diff --git a/argocd.tf b/argocd.tf
index 91d992a..e001c9a 100644
--- a/argocd.tf
+++ b/argocd.tf
@@ -6,7 +6,7 @@ locals {
     # NB argocd-server will automatically reload this secret.
     # NB alternatively we could set the server.certificate.enabled helm value. but
     #    that does not allow us to fully customize the certificate (e.g. subject).
-    # see https://github.com/argoproj/argo-helm/blob/argo-cd-7.6.8/charts/argo-cd/templates/argocd-server/certificate.yaml
+    # see https://github.com/argoproj/argo-helm/blob/argo-cd-7.6.12/charts/argo-cd/templates/argocd-server/certificate.yaml
     # see https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/
     # see https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.Certificate
     {
@@ -47,7 +47,7 @@ locals {
 
 # set the configuration.
 # NB the default values are described at:
-#       https://github.com/argoproj/argo-helm/blob/argo-cd-7.6.8/charts/argo-cd/values.yaml
+#       https://github.com/argoproj/argo-helm/blob/argo-cd-7.6.12/charts/argo-cd/values.yaml
 #    NB make sure you are seeing the same version of the chart that you are installing.
 # NB this disables the tls between argocd components, that is, the internal
 #    cluster traffic does not uses tls, and only the ingress uses tls.
@@ -64,7 +64,7 @@ data "helm_template" "argocd" {
   chart      = "argo-cd"
   # see https://artifacthub.io/packages/helm/argo/argo-cd
   # renovate: datasource=helm depName=argo-cd registryUrl=https://argoproj.github.io/argo-helm
-  version      = "7.6.8" # app version 2.12.4.
+  version      = "7.6.12" # app version 2.12.6.
   kube_version = var.kubernetes_version
   api_versions = []
   values = [yamlencode({