diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0372e36..2db4fef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,14 @@ All notable changes to this project will be documented in this file.
 - Bump stackable-operator to 0.114.0 ([#439]).
 - Bump stackabke-operator to 0.115.0 ([#444]).
 
+### Fixed
+
+- Support ConfigMaps and Secrets with names longer than 63 characters. Previously the restarter put
+  the object name into the name part of an annotation key, which Kubernetes limits to 63 characters,
+  causing it to reject the entire StatefulSet ([#443]).
+
 [#439]: https://github.com/stackabletech/commons-operator/pull/439
+[#443]: https://github.com/stackabletech/commons-operator/pull/443
 [#444]: https://github.com/stackabletech/commons-operator/pull/444
 
 ## [26.7.0] - 2026-07-21
diff --git a/Cargo.lock b/Cargo.lock
index 4b5f2c5..6c8ced6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -316,9 +316,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+checksum = "9066c49992464636f92905fa096ec58baaa4d57ec19a5c096c68d3e25ef3d136"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -358,9 +358,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.5"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301b56658598e48f3648647ac6fc887be7e7108eddfa4e9b63fcf3ec58c0cadf"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -368,9 +368,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.5"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94a65403d1a1bd28f7dc68eb8506e8874808ee5eecb59298de588e2e1407a078"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
  "anstream",
  "anstyle",
@@ -912,9 +912,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
 
 [[package]]
 name = "flagset"
@@ -1704,7 +1704,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "darling 0.24.0",
  "regex",
@@ -3101,7 +3101,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -3145,7 +3145,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator"
 version = "0.115.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "base64 0.23.1",
  "clap",
@@ -3189,7 +3189,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "darling 0.24.0",
  "proc-macro2",
@@ -3200,7 +3200,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.2"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3217,7 +3217,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "axum",
  "clap",
@@ -3241,7 +3241,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "kube",
  "schemars",
@@ -3255,7 +3255,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3273,7 +3273,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.2"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#fb2d86579f4e3df008f78f0e527a012243483a2d"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#03d8966c3ac58f42ad637e1eabaa14598150b9e3"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -4193,9 +4193,9 @@ dependencies = [
 
 [[package]]
 name = "xml"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "636f85e5ca6488e96401b61eb7de54f4e44755c988af0f52cf90230c312a1a89"
+checksum = "2f45bb2c13fec6a6cb4c0f76a7e94839e110a14ec803ec2940777a94c347bc52"
 
 [[package]]
 name = "yoke"
@@ -4222,18 +4222,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.nix b/Cargo.nix
index afdf2c7..e35efcf 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -989,12 +989,9 @@ rec {
       };
       "cc" = rec {
         crateName = "cc";
-        version = "1.4.0";
-        edition = "2018";
-        sha256 = "1fc26n76n7gr37m2q0xw5l8jpn4sd33hvyppmwhv6v4fcyxq3pas";
-        authors = [
-          "Alex Crichton <alex@alexcrichton.com>"
-        ];
+        version = "1.4.1";
+        edition = "2021";
+        sha256 = "0dniydgf5lv8dh4mr6n1gvas9albqmp0kyh557wkcij6jacw8rlh";
         dependencies = [
           {
             name = "find-msvc-tools";
@@ -1019,7 +1016,7 @@ rec {
           }
         ];
         features = {
-          "parallel" = [ "dep:libc" "dep:jobserver" ];
+          "parallel" = [ "dep:jobserver" "dep:libc" ];
         };
         resolvedDefaultFeatures = [ "parallel" ];
       };
@@ -1135,10 +1132,10 @@ rec {
       };
       "clap" = rec {
         crateName = "clap";
-        version = "4.6.5";
+        version = "4.6.6";
         edition = "2024";
         crateBin = [];
-        sha256 = "1pyaq1cfrwzwcfdlxynxiq8fgrvvi3yccyk490v8zr4qhmjmc6rh";
+        sha256 = "1jmx5z8d6jbvxdz6dybh599s4rd7ns6sl90p2rrdga09yh3pwg27";
         dependencies = [
           {
             name = "clap_builder";
@@ -1177,9 +1174,9 @@ rec {
       };
       "clap_builder" = rec {
         crateName = "clap_builder";
-        version = "4.6.5";
+        version = "4.6.6";
         edition = "2024";
-        sha256 = "0y500wa2x3jqvsc95dgcbvp0hj47x038bsv8vkvjigd1s41m99ll";
+        sha256 = "12cqg25zpjc3k82cpqa2v9h7s3vk1vydpgnwl8lfg6lfm2jzwj3v";
         dependencies = [
           {
             name = "anstream";
@@ -2809,9 +2806,9 @@ rec {
       };
       "find-msvc-tools" = rec {
         crateName = "find-msvc-tools";
-        version = "0.1.9";
-        edition = "2018";
-        sha256 = "10nmi0qdskq6l7zwxw5g56xny7hb624iki1c39d907qmfh3vrbjv";
+        version = "0.1.10";
+        edition = "2021";
+        sha256 = "1pp1612g5k6im9732g16j6a87czhb35xcyzlrpq2mkgdwrrkbdr6";
         libName = "find_msvc_tools";
 
