diff --git a/.github/workflows/cluster-release.yaml b/.github/workflows/cluster-release.yaml
index d57b0a4057..d587fa86a8 100644
--- a/.github/workflows/cluster-release.yaml
+++ b/.github/workflows/cluster-release.yaml
@@ -19,6 +19,8 @@ permissions:
   contents: read
 
 env:
+  # Must match status.webhookPath for Receiver cluster-release/flux-system.
+  FLUX_RECEIVER_URL: https://flux-webhook.kantai.xyz/hook/ef1ac25eeff8057bf82070418a3eabb755c4821b29ff32377c75863bc1692ab5
   OCI_REPOSITORY: ghcr.io/${{ github.repository }}/cluster
 
 jobs:
@@ -103,3 +105,21 @@ jobs:
           DIGEST: ${{ steps.publish.outputs.digest }}
         run: |
           flux tag artifact "oci://${OCI_REPOSITORY}@${DIGEST}" --tag latest
+
+      - name: Notify Flux
+        run: |
+          token="$(curl --fail-with-body --silent --show-error \
+            --header "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=notification-controller" \
+            | jq -er '.value')"
+          for attempt in $(seq 1 30); do
+            if curl --fail-with-body --silent --show-error \
+              --request POST \
+              --header "Authorization: Bearer ${token}" \
+              "${FLUX_RECEIVER_URL}"; then
+              exit 0
+            fi
+            echo "Flux Receiver unavailable (attempt ${attempt}/30); retrying in 10 seconds"
+            sleep 10
+          done
+          exit 1
diff --git a/kubernetes/apps/flux-system/instance/ks/externalsecret.yaml b/kubernetes/apps/flux-system/instance/ks/externalsecret.yaml
deleted file mode 100644
index bbb360e380..0000000000
--- a/kubernetes/apps/flux-system/instance/ks/externalsecret.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-# yaml-language-server: $schema=https://crd.kantai.xyz/external-secrets.io/externalsecret_v1.json
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: github-webhook-token
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword
-  target:
-    name: github-webhook-token-secret
-    template:
-      data:
-        token: "{{ .FLUX_GITHUB_WEBHOOK_TOKEN }}"
-  dataFrom:
-    - extract:
-        key: flux
diff --git a/kubernetes/apps/flux-system/instance/ks/httproute.yaml b/kubernetes/apps/flux-system/instance/ks/httproute.yaml
index 7ba2314034..272bf79f65 100644
--- a/kubernetes/apps/flux-system/instance/ks/httproute.yaml
+++ b/kubernetes/apps/flux-system/instance/ks/httproute.yaml
@@ -2,7 +2,7 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: github-webhook
+  name: cluster-release
   annotations:
     gatus.home-operations.com/endpoint: |-
       conditions: ["[STATUS] == 404"]
diff --git a/kubernetes/apps/flux-system/instance/ks/kustomization.yaml b/kubernetes/apps/flux-system/instance/ks/kustomization.yaml
index c12315eb1a..6f2024f439 100644
--- a/kubernetes/apps/flux-system/instance/ks/kustomization.yaml
+++ b/kubernetes/apps/flux-system/instance/ks/kustomization.yaml
@@ -3,7 +3,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./externalsecret.yaml
   - ./grafanadashboard.yaml
   - ./helmrelease.yaml
   - ./httproute.yaml
diff --git a/kubernetes/apps/flux-system/instance/ks/receiver.yaml b/kubernetes/apps/flux-system/instance/ks/receiver.yaml
index 116c934e39..ca4320c94f 100644
--- a/kubernetes/apps/flux-system/instance/ks/receiver.yaml
+++ b/kubernetes/apps/flux-system/instance/ks/receiver.yaml
@@ -3,18 +3,20 @@
 apiVersion: notification.toolkit.fluxcd.io/v1
 kind: Receiver
 metadata:
-  name: github-webhook
+  name: cluster-release
 spec:
-  type: github
-  events:
-    - ping
-    - push
-  secretRef:
-    name: github-webhook-token-secret
+  type: generic-oidc
+  oidcProviders:
+    - issuerURL: https://token.actions.githubusercontent.com
+      audience: notification-controller
+      validations:
+        - expression: claims.repository == "jfroy/flatops"
+          message: unexpected repository
+        - expression: claims.ref == "refs/heads/main"
+          message: release must run from main
+        - expression: claims.workflow_ref == "jfroy/flatops/.github/workflows/cluster-release.yaml@refs/heads/main"
+          message: unexpected workflow
   resources:
     - apiVersion: source.toolkit.fluxcd.io/v1
-      kind: GitRepository
-      name: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1
-      kind: Kustomization
+      kind: OCIRepository
       name: flux-system
diff --git a/kubernetes/cluster/ocirepository.yaml b/kubernetes/cluster/ocirepository.yaml
new file mode 100644
index 0000000000..5a0c621cf2
--- /dev/null
+++ b/kubernetes/cluster/ocirepository.yaml
@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://crd.kantai.xyz/source.toolkit.fluxcd.io/ocirepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+  annotations:
+    # Keep the source in place when FluxInstance takes over its management.
+    kustomize.toolkit.fluxcd.io/prune: Disabled
+spec:
+  interval: 5m
+  ref:
+    tag: latest
+  url: oci://ghcr.io/jfroy/flatops/cluster
+  verify:
+    provider: cosign
+    matchOIDCIdentity:
+      - issuer: ^https://token[.]actions[.]githubusercontent[.]com$
+        subject: ^https://github[.]com/jfroy/flatops/[.]github/workflows/cluster-release[.]yaml@refs/heads/main$