diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
index 9b470f0..4a9fa18 100644
--- a/.github/workflows/helm.yaml
+++ b/.github/workflows/helm.yaml
@@ -77,8 +77,9 @@ jobs:
       - name: Generate Helm chart
         run: make helm
 
-      - name: Install Helm chart
+      - name: Install Helm charts
         run: |
+          helm dependency build ./chart/bootc-operator
           helm install bootc-operator ./chart/bootc-operator \
             --kubeconfig $(pwd)/kubeconfig-e2e \
             --create-namespace --namespace bootc-operator \
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d6d31bf..dc12749 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -131,7 +131,7 @@ jobs:
           TAG: ${{ steps.version.outputs.tag }}
         run: make release-manifest IMG="${IMAGE}:${TAG}"
 
-      - name: Package and push Helm chart
+      - name: Package and push Helm charts
         env:
           VERSION: ${{ steps.version.outputs.version }}
           TAG: ${{ steps.version.outputs.tag }}
@@ -139,10 +139,18 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           make helm
+          helm registry login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
+
+          ./bin/yq -i ".version = \"${VERSION}\"" chart/bootc-operator-crds/Chart.yaml
+          ./bin/yq -i ".appVersion = \"${TAG}\"" chart/bootc-operator-crds/Chart.yaml
+          helm package chart/bootc-operator-crds
+          helm push "bootc-operator-crds-${VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts
+
           ./bin/yq -i ".version = \"${VERSION}\"" chart/bootc-operator/Chart.yaml
           ./bin/yq -i ".appVersion = \"${TAG}\"" chart/bootc-operator/Chart.yaml
+          ./bin/yq -i ".dependencies[0].version = \"${VERSION}\"" chart/bootc-operator/Chart.yaml
+          helm dependency build chart/bootc-operator
           helm package chart/bootc-operator
-          helm registry login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
           helm push "bootc-operator-${VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts
 
       - name: Create release
diff --git a/.gitignore b/.gitignore
index e048405..01dc05d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,9 @@ kubeconfig-*
 docs/book/
 user-docs
 chart/bootc-operator/crds/
+chart/bootc-operator/charts/
+chart/bootc-operator/Chart.lock
+chart/bootc-operator-crds/templates/
 chart/bootc-operator/templates/controller-clusterrole.yaml
 chart/bootc-operator/templates/daemon-clusterrole.yaml
 chart/bootc-operator/templates/leader-election-role.yaml
diff --git a/chart/bootc-operator-crds/.helmignore b/chart/bootc-operator-crds/.helmignore
new file mode 100644
index 0000000..fafdb7f
--- /dev/null
+++ b/chart/bootc-operator-crds/.helmignore
@@ -0,0 +1,6 @@
+.DS_Store
+.git/
+.gitignore
+*.swp
+*.bak
+*.tmp
diff --git a/chart/bootc-operator-crds/Chart.yaml b/chart/bootc-operator-crds/Chart.yaml
new file mode 100644
index 0000000..5f817ae
--- /dev/null
+++ b/chart/bootc-operator-crds/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v2
+name: bootc-operator-crds
+description: CRDs for the bootc-operator
+type: application
+version: 0.1.0
+appVersion: "v0.1.1"
+kubeVersion: ">= 1.34.0"
+home: https://github.com/bootc-dev/bootc-operator
+sources:
+  - https://github.com/bootc-dev/bootc-operator
+keywords:
+  - bootc
+  - operator
+  - crd
diff --git a/chart/bootc-operator/Chart.yaml b/chart/bootc-operator/Chart.yaml
index 155c945..1aca653 100644
--- a/chart/bootc-operator/Chart.yaml
+++ b/chart/bootc-operator/Chart.yaml
@@ -13,3 +13,8 @@ keywords:
   - operator
   - os-update
   - node-management
+dependencies:
+  - name: bootc-operator-crds
+    version: "0.1.0"
+    repository: "file://../bootc-operator-crds"
+    condition: crds.install
diff --git a/chart/bootc-operator/values.yaml b/chart/bootc-operator/values.yaml
index 31651db..9aaacc5 100644
--- a/chart/bootc-operator/values.yaml
+++ b/chart/bootc-operator/values.yaml
@@ -1,3 +1,6 @@
+crds:
+  install: true
+
 image:
   repository: ghcr.io/bootc-dev/bootc-operator
   tag: ""
diff --git a/docs/src/helm.md b/docs/src/helm.md
index ebb67c0..91a73e4 100644
--- a/docs/src/helm.md
+++ b/docs/src/helm.md
@@ -7,6 +7,11 @@
 
