diff --git a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
index 4dbcced..0a49fd0 100644
--- a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
+++ b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
@@ -86,12 +86,11 @@ spec:
                 matchLabels:
                   app: engine-image
       mutate:
-        # Use `foreach` over the pod's own containers (relative paths, NOT
-        # request.object.*) so the rule works in BOTH admission AND background
-        # modes. The backgroundController has no admission request, so
-        # request.object.* is unavailable in background scanning.
+        # `request.object` is available in BOTH admission and background modes:
+        # the backgroundController synthesizes an admission-like request for
+        # existing resources, so the same foreach works for both.
         foreach:
-          - list: "spec.containers[]"
+          - list: "request.object.spec.containers"
             patchStrategicMerge: |
               spec:
                 containers:
@@ -99,12 +98,7 @@ spec:
                     resources:
                       requests:
                         cpu: null
-          - list: "spec.initContainers[]"
-            preconditions:
-              all:
-                - key: "{{ spec.initContainers[] || `[]` | length(@) }}"
-                  operator: GreaterThan
-                  value: 0
+          - list: "request.object.spec.initContainers || `[]`"
             patchStrategicMerge: |
               spec:
                 initContainers:
diff --git a/kubernetes/system/kyverno/release.yaml b/kubernetes/system/kyverno/release.yaml
index f3a9e79..3fa5815 100644
--- a/kubernetes/system/kyverno/release.yaml
+++ b/kubernetes/system/kyverno/release.yaml
@@ -12,7 +12,7 @@ spec:
         name: kyverno
         namespace: kyverno
       chart: kyverno
-      version: '3.3.7'
+      version: '3.9.0'
       interval: 5m
   # Minimal footprint for a single-node cluster:
   #  - admissionReports disabled (no extra Redis/Postgres)