diff --git a/CHANGELOG.md b/CHANGELOG.md
index 63d23449aca986220f81e37a044851faebe21fa0..0c6c71d8b9d0ff840f82b10a12652d6049356813 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,18 @@
+# [7.0.0](https://gitlab.com/to-be-continuous/kubernetes/compare/6.5.0...7.0.0) (2025-01-31)
+
+
+### Features
+
+* variables substitution enhancements ([4023f7f](https://gitlab.com/to-be-continuous/kubernetes/commit/4023f7f862fd89b30067c6d548d4dbf06016f622))
+
+
+### BREAKING CHANGES
+
+* Now the variables substitution mechanism
+implements complete YAML string encoding.
+That might break projects that used to workaround the former
+implementation flaws.
+
 # [6.5.0](https://gitlab.com/to-be-continuous/kubernetes/compare/6.4.0...6.5.0) (2025-01-27)
 
 
diff --git a/README.md b/README.md
index b729020d4415d393fd88c53d3c90661cc133ca18..8348072a88651d08bedd343eb2f3eed5ebfe9fd9 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ Add the following to your `.gitlab-ci.yml`:
 ```yaml
 include:
   # 1: include the component
-  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@6.5.0
+  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@7.0.0
     # 2: set/override component inputs
     inputs:
       # ⚠ this is only an example
@@ -35,7 +35,7 @@ Add the following to your `.gitlab-ci.yml`:
 include:
   # 1: include the template
   - project: 'to-be-continuous/kubernetes'
-    ref: '6.5.0'
+    ref: '7.0.0'
     file: '/templates/gitlab-ci-k8s.yml'
 
 variables:
@@ -526,12 +526,12 @@ With:
 ```yaml
 include:
   # main template
-  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@6.5.0
+  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@7.0.0
     inputs:
       # ⚠ oc-container image (includes required curl)
       kubectl-image: registry.hub.docker.com/docker.io/appuio/oc:v4.14
   # Vault variant
-  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s-vault@6.5.0
+  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s-vault@7.0.0
     inputs:
       # audience claim for JWT
       vault-oidc-aud: "https://vault.acme.host"
@@ -592,9 +592,9 @@ With a common default `GCP_OIDC_PROVIDER` and `GCP_OIDC_ACCOUNT` configuration f
 ```yaml
 include:
   # main template
-  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@6.5.0
+  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8s@7.0.0
   # Google Cloud variant
-  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8ss-gcp@6.5.0
+  - component: $CI_SERVER_FQDN/to-be-continuous/kubernetes/gitlab-ci-k8ss-gcp@7.0.0
     inputs:
       # common OIDC config for non-prod envs
       gcp-oidc-provider: "projects/<gcp_nonprod_proj_id>/locations/global/workloadIdentityPools/<pool_id>/providers/<provider_id>"
diff --git a/templates/gitlab-ci-k8s-vault.yml b/templates/gitlab-ci-k8s-vault.yml
index 7f467ca1b98cd8f16749c3f82a4359a4da45bfc9..7943e33c55f67d5d9cf52fc370297aec3b5a2ef4 100644
--- a/templates/gitlab-ci-k8s-vault.yml
+++ b/templates/gitlab-ci-k8s-vault.yml
@@ -22,7 +22,7 @@ variables:
 .k8s-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "--port", "8082", "kubernetes", "6.5.0"]
+      command: ["--service", "--port", "8082", "kubernetes", "7.0.0"]
     - name: "$TBC_VAULT_IMAGE"
       alias: "vault-secrets-provider"
   variables:
diff --git a/templates/gitlab-ci-k8s.yml b/templates/gitlab-ci-k8s.yml
index f6bfa1e1abc92f54eae90d5546e140954ab00454..dd475923c8427804eb60536bad18f28bd2615d4e 100644
--- a/templates/gitlab-ci-k8s.yml
+++ b/templates/gitlab-ci-k8s.yml
@@ -846,7 +846,7 @@ stages:
     entrypoint: [""]
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "kubernetes", "6.5.0"]
+      command: ["--service", "kubernetes", "7.0.0"]
   before_script:
     - !reference [.k8s-scripts]
     - install_ca_certs "${CUSTOM_CA_CERTS:-$DEFAULT_CA_CERTS}"