 ## Install
 
+The operator chart includes the CRDs as a
+[dependency](https://helm.sh/docs/helm/helm_dependency/). CRDs are
+installed in a sub-chart (instead of the `crds/` directory) so that
+`helm upgrade` can update them.
+
 Install from the OCI registry:
 
 ```bash
@@ -18,17 +23,26 @@ To install a specific version:
 
 ```bash
 helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \
-  --version 0.1.0 \
-  --create-namespace --namespace bootc-operator
+  --version 0.1.0 --create-namespace --namespace bootc-operator
 ```
 
 Alternatively, install from a local checkout:
 
 ```bash
+helm dependency build ./chart/bootc-operator
 helm install bootc-operator ./chart/bootc-operator \
   --create-namespace --namespace bootc-operator
 ```
 
+To manage CRDs separately (e.g. with a GitOps tool), disable the
+dependency and install the CRD chart on its own:
+
+```bash
+helm install bootc-operator-crds oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator-crds
+helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \
+  --create-namespace --namespace bootc-operator --set crds.install=false
+```
+
 By default the chart uses the image
 `ghcr.io/bootc-dev/bootc-operator:<appVersion>` where `appVersion` is
 defined in `Chart.yaml`.
@@ -88,6 +102,25 @@ kubectl create secret generic my-pull-secret \
   --type=kubernetes.io/dockerconfigjson
 ```
 
+## Upgrade
+
+```bash
+helm upgrade bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \
+  --version <version> --namespace bootc-operator
+```
+
+Replace `<version>` with the chart version (e.g. `0.2.0`). The CRD
+sub-chart is upgraded automatically.
+
+## Uninstall
+
+```bash
+helm uninstall bootc-operator --namespace bootc-operator
+```
+
+> **Warning**: uninstalling the chart also removes the CRDs and all
+> their instances cluster-wide.
+
 ## Regenerating the chart
 
 Most Helm templates are generated from the kustomize manifests. After
@@ -102,6 +135,7 @@ make helm
 
 | Key | Default | Description |
 |-----|---------|-------------|
+| `crds.install` | `true` | Install the CRD sub-chart |
 | `image.repository` | `ghcr.io/bootc-dev/bootc-operator` | Operator image repository |
 | `image.tag` | `""` (uses `appVersion`) | Operator image tag |
 | `image.pullPolicy` | not set | Kubernetes image pull policy |
diff --git a/hack/sync-helm.sh b/hack/sync-helm.sh
index fd67a75..f55df97 100755
--- a/hack/sync-helm.sh
+++ b/hack/sync-helm.sh
@@ -7,14 +7,15 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 CHART_DIR="$REPO_ROOT/chart/bootc-operator"
+CRD_CHART_DIR="$REPO_ROOT/chart/bootc-operator-crds"
 CONFIG_DIR="$REPO_ROOT/config"
 YQ="${YQ:-yq}"
 
 command -v "$YQ" >/dev/null 2>&1 || { echo "error: yq required (run: make yq)" >&2; exit 1; }
 
-# --- CRDs ---
-mkdir -p "$CHART_DIR/crds"
-cp "$CONFIG_DIR"/crd/bases/*.yaml "$CHART_DIR/crds/"
+# --- CRDs (separate chart) ---
+mkdir -p "$CRD_CHART_DIR/templates"
+cp "$CONFIG_DIR"/crd/bases/*.yaml "$CRD_CHART_DIR/templates/"
 echo "Synced CRDs"
 
 # --- RBAC ---