diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d61c742..d2f50f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,7 +57,7 @@ jobs:
         run: |
           set -euo pipefail
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
 
       - name: Build the Configuration package
@@ -183,7 +183,7 @@ jobs:
           # XP_VERSION pins the CLI: install.sh otherwise takes whatever is
           # current, so this job would drift onto a different CLI with no commit.
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
           # kind-up.sh needs helm; the runner image ships it, but don't rely on that.
           command -v helm >/dev/null || \
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 944ce43..51cb672 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -124,7 +124,7 @@ jobs:
         run: |
           set -euo pipefail
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
           crossplane version --client
 
@@ -178,7 +178,7 @@ jobs:
         run: |
           set -euo pipefail
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
 
       - name: Build the Configuration package
@@ -215,7 +215,7 @@ jobs:
         run: |
           set -euo pipefail
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
 
       - name: Login to GHCR
@@ -281,7 +281,7 @@ jobs:
         run: |
           set -euo pipefail
           # renovate: datasource=github-releases depName=crossplane/crossplane
-          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.0 sh
+          curl -sfL "https://cli.crossplane.io/install.sh" | XP_VERSION=v2.4.1 sh
           sudo mv ./crossplane /usr/local/bin/crossplane
 
       - name: Login to GHCR