStorage, PrometheusRule_KubePrometheusStackKubernetesSystemApiserver, PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager, PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy, PrometheusRule_KubePrometheusStackKubernetesSystemKubelet, PrometheusRule_KubePrometheusStackKubernetesSystemScheduler, PrometheusRule_KubePrometheusStackKubernetesSystem, PrometheusRule_KubePrometheusStackNodeExporterRules, PrometheusRule_KubePrometheusStackNodeExporter, PrometheusRule_KubePrometheusStackNodeNetwork, PrometheusRule_KubePrometheusStackNodeRules, PrometheusRule_KubePrometheusStackPrometheusOperator, PrometheusRule_KubePrometheusStackPrometheus, ServiceMonitor_KubePrometheusStackGrafana, ServiceMonitor_KubePrometheusStackKubeStateMetrics, ServiceMonitor_KubePrometheusStackPrometheusNodeExporter, ServiceMonitor_KubePrometheusStackAlertmanager, ServiceMonitor_KubePrometheusStackCoredns, ServiceMonitor_KubePrometheusStackApiserver, ServiceMonitor_KubePrometheusStackKubeControllerManager, ServiceMonitor_KubePrometheusStackKubeEtcd, ServiceMonitor_KubePrometheusStackKubeProxy, ServiceMonitor_KubePrometheusStackKubeScheduler, ServiceMonitor_KubePrometheusStackKubelet, ServiceMonitor_KubePrometheusStackOperator, ServiceMonitor_KubePrometheusStackPrometheus, ServiceAccount_KubePrometheusStackGrafanaTest, ServiceAccount_KubePrometheusStackAdmission, ConfigMap_KubePrometheusStackGrafanaTest, ClusterRole_KubePrometheusStackAdmission, ClusterRoleBinding_KubePrometheusStackAdmission, Role_KubePrometheusStackAdmission, RoleBinding_KubePrometheusStackAdmission, Pod_KubePrometheusStackGrafanaTest, Job_KubePrometheusStackAdmissionCreate, Job_KubePrometheusStackAdmissionPatch];
 export default {
   resources: resources
 };
diff --git a/packages/manifests/src/index.ts b/packages/manifests/src/index.ts
index 374c817..3cca22c 100644
--- a/packages/manifests/src/index.ts
+++ b/packages/manifests/src/index.ts
@@ -65,8 +65,80 @@ export function getOperatorVersions(operatorId: string): string[] {
 }
 
 export function getOperatorResources(operatorId: string, version?: string): KubernetesResource[] {
+  // `version` is accepted but not yet honoured: the generated objects carry one
+  // resource set per operator, not one per version. Callers that need a
+  // specific version should use getOperatorManifestPaths, which reads the
+  // vendored files and does respect it.
   return OPERATOR_MAP[operatorId].resources as KubernetesResource[];
 }
 
+/**
+ * Absolute paths to an operator's vendored manifests, in the order they must be
+ * applied.
+ *
+ * For consumers that shell out to `kubectl apply -f` rather than going through
+ * a client — which is most bring-up tooling. The alternative is fetching the
+ * same YAML from GitHub releases at run time, which is exactly the
+ * non-determinism this package exists to remove: those downloads are rate
+ * limited per IP and fail mid-transfer rather than cleanly.
+ *
+ * Order matters and is encoded in the filenames. Knative ships as three
+ * numbered parts because its CRDs must be established before serving-core
+ * creates custom resources of those kinds; returning them sorted means a caller
+ * cannot get that wrong by accident.
+ */
+export function getOperatorManifestPaths(operatorId: string, version?: string): string[] {
+  const versions = getOperatorVersions(operatorId);
+  if (!versions || versions.length === 0) {
+    throw new Error(`Unknown operator '${operatorId}'`);
+  }
+
+  const resolved = version ?? versions[versions.length - 1];
+  if (!versions.includes(resolved)) {
+    throw new Error(
+      `Operator '${operatorId}' has no version '${resolved}' (has: ${versions.join(', ')})`
+    );
+  }
+
+  const root = path.join(operatorsRoot(), operatorId);
+  const asDir = path.join(root, resolved);
+  if (fs.existsSync(asDir) && fs.statSync(asDir).isDirectory()) {
+    return fs
+      .readdirSync(asDir)
+      .filter((f) => f.endsWith('.yaml'))
+      .sort((a, b) => a.localeCompare(b))
+      .map((f) => path.join(asDir, f));
+  }
+
+  const asFile = `${asDir}.yaml`;
+  if (fs.existsSync(asFile)) return [asFile];
+
+  throw new Error(
+    `No vendored manifests for '${operatorId}@${resolved}' (looked in ${asDir} and ${asFile})`
+  );
+}
+
+/**
+ * Where the vendored manifests live.
+ *
+ * Walked rather than counted: this resolves correctly from `src`, from `dist`,
+ * and from `dist/esm`, whose depths differ. A fixed number of `..` segments is
+ * right for one of those and wrong for the others, and wrong only shows up at
+ * run time in a consumer.
+ */
+function operatorsRoot(): string {
+  let dir = __dirname;
+  for (let i = 0; i < 6; i++) {
+    const candidate = path.join(dir, 'operators');
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `Vendored manifests not found (looked for an 'operators' directory above ${__dirname})`
+  );
+}
+
 // Re-export generated operator artifacts at the root for convenience
 export { OPERATOR_IDS, OPERATOR_VERSIONS, OPERATOR_MAP, OPERATOR_OBJECTS };