diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml
index bafcc42..bd53e27 100644
--- a/.github/workflows/validate-charts.yml
+++ b/.github/workflows/validate-charts.yml
@@ -332,10 +332,31 @@ jobs:
           : "${FREESAILARR_WG_KEY:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/credential}"
           : "${FREESAILARR_WG_ADDRESSES:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address}"
           echo "Both VPN values arrived non-empty."
+      - name: "PROBE runner facts (throwaway branch only)"
+        run: |
+          echo "runner=${RUNNER_NAME:-?} os=${RUNNER_OS:-?} arch=${RUNNER_ARCH:-?} nproc=$(nproc)"
+          free -m | head -2 || true
+          df -h / | tail -1 || true
+          docker info --format 'server={{.ServerVersion}} storage={{.Driver}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} rootless={{.SecurityOptions}} cpus={{.NCPU}} mem={{.MemTotal}}' || echo "docker info FAILED"
+          docker info 2>&1 | grep -iE "rootless|warning" || echo "(no rootless/warning lines)"
+          ls -l /dev/fuse 2>&1 || echo "(no /dev/fuse)"
       - name: "Install k3d"
         run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
       - name: "Create k3d cluster"
-        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s
+        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback
+      - name: "PROBE k3s did not come up (throwaway branch only)"
+        if: failure()
+        run: |
+          docker ps -a
+          echo "=== k3s node log ==="
+          docker logs k3d-install-test-server-0 2>&1 | tail -120 || true
+          echo "=== docker info ==="
+          docker info || true
+      - name: "PROBE cluster is usable (throwaway branch only)"
+        run: |
+          kubectl get nodes -o wide
+          kubectl get --raw='/readyz?verbose' | tail -5
+          kubectl -n kube-system get pods
       # Every chart reaching this step is one the exclusion filter let through,
       # so the script's SKIP branch is never taken here - it exists for local
       # runs. The variables below are empty for every chart but the one that
diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml
index fd73851..e1ad1fe 100644
--- a/cyberchef/Chart.yaml
+++ b/cyberchef/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 9.0.1+up11.4.0
+version: 9.0.2+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:
diff --git a/freesailarr/Chart.yaml b/freesailarr/Chart.yaml
index a7801e2..dff2fcc 100644
--- a/freesailarr/Chart.yaml
+++ b/freesailarr/Chart.yaml
@@ -8,7 +8,7 @@ description: A Helm chart to deploy a Wireguard-tunneled media automation stack
 
 type: application
 
-version: 3.0.5+up1.0.0
+version: 3.0.6+up1.0.0
 # The chart's own version marker, freely chosen and tied to no upstream. The
 # stack bundles nine independently versioned projects, so there is no single
 # "app version" to track here.