       };
@@ -5419,9 +5416,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "k8s_version";
         authors = [
@@ -10191,9 +10188,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_certs";
         authors = [
@@ -10377,9 +10374,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_operator";
         authors = [
@@ -10559,7 +10556,8 @@ rec {
           "client-feature-gates" = [ "dep:winnow" ];
           "crds" = [ "dep:stackable-versioned" ];
           "default" = [ "crds" ];
-          "full" = [ "client-feature-gates" "crds" "certs" "test-support" "time" "webhook" "kube-ws" ];
+          "full" = [ "client-feature-gates" "crds" "certs" "test-support" "time" "webhook" "kube-ws" "kube-cel" ];
+          "kube-cel" = [ "kube/cel" ];
           "kube-ws" = [ "kube/ws" ];
           "time" = [ "stackable-shared/time" ];
           "webhook" = [ "dep:stackable-webhook" ];
@@ -10572,9 +10570,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         procMacro = true;
         libName = "stackable_operator_derive";
@@ -10607,9 +10605,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_shared";
         authors = [
@@ -10688,9 +10686,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_telemetry";
         authors = [
@@ -10798,9 +10796,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_versioned";
         authors = [
@@ -10848,9 +10846,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         procMacro = true;
         libName = "stackable_versioned_macros";
@@ -10916,9 +10914,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "fb2d86579f4e3df008f78f0e527a012243483a2d";
-          sha256 = "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "03d8966c3ac58f42ad637e1eabaa14598150b9e3";
+          sha256 = "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7";
         };
         libName = "stackable_webhook";
         authors = [
@@ -14787,9 +14785,9 @@ rec {
       };
       "xml" = rec {
         crateName = "xml";
-        version = "1.3.0";
+        version = "1.4.0";
         edition = "2021";
-        sha256 = "128s58qhq8whrx90zbw8r5algr7lakgbf7mn05jfk234rbjqavv3";
+        sha256 = "0lmw8z1r8ykp80lyq0y89shi1q9r93lsfxhg9k5sdipy2cnbni9g";
         authors = [
           "Vladimir Matveev <vmatveev@citrine.cc>"
           "Kornel (https://github.com/kornelski)"
@@ -14864,13 +14862,9 @@ rec {
       };
       "zerocopy" = rec {
         crateName = "zerocopy";
-        version = "0.8.55";
+        version = "0.8.56";
         edition = "2021";
-        sha256 = "1swncvj53zi9yr08b9ddhfrcmlrmh6ijxzxcr3p6w3qlgg6hb8dm";
-        authors = [
-          "Joshua Liebow-Feeser <joshlf@google.com>"
-          "Jack Wrenn <jswrenn@amazon.com>"
-        ];
+        sha256 = "1svmifchgdk0sm7v24lfwhhxis57gwa2lg21ingmmd5dhgjn8rsm";
         dependencies = [
           {
             name = "zerocopy-derive";
@@ -14900,15 +14894,11 @@ rec {
       };
       "zerocopy-derive" = rec {
         crateName = "zerocopy-derive";
-        version = "0.8.55";
+        version = "0.8.56";
         edition = "2021";
-        sha256 = "1sr8w9zc62lxmw7v6n89nxvqlki48b0nyfpyri6dd367f3xpds8g";
+        sha256 = "1hfz1hfxj86y1sgyia8gbisny9bl9bwlbahg4jypjmsp43y45azj";
         procMacro = true;
         libName = "zerocopy_derive";
-        authors = [
-          "Joshua Liebow-Feeser <joshlf@google.com>"
-          "Jack Wrenn <jswrenn@amazon.com>"
-        ];
         dependencies = [
           {
             name = "proc-macro2";
diff --git a/Cargo.toml b/Cargo.toml
index dbe7112..505d47a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,17 +15,17 @@ stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git",
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }
 chrono = "0.4"
-clap = "4.5"
+clap = "4.6"
 futures = { version = "0.3", features = ["compat"] }
-http = "1.3"
-json-patch = "4.1"
+http = "1.5"
+json-patch = "4.2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 snafu = "0.9"
 strum = { version = "0.28", features = ["derive"] }
-tokio = { version = "1.40", features = ["full"] }
+tokio = { version = "1.53", features = ["full"] }
 tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "feat/ensure-max-length-pub" }
diff --git a/crate-hashes.json b/crate-hashes.json
index 43cd4b7..2ad8138 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,11 +1,11 @@
 {
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#k8s-version@0.1.3": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-certs@0.4.1": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-operator-derive@0.3.1": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-operator@0.115.0": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-shared@0.1.2": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-telemetry@0.6.5": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-versioned-macros@0.11.1": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-versioned@0.11.1": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.115.0#stackable-webhook@0.9.2": "1w57n5xx0ik63r252l1v5ymm51jlsf7v4pj682b902k8vinlhyqb"
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#k8s-version@0.1.3": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-certs@0.4.1": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-operator-derive@0.3.1": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-operator@0.115.0": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-shared@0.1.2": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-telemetry@0.6.5": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-versioned-macros@0.11.1": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-versioned@0.11.1": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=feat%2Fensure-max-length-pub#stackable-webhook@0.9.2": "0j37jqw7xrk0wf5ainwcm9p2b6x8iidjn00ka2b2d4mab7ys7hw7"
 }
\ No newline at end of file
diff --git a/docs/modules/commons-operator/pages/restarter.adoc b/docs/modules/commons-operator/pages/restarter.adoc
index 7f5f887..3ba89fb 100644
--- a/docs/modules/commons-operator/pages/restarter.adoc
+++ b/docs/modules/commons-operator/pages/restarter.adoc
@@ -61,6 +61,16 @@ spec:
 ...
 ----
 
