diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e6d829c60..6a4dbd179 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,6 +43,7 @@ repos:
           - jmespath==1.0.1
           - netaddr==1.3.0
           - distlib
+          - passlib==1.7.4
 
   - repo: https://github.com/golangci/misspell
     rev: v0.7.0
diff --git a/README.md b/README.md
index 3c18d199c..8211ab27a 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,7 @@ Note:
 - Application
   - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
   - [coredns](https://github.com/coredns/coredns) 1.14.6
-  - [argocd](https://argoproj.github.io/) 2.14.5
+  - [argocd](https://argoproj.github.io/) 2.14.21
   - [helm](https://helm.sh/) 3.22.0
   - [metallb](https://metallb.universe.tf/) 0.13.9
   - [registry](https://github.com/distribution/distribution) 2.8.1
diff --git a/roles/kubernetes-apps/argocd/defaults/main.yml b/roles/kubernetes-apps/argocd/defaults/main.yml
deleted file mode 100644
index c41b86f03..000000000
--- a/roles/kubernetes-apps/argocd/defaults/main.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-argocd_enabled: false
-argocd_version: 2.14.5
-argocd_namespace: argocd
-# argocd_admin_password:
diff --git a/roles/kubernetes-apps/argocd/tasks/main.yml b/roles/kubernetes-apps/argocd/tasks/main.yml
index f40228836..0cfc8d9cd 100644
--- a/roles/kubernetes-apps/argocd/tasks/main.yml
+++ b/roles/kubernetes-apps/argocd/tasks/main.yml
@@ -1,95 +1,29 @@
 ---
-- name: Kubernetes Apps | Download yq
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(downloads.yq) }}"
-
-- name: Kubernetes Apps | Copy yq binary from download dir
-  copy:
-    src: "{{ downloads.yq.dest }}"
-    dest: "{{ bin_dir }}/yq"
-    mode: "0755"
-    remote_src: true
-
-- name: Kubernetes Apps | Set ArgoCD template list
-  set_fact:
-    argocd_templates:
-      - name: namespace
-        file: argocd-namespace.yml
-      - name: install
-        file: "{{ downloads.argocd_install.dest | basename }}"
-        namespace: "{{ argocd_namespace }}"
-        download: "{{ downloads.argocd_install }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Download ArgoCD remote manifests
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(item.download) }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir
-  ansible.posix.synchronize:
-    src: "{{ local_release_dir }}/{{ item.file }}"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    compress: false
-    perms: true
-    owner: false
-    group: false
-  delegate_to: "{{ inventory_hostname }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Set ArgoCD namespace for remote manifests
-  become: true
-  command: |
-    {{ bin_dir }}/yq eval-all -i '.metadata.namespace="{{ argocd_namespace }}"' {{ kube_config_dir }}/{{ item.file }}
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Create ArgoCD manifests from templates
-  become: true
-  template:
-    src: "{{ item.file }}.j2"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    mode: "0644"
-  with_items: "{{ argocd_templates | selectattr('download', 'undefined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
 - name: Kubernetes Apps | Install ArgoCD
-  become: true
-  kube:
-    name: ArgoCD
-    kubectl: "{{ bin_dir }}/kubectl"
-    filename: "{{ kube_config_dir }}/{{ item.file }}"
-    state: latest
-  with_items: "{{ argocd_templates }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
+  vars:
+    ns_object:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ argocd_namespace }}"
+        labels:
+          app: argocd
+  command:
+    cmd: >
+      {{ kubectl }} apply -n {{ argocd_namespace }}
+      --server-side=true --force-conflicts --field-manager=kubespray
+      -f - -f {{ downloads.argocd_install.dest }}
+    stdin: "{{ ns_object | to_json }}"
 
 # https://github.com/argoproj/argo-cd/blob/master/docs/faq.md#i-forgot-the-admin-password-how-do-i-reset-it
 - name: Kubernetes Apps | Set ArgoCD custom admin password
-  become: true
-  shell: |
-    {{ bin_dir }}/kubectl --kubeconfig /etc/kubernetes/admin.conf -n {{ argocd_namespace }} patch secret argocd-secret -p \
-      '{
-        "stringData": {
-          "admin.password": "{{ argocd_admin_password | password_hash('bcrypt') }}",
-          "admin.passwordMtime": "'$(date +%FT%T%Z)'"
-        }
-      }'
+  vars:
+    password_patch:
+      stringData:
+        'admin.password': "{{ argocd_admin_password | password_hash('bcrypt') }}"
+        'admin.passwordMtime': "{{ now(utc=true, fmt='%Y-%m-%dT%H:%M:%SZ') }}"
+  command:
+    cmd: "{{ kubectl }} -n {{ argocd_namespace }} patch secret argocd-secret --patch-file=/dev/stdin"
+    stdin: "{{ password_patch | to_json }}"
   when:
     - argocd_admin_password is defined
-    - "inventory_hostname == groups['kube_control_plane'][0]"
diff --git a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 b/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2
deleted file mode 100644
index 5a3d40f8a..000000000
--- a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2
+++ /dev/null
@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ argocd_namespace }}
-  labels:
-    app: argocd
diff --git a/roles/kubernetes-apps/meta/main.yml b/roles/kubernetes-apps/meta/main.yml
index 0ae4cec9d..a2f1d745a 100644
--- a/roles/kubernetes-apps/meta/main.yml
+++ b/roles/kubernetes-apps/meta/main.yml
@@ -114,6 +114,7 @@ dependencies:
       - metallb
 
