diff --git a/apps/overlays/au-syd1/woodpecker/kustomization.yaml b/apps/overlays/au-syd1/woodpecker/kustomization.yaml
index 279ae05..4e1618f 100644
--- a/apps/overlays/au-syd1/woodpecker/kustomization.yaml
+++ b/apps/overlays/au-syd1/woodpecker/kustomization.yaml
@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: woodpecker
     repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.6.3"
+    version: "3.6.5"
     releaseName: woodpecker
     namespace: woodpecker
     valuesFile: values.yaml
diff --git a/apps/overlays/au-syd1/woodpecker/values.yaml b/apps/overlays/au-syd1/woodpecker/values.yaml
index fd16b7e..57dc0da 100644
--- a/apps/overlays/au-syd1/woodpecker/values.yaml
+++ b/apps/overlays/au-syd1/woodpecker/values.yaml
@@ -6,6 +6,11 @@ agent:
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
     WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
+    # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
+    # serviceAccountName is gated behind this agent flag (default false).
+    # The estate's pipelines set backend_options.kubernetes.serviceAccountName
+    # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
+    WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
     WOODPECKER_LOG_LEVEL: debug
   #extraSecretNamesForEnvFrom:
   #  - woodpecker-default-agent-secret