diff --git a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
index bac32b5199..bb66bead12 100644
--- a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
@@ -321,12 +321,13 @@ spec:
         # read access for that lookup is the storage scan-record cleanup role. The
         # main-only publisher attaches SBOM/provenance and signs the digest
         # before this pin may advance.
-        # Revision 9 reads both native flattened metadata and the versioned
+        # Revision 10 reads both native flattened metadata and the versioned
         # metadata wrapper before conditionally reconciling an intact,
         # same-identity payload exactly one version ahead. Payload bytes stay
-        # intact; unproven or concurrently changed state is refused (#5419).
+        # intact; creation-time identity is compared at metadata JSON precision.
+        # Unproven or concurrently changed state is refused (#5419).
         repository: ghcr.io/devantler-tech/platform-kubescape-storage
-        tag: "v0.0.297-sqlite-contention.9-f8fd00273d01ce830150e68dfb636598f9e52099@sha256:743a71c369536f94740ca4241394bc877601ff16d0b30095940900fcd7833ff6"
+        tag: "v0.0.297-sqlite-contention.10-f90df920acce50d6af7a3df0f95a00c02639a173@sha256:09e5868c8a20a958587ec57755c3e447fb25f3d46945e4f0da40788fd3f5ec96"
         pullPolicy: IfNotPresent
     # Hetzner CSI provisions a minimum 10Gi volume; match the PVC request
     # to avoid Helm upgrade failures from PVC shrink rejection.
diff --git a/scripts/tests/test-kubescape-storage-hotfix.sh b/scripts/tests/test-kubescape-storage-hotfix.sh
index 331d983bb9..5c69c47437 100755
--- a/scripts/tests/test-kubescape-storage-hotfix.sh
+++ b/scripts/tests/test-kubescape-storage-hotfix.sh
@@ -12,7 +12,7 @@ readonly native_codec_patch_file="${root_dir}/k8s/bases/infrastructure/controlle
 readonly helm_release="${root_dir}/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml"
 readonly source_commit='b35788b68337134fc2514574cde1ba7f1225fd43'
 readonly image_repository='ghcr.io/devantler-tech/platform-kubescape-storage'
-readonly image_tag='v0.0.297-sqlite-contention.9-f8fd00273d01ce830150e68dfb636598f9e52099@sha256:743a71c369536f94740ca4241394bc877601ff16d0b30095940900fcd7833ff6'
+readonly image_tag='v0.0.297-sqlite-contention.10-f90df920acce50d6af7a3df0f95a00c02639a173@sha256:09e5868c8a20a958587ec57755c3e447fb25f3d46945e4f0da40788fd3f5ec96'
 
 fail() {
   printf 'FAIL: %s\n' "$1" >&2
diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt
index 3c032ba32b..602d84c61d 100644
--- a/scripts/validate-eks-ci-role-policy/approved-surface.txt
+++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt
@@ -68,7 +68,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|tetragon 5781451a70a8dee38ed71
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|alertmanager be4e40e80964e37494dde9c1df0662a58b9b8976d2a57b9efed9c65aebdb9611
 
-helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape 9337fa8f666f46ac0c4d1e868696f0095316ca869c891b3b9fc03e30c60bb72d
+helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape 6a352e2f5cb05f56d3558dcb9a11b1a56275b70c62b508f67e9c5366c79ce390
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|kyverno|kyverno 96afd304ffb1fc5dfcbdca6a7e8a29006735e1ad40a992edd4cc3b03568208ee