+==== Pod template annotations
+
+To detect changes, the operator adds an annotation for every referenced ConfigMap and Secret to the Pod template of the StatefulSet.
+Its key is `configmap.restarter.stackable.tech/\{name\}` or `secret.restarter.stackable.tech/\{name\}`, its value is the UID and resource version of the referenced object (or `changes-ignored` if it is excluded as described above).
+Kubernetes rolling-restarts the Pods whenever one of these values changes.
+These annotations are managed by the operator, there is no need to set them yourself.
+
+Object names can be up to 253 characters long, but Kubernetes limits the part of an annotation key after the `/` to 63 characters.
+Longer names are therefore truncated and filled up with the hash of the original name to make sure there are no clashes.
+
 == ConfigMap/Secret
 
 Label:: `restarter.stackable.tech/ignore`
diff --git a/rust/operator-binary/src/restart_controller/statefulset.rs b/rust/operator-binary/src/restart_controller/statefulset.rs
index b7d60ef..b31daca 100644
--- a/rust/operator-binary/src/restart_controller/statefulset.rs
+++ b/rust/operator-binary/src/restart_controller/statefulset.rs
@@ -22,11 +22,11 @@ use stackable_operator::{
             Config, WatchStreamExt, applier,
             controller::{Action, ReconcileRequest, trigger_self, trigger_with},
             events::{Recorder, Reporter},
-            reflector,
-            reflector::{ObjectRef, Store},
+            reflector::{self, ObjectRef, Store},
             watcher::{self, watcher},
         },
     },
+    kvp::{self, KeyError},
     logging::controller::{ReconcilerError, report_controller_reconciled},
     namespace::WatchNamespace,
 };
@@ -36,6 +36,12 @@ use crate::utils::delayed_init::{DelayedInit, InitDropped, Initializer};
 
 const FULL_CONTROLLER_NAME: &str = "statefulset.restarter.commons.stackable.tech";
 
+/// Prefix of the Pod annotations tracking the referenced ConfigMaps.
+const CONFIGMAP_ANNOTATION_PREFIX: &str = "configmap.restarter.stackable.tech";
+
+/// Prefix of the Pod annotations tracking the referenced Secrets.
+const SECRET_ANNOTATION_PREFIX: &str = "secret.restarter.stackable.tech";
+
 pub struct Ctx {
     client: Client,
     cms: DelayedInit<Store<PartialObjectMeta<ConfigMap>>>,
@@ -47,7 +53,8 @@ pub struct Ctx {
 pub enum Error {
     #[snafu(display("StatefulSet object is invalid"))]
     InvalidStatefulSet {
-        source: error_boundary::InvalidObject,
+        #[snafu(source(from(error_boundary::InvalidObject, Box::new)))]
+        source: Box<error_boundary::InvalidObject>,
     },
 