   - role: kubernetes-apps/argocd
+    become: true
     when:
       - argocd_enabled
       - inventory_hostname == groups['kube_control_plane'][0]
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 05b3a15ba..cacdfadcb 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -911,22 +911,10 @@ downloads:
     groups:
       - kube_control_plane
 
-  yq:
-    enabled: "{{ argocd_enabled }}"
-    file: true
-    version: "{{ yq_version }}"
-    dest: "{{ local_release_dir }}/yq-{{ yq_version }}-{{ image_arch }}"
-    checksum: "{{ yq_binary_checksum }}"
-    url: "{{ yq_download_url }}"
-    unarchive: false
-    groups:
-      - kube_control_plane
-
   argocd_install:
     enabled: "{{ argocd_enabled }}"
     file: true
-    version: "{{ argocd_version }}"
-    dest: "{{ local_release_dir }}/argocd-install.yml"
+    dest: "{{ local_release_dir }}/argocd-install-{{ argocd_version }}.yml"
     checksum: "{{ argocd_install_checksum }}"
     url: "{{ argocd_install_url }}"
     unarchive: false
diff --git a/roles/kubespray_defaults/defaults/main/main.yml b/roles/kubespray_defaults/defaults/main/main.yml
index 7217d96ab..b38d6ae38 100644
--- a/roles/kubespray_defaults/defaults/main/main.yml
+++ b/roles/kubespray_defaults/defaults/main/main.yml
@@ -475,6 +475,7 @@ expand_persistent_volumes: false
 metallb_enabled: false
 metallb_speaker_enabled: "{{ metallb_enabled }}"
 argocd_enabled: false
+argocd_namespace: argocd
 gateway_api_enabled: false
 prometheus_operator_crds_enabled: false
 
diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml
index 8e92b8ce0..942c1c922 100644
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -1697,35 +1697,6 @@ skopeo_binary_checksums:
     1.14.5: sha256:4ed476c46fabb3b320aac9b88ddc1b7a2665cb151a93482db7cb98e5768a768f
     1.14.4: sha256:f1b37ad1b83bd43bada6e49518165cf41d727d0662351dc5fcc9a46f0c3b4482
     1.14.3: sha256:9028b7c4aafe235f1ba4efd57435b97ace341e544d3a6807440ac3b0f32d7d73
-yq_checksums:
-  arm:
-    4.42.1: sha256:4e3fe0c37793d28e96d465d9958fbf679d8c616e1857d0faf7980ad087f32aee
-    4.41.1: sha256:ccd50344652c02574ca7dd123c7d66a06b391838e8ca6088b688e6edf2e25d0c
-    4.40.7: sha256:fb922bb1e3974fbd15957feafb5e9bbabe43f4192999cf9b3e0e470815f2e0da
-    4.40.5: sha256:c587b2411e43d3fbcdd24c233fb558a362b5111a8446b23f9ce9a4a5665a7041
-    4.40.4: sha256:2ff3f17483f2172a20130b16328114bfe6abd7d3068d66d8194a5093079e8529
-    4.40.3: sha256:6a97856e8b4ef992ce08dcfdf97fec517cf612b1a89078406f401673f126c21c
-  arm64:
-    4.42.1: sha256:16a57531a594b66c3e0981cd93f9e9cd4b684a347b86eaf5e3f409074ad67eb8
-    4.41.1: sha256:066aa930d74e39a25447b1900d8cbb3e1c7df72cd75bc203bc6ae5ee577a5b4a
-    4.40.7: sha256:a84f2c8f105b70cd348c3bf14048aeb1665c2e7314cbe9aaff15479f268b8412
-    4.40.5: sha256:9431f0fa39a0af03a152d7fe19a86e42e9ff28d503ed4a70598f9261ec944a97
-    4.40.4: sha256:79c61a1ebfedb165ec8c4678777775b52e2c581801f5d4cd80f97300852fe0f0
-    4.40.3: sha256:44a5cca10d33019b8a46212882197be4f961dfe7deddde0af497065aa980a6a4
-  amd64:
-    4.42.1: sha256:1a95960dddd426321354d58d2beac457717f7c49a9ec0806749a5a9e400eb45e
-    4.41.1: sha256:ce0d5a61c256a463fd32f67f133e0c2948bc2cf77d44c42ff335a40e6bef34bf
-    4.40.7: sha256:4f13ee9303a49f7e8f61e7d9c87402e07cc920ae8dfaaa8c10d7ea1b8f9f48ed
-    4.40.5: sha256:0d6aaf1cf44a8d18fbc7ed0ef14f735a8df8d2e314c4cc0f0242d35c0a440c95
-    4.40.4: sha256:f9163412d9aa2aa55e888fdcaf2b4053ada20074be35f701424caa7163100704
-    4.40.3: sha256:6e9a5ed9591dbf1d13aaec4efaaf0ecdaf4945ea393b9ce01f4c3dea22311470
-  ppc64le:
-    4.42.1: sha256:d0d1cdbd2c4a7e6995433baf879cadaa47f6f12290e1661ea11933ed90baccb6
-    4.41.1: sha256:eed2af79d0ad787878b2d5c7c592e43ac152208d9ed432b42a43663167e276e8
-    4.40.7: sha256:ac0e8d06a7ed9afc108b4e2e9d6900312b01757f61b75fcecb809f15c39b10e7
-    4.40.5: sha256:a1df9d2b872fbb30583526bf4f37f737dc1913b28606dfc1dafeaf56a8862b3d
-    4.40.4: sha256:c67379085a44558825a60a8af3b59b400852b168356070829bc0f45c70553f45
-    4.40.3: sha256:2fe818a0b141913a41548e0e727267479d0f755221c73f9e304788c8e9139a45
 gateway_api_standard_crds_checksums:
   no_arch:
     1.6.2: sha256:faede450fa178126aba41337737b97d351ebe87d93c910237ce1e072d1ca40d9
diff --git a/scripts/component_hash_update/src/component_hash_update/components.py b/scripts/component_hash_update/src/component_hash_update/components.py
index 576c40379..7cc1a43aa 100644
--- a/scripts/component_hash_update/src/component_hash_update/components.py
+++ b/scripts/component_hash_update/src/component_hash_update/components.py
@@ -100,10 +100,6 @@ infos = {
         "binary": True,
         "graphql_id": "R_kgDOFPvgPg",
     },
-    "yq": {
-        "url": "https://github.com/mikefarah/yq/releases/download/v{version}/checksums-bsd",  # see https://github.com/mikefarah/yq/pull/1691 for why we use this url
-        "graphql_id": "R_kgDOApOQGQ",
-    },
     "argocd_install": {
         "url": "https://raw.githubusercontent.com/argoproj/argo-cd/v{version}/manifests/install.yaml",
         "graphql_id": "R_kgDOBzS60g",
diff --git a/scripts/component_hash_update/src/component_hash_update/download.py b/scripts/component_hash_update/src/component_hash_update/download.py
index 2e4a7e3c5..ece2049b8 100644
--- a/scripts/component_hash_update/src/component_hash_update/download.py
+++ b/scripts/component_hash_update/src/component_hash_update/download.py
@@ -78,18 +78,6 @@ def download_hash(downloads: {str: {str: Any}}) -> None:
             parts[1].split(".")[1]: parts[0]
             for parts in (line.split() for line in hashes.split("\n")[3:9])
         },
-        "yq": lambda rhashes_bsd: {
-            pair[0].split("_")[-1]: pair[1]
-            # pair = (yq_<os>_<arch>, <hash>)
-            for pair in (
-                (line.split()[1][1:-1], line.split()[3])
-                for line in rhashes_bsd.splitlines()
-                if line.startswith("SHA256")
-            )
-            if pair[0].startswith("yq")
-            and pair[0].split("_")[1] == "linux"
-            and not pair[0].endswith(".tar.gz")
-        },
     }
 
     checksums_file = (
diff --git a/scripts/propagate_ansible_variables.yml b/scripts/propagate_ansible_variables.yml
index 6ef265cac..30a04ab65 100755
--- a/scripts/propagate_ansible_variables.yml
+++ b/scripts/propagate_ansible_variables.yml
@@ -14,7 +14,6 @@
     loop:
     - ../roles/container-engine/docker/defaults/main.yml
     - ../roles/kubernetes/node/defaults/main.yml
-    - ../roles/kubernetes-apps/argocd/defaults/main.yml
   - name: Render versions in README.md
     blockinfile:
       marker: '<!-- {mark} ANSIBLE MANAGED BLOCK -->'