diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf
index 9db1fae..47a9871 100644
--- a/bootstrap/platform/main.tf
+++ b/bootstrap/platform/main.tf
@@ -1399,8 +1399,37 @@ EOT
   }
 }
 
+resource "null_resource" "kyverno_helm_recovery" {
+  depends_on = [null_resource.calico_ready]
+
+  triggers = {
+    kubeconfig_path = var.kubeconfig_path
+    namespace       = var.kyverno.namespace
+    release_name    = "kyverno"
+    release_version = var.kyverno.chart_version
+  }
+
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-lc"]
+    command     = <<EOT
+set -euo pipefail
+
+kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" get secrets \
+  -l "owner=helm,name=${self.triggers.release_name}" \
+  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.status}{"\n"}{end}' 2>/dev/null |
+while IFS=$'\t' read -r secret status; do
+  case "$status" in
+    pending-install|pending-upgrade|pending-rollback|failed|uninstalling)
+      kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" delete secret "$secret"
+      ;;
+  esac
+done
+EOT
+  }
+}
+
 resource "helm_release" "kyverno" {
-  depends_on       = [null_resource.calico_ready]
+  depends_on       = [null_resource.kyverno_helm_recovery]
   name             = "kyverno"
   repository       = var.kyverno.repository
   chart            = "kyverno"