     #[snafu(display("failed to patch object {obj_ref}"))]
@@ -61,6 +68,12 @@ pub enum Error {
 
     #[snafu(display("secrets initializer was cancelled"))]
     SecretsUninitialized { source: InitDropped },
+
+    #[snafu(display("failed to build annotation key for object {object_name:?}"))]
+    InvalidAnnotationKey {
+        source: KeyError,
+        object_name: String,
+    },
 }
 
 impl ReconcilerError for Error {
@@ -74,6 +87,7 @@ impl ReconcilerError for Error {
             Error::PatchFailed { obj_ref, .. } => Some(*obj_ref.clone()),
             Error::ConfigMapsUninitialized { .. } => None,
             Error::SecretsUninitialized { .. } => None,
+            Error::InvalidAnnotationKey { .. } => None,
         }
     }
 }
@@ -133,7 +147,7 @@ pub async fn start<F>(
                 trigger_all(
                     {
                         let cm_reader = cm_store.as_reader();
-                        reflector(
+                        reflector::reflector(
                             cm_store,
                             watcher(
                                 cms,
@@ -153,7 +167,7 @@ pub async fn start<F>(
                 trigger_all(
                     {
                         let secret_reader = secret_store.as_reader();
-                        reflector(
+                        reflector::reflector(
                             secret_store,
                             watcher(
                                 secrets,
@@ -172,7 +186,7 @@ pub async fn start<F>(
                 ),
             ),
             trigger_self(
-                reflector(
+                reflector::reflector(
                     sts_store,
                     watcher(
                         stses,
@@ -244,6 +258,22 @@ fn find_pod_refs<'a, K: Resource + 'a>(
         .chain(container_env_from_refs)
 }
 
+/// Builds the annotation key tracking the referenced ConfigMap or Secret named `object_name`.
+///
+/// Kubernetes object names are DNS subdomains and can be up to 253 characters long, but the name
+/// part of an annotation key (everything after the `/`) is a qualified name and must not exceed 63
+/// characters. Embedding the object name verbatim therefore produced an invalid annotation key for
+/// longer names, which made Kubernetes reject the entire StatefulSet - either at admission time via
+/// our mutating webhook, or when this controller patched it.
+///
+/// So instead we rely on [`kvp::Key::shortened_to_valid_length`] to keep the name within limits.
+fn annotation_key(prefix: &str, object_name: &str) -> Result<String, Error> {
+    let key = kvp::Key::shortened_to_valid_length(Some(prefix), object_name)
+        .context(InvalidAnnotationKeySnafu { object_name })?;
+
+    Ok(key.to_string())
+}
+
 pub async fn get_updated_restarter_annotations(
     sts: &StatefulSet,
     ctx: Arc<Ctx>,
@@ -297,24 +327,22 @@ pub async fn get_updated_restarter_annotations(
                 .then_some(value)
         })
         .collect::<BTreeSet<_>>();
-    annotations.extend(
-        cm_refs
-            .map(|cm_ref| (cm_ref.name.clone(), cms.get(&cm_ref)))
-            .map(|(cm_name, cm)| {
-                (
-                    format!("configmap.restarter.stackable.tech/{cm_name}",),
-                    if let Some(cm) = cm
-                        && let Some(uid) = &cm.metadata.uid
-                        && let Some(resource_version) = &cm.metadata.resource_version
-                        && !ignored_cms.contains(&cm_name)
-                    {
-                        format!("{uid}/{resource_version}",)
-                    } else {
-                        "changes-ignored".to_owned()
-                    },
-                )
-            }),
-    );
+    for cm_ref in cm_refs {
+        let cm_name = &cm_ref.name;
+        let cm = cms.get(&cm_ref);
+
+        let value = if let Some(cm) = cm
+            && let Some(uid) = &cm.metadata.uid
+            && let Some(resource_version) = &cm.metadata.resource_version
+            && !ignored_cms.contains(cm_name)
+        {
+            format!("{uid}/{resource_version}",)
+        } else {
+            "changes-ignored".to_owned()
+        };
+
+        annotations.insert(annotation_key(CONFIGMAP_ANNOTATION_PREFIX, cm_name)?, value);
+    }
 
