Complete procedures with a way back.

Pin Helm and chart inputs, separate secrets from values and release history, render and server-validate manifests, stage upgrades with bounded waits, verify application behavior, roll back only across compatible data, and operate hooks, CRDs, drift, and secret rotation.

Install pinned Argo CD 3.4.5, constrain an AppProject, verify repository transport and GnuPG-signed commits or tags, preview manual syncs, sequence waves and hooks, harden revision overrides, rehearse rollback, rotate keys, and plan the separate 3.5 sourceIntegrity migration.