diff --git a/.trivyignore b/.trivyignore
index 31440c6..fb206e0 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -7,3 +7,6 @@ CVE-2026-41568
 
 # go.etcd.io/bbolt v1.4.3 dep, no fix available
 CVE-2026-33817
+
+# golang.org/x/crypto/openpgp unmaintained, no fix (indirect, unreachable)
+GO-2026-5932
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d8e1c3c..31aafd5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,11 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- helm: when `executor.kafkaUser.enabled`, pass the executor's own client-cert + CA secret names to the executor as `JOB_KAFKA_CLIENT_CERT_SECRET` / `JOB_KAFKA_CA_CERT_SECRET` env, so it mounts mTLS Kafka certs into the per-task agent Jobs it spawns (agent-task-executor ≥ v0.4.0). Fixes spawned agent Jobs (pr-reviewer, github-releaser) crashing on `open /client-cert/file: no such file` against mTLS Kafka. Default off (`kafkaUser` disabled) → no env, spawned Jobs unchanged. Chart 0.4.1 → 0.5.0.
+- chore: bump Go 1.26.4 → 1.26.5 to clear stdlib advisory GO-2026-5856 (blocks precommit/CI).
+
 ## v0.76.1
 
 - helm: harden mTLS cert volume `defaultMode` `420` (0644) → `288` (0440) — drops world-read on the mounted client key while keeping group-read so a non-root pod (`runAsUser`+`fsGroup`) can still read it (`0400` would deny it). Chart 0.4.0 → 0.4.1. Matches the `bborbe/maintainer` chart fix.
diff --git a/go.mod b/go.mod
index 1638a3b..9c88b4f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/bborbe/agent
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/bborbe/collection v1.20.17
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index 7b3f1e3..de100cc 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -3,7 +3,7 @@ name: agent
 description: bborbe agent framework — event-driven, Kafka-based, K8s-native task platform (controller, executor, and example agents)
 type: application
 # Chart version — bumped on chart changes, independent of appVersion.
-version: 0.4.1
+version: 0.5.0
 # Default image tag for the framework components when values don't override.
 appVersion: "0.3.1"
 home: https://github.com/bborbe/agent
diff --git a/helm/templates/executor-deployment.yaml b/helm/templates/executor-deployment.yaml
index bfe8eba..0de4fb4 100644
--- a/helm/templates/executor-deployment.yaml
+++ b/helm/templates/executor-deployment.yaml
@@ -77,6 +77,18 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            {{- if .Values.executor.kafkaUser.enabled }}
+            {{- $ku := .Values.executor.kafkaUser }}
+            {{- $userName := $ku.userName | default (printf "%s-agent-task-executor" (include "agent.namespace" .)) }}
+            # mTLS Kafka: the spawned agent Jobs also connect Kafka, so hand the
+            # executor its own client-cert + CA secret names to mount into each Job
+            # (agent-task-executor >= v0.4.0 JOB_KAFKA_* support). Empty when kafkaUser
+            # is disabled → plaintext, spawned Jobs unchanged.
+            - name: JOB_KAFKA_CLIENT_CERT_SECRET
+              value: {{ $ku.clientSecret | default $userName | quote }}
+            - name: JOB_KAFKA_CA_CERT_SECRET
+              value: {{ $ku.caCertSecret | quote }}
+            {{- end }}
           ports:
             - containerPort: 9090
               name: http