     let secret_refs = pod_specs
         .flat_map(|pod_spec| {
@@ -351,24 +379,25 @@ pub async fn get_updated_restarter_annotations(
         })
         .map(|x| x.1)
         .collect::<BTreeSet<_>>();
-    annotations.extend(
-        secret_refs
-            .map(|secret_ref| (secret_ref.name.clone(), secrets.get(&secret_ref)))
-            .map(|(secret_name, secret)| {
-                (
-                    format!("secret.restarter.stackable.tech/{secret_name}",),
-                    if let Some(secret) = secret
-                        && let Some(uid) = &secret.metadata.uid
-                        && let Some(resource_version) = &secret.metadata.resource_version
-                        && !ignored_secrets.contains(&secret_name)
-                    {
-                        format!("{uid}/{resource_version}",)
-                    } else {
-                        "changes-ignored".to_owned()
-                    },
-                )
-            }),
-    );
+    for secret_ref in secret_refs {
+        let secret_name = &secret_ref.name;
+        let secret = secrets.get(&secret_ref);
+
+        let value = if let Some(secret) = secret
+            && let Some(uid) = &secret.metadata.uid
+            && let Some(resource_version) = &secret.metadata.resource_version
+            && !ignored_secrets.contains(secret_name)
+        {
+            format!("{uid}/{resource_version}",)
+        } else {
+            "changes-ignored".to_owned()
+        };
+
+        annotations.insert(
+            annotation_key(SECRET_ANNOTATION_PREFIX, secret_name)?,
+            value,
+        );
+    }
 
     Ok(annotations)
 }
@@ -429,3 +458,33 @@ fn error_policy(_obj: Arc<DeserializeGuard<StatefulSet>>, error: &Error, _ctx: A
         _ => Action::requeue(Duration::from_secs(5)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_annotation_names() {
+        assert_eq!(
+            annotation_key(CONFIGMAP_ANNOTATION_PREFIX, "my-configmap")
+                .expect("annotation key for a short ConfigMap name must be valid"),
+            "configmap.restarter.stackable.tech/my-configmap"
+        );
+        assert_eq!(
+            annotation_key(
+                SECRET_ANNOTATION_PREFIX,
+                "secret-not-ignored-with-very-looooooong-name-with-63-characters"
+            )
+            .expect("annotation key for a Secret name of exactly 63 characters must be valid"),
+            "secret.restarter.stackable.tech/secret-not-ignored-with-very-looooooong-name-with-63-characters"
+        );
+        assert_eq!(
+            annotation_key(
+                SECRET_ANNOTATION_PREFIX,
+                "hiverest-owner-user.stackable-postgres-cluster.credentials.postgresql.acid.zalan.do"
+            )
+            .expect("annotation key for an overly long Secret name must be shortened and valid"),
+            "secret.restarter.stackable.tech/hiverest-owner-user.stackable-postgres-cluster.credent-8221aa71"
+        );
+    }
+}
diff --git a/tests/templates/kuttl/restarter/10-create-test-resources.yaml b/tests/templates/kuttl/restarter/10-create-test-resources.yaml
index ba24fa7..966de31 100644
--- a/tests/templates/kuttl/restarter/10-create-test-resources.yaml
+++ b/tests/templates/kuttl/restarter/10-create-test-resources.yaml
@@ -9,7 +9,7 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: secret-not-ignored
+  name: secret-not-ignored-with-very-looooooooooooooooooooooooooooooooooooooooooong-name-with-100-characters
 stringData:
   revision: "1"
 ---
@@ -72,7 +72,7 @@ spec:
             name: configmap-not-ignored
         - name: secret-not-ignored
           secret:
-            secretName: secret-not-ignored
+            secretName: secret-not-ignored-with-very-looooooooooooooooooooooooooooooooooooooooooong-name-with-100-characters
         - name: configmap-self-ignored
           configMap:
             name: configmap-self-ignored
diff --git a/tests/templates/kuttl/restarter/21-trigger-restart.yaml b/tests/templates/kuttl/restarter/21-trigger-restart.yaml
index 08650bf..5691a8e 100644
--- a/tests/templates/kuttl/restarter/21-trigger-restart.yaml
+++ b/tests/templates/kuttl/restarter/21-trigger-restart.yaml
@@ -9,6 +9,6 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: secret-not-ignored
+  name: secret-not-ignored-with-very-looooooooooooooooooooooooooooooooooooooooooong-name-with-100-characters
 stringData:
   revision: "2"