diff --git a/terraform/main.tf b/terraform/main.tf
index 06f3073..8250fd8 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -2914,7 +2914,7 @@ resource "null_resource" "deploy_cloudnativepg_nprd_apps" {
       # Verify installation
       echo ""
       echo "Verifying CloudNativePG installation..."
-      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m || true
+      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m
       
       echo ""
       echo "CloudNativePG Pods:"
@@ -2931,30 +2931,9 @@ resource "null_resource" "deploy_cloudnativepg_nprd_apps" {
     EOT
   }
 
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing CloudNativePG from NPRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/nprd-apps.yaml"
-      
-      if kubectl get namespace cnpg-system &>/dev/null; then
-        echo "Removing CloudNativePG operator..."
-        CNPG_MANIFEST_URL="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.28/releases/cnpg-1.28.0.yaml"
-        kubectl delete -f "$${CNPG_MANIFEST_URL}" --ignore-not-found=true || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace cnpg-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ CloudNativePG removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
+  # No destroy provisioner: a version bump replaces this resource, and deleting the
+  # operator manifest would delete the CNPG CRDs and with them every Cluster/Backup.
+  # Uninstalling CloudNativePG is a manual operation.
 
   depends_on = [
     null_resource.merge_kubeconfigs,
@@ -3012,7 +2991,7 @@ resource "null_resource" "deploy_cloudnativepg_prd_apps" {
       # Verify installation
       echo ""
       echo "Verifying CloudNativePG installation..."
-      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m || true
+      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m
       
       echo ""
       echo "CloudNativePG Pods:"
@@ -3029,30 +3008,9 @@ resource "null_resource" "deploy_cloudnativepg_prd_apps" {
     EOT
   }
 
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing CloudNativePG from PRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/prd-apps.yaml"
-      
-      if kubectl get namespace cnpg-system &>/dev/null; then
-        echo "Removing CloudNativePG operator..."
-        CNPG_MANIFEST_URL="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.28/releases/cnpg-1.28.0.yaml"
-        kubectl delete -f "$${CNPG_MANIFEST_URL}" --ignore-not-found=true || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace cnpg-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ CloudNativePG removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
+  # No destroy provisioner: a version bump replaces this resource, and deleting the
+  # operator manifest would delete the CNPG CRDs and with them every Cluster/Backup.
+  # Uninstalling CloudNativePG is a manual operation.
 
   depends_on = [
     null_resource.merge_kubeconfigs,
@@ -3110,7 +3068,7 @@ resource "null_resource" "deploy_cloudnativepg_poc_apps" {
       # Verify installation
       echo ""
       echo "Verifying CloudNativePG installation..."
-      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m || true
+      kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=5m
       
       echo ""
       echo "CloudNativePG Pods:"
@@ -3127,30 +3085,9 @@ resource "null_resource" "deploy_cloudnativepg_poc_apps" {
     EOT
   }
 
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing CloudNativePG from POC Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/poc-apps.yaml"
-      
-      if kubectl get namespace cnpg-system &>/dev/null; then
-        echo "Removing CloudNativePG operator..."
-        CNPG_MANIFEST_URL="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.28/releases/cnpg-1.28.0.yaml"
-        kubectl delete -f "$${CNPG_MANIFEST_URL}" --ignore-not-found=true || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace cnpg-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ CloudNativePG removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
+  # No destroy provisioner: a version bump replaces this resource, and deleting the
+  # operator manifest would delete the CNPG CRDs and with them every Cluster/Backup.
+  # Uninstalling CloudNativePG is a manual operation.
 
   depends_on = [
     null_resource.merge_kubeconfigs,
diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example
index 38ed375..02f8b24 100644
--- a/terraform/terraform.tfvars.example
+++ b/terraform/terraform.tfvars.example
@@ -367,10 +367,11 @@ opensearch_operator_version = "2.8.0"
 # Check latest version: https://github.com/mongodb/mongodb-kubernetes-operator/releases
 mongodb_operator_version = "0.13.0"
 
-# CloudNativePG Operator version (default: 1.28.0)
-# Installed via manifest, not Helm
-# Check latest version: https://github.com/cloudnative-pg/cloudnative-pg/releases
-cloudnativepg_operator_version = "1.28.0"
+# CloudNativePG Operator version (default: 1.30.1)
+# Installed via manifest (server-side apply), not Helm. Bumping it re-applies the
+# manifest; existing PostgreSQL clusters roll their instance managers (primary last).
+# Read the release notes first: https://cloudnative-pg.io/documentation/current/release_notes/
+cloudnativepg_operator_version = "1.30.1"
 
 # GitHub Actions Runner Controller (ARC) Helm chart version (default: 0.13.1)
 # Check latest version: https://github.com/actions/actions-runner-controller/releases
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 2b1307a..a9ea723 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -404,7 +404,7 @@ variable "mongodb_operator_version" {
 variable "cloudnativepg_operator_version" {
   description = "CloudNativePG Operator version (installed via manifest)"
   type        = string
-  default     = "1.28.0"
+  default     = "1.30.1"
 }
 
 variable "github_arc_controller_version" {