diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 4ca2142de..96614d59f 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -25,6 +25,8 @@ jobs:
         go-version: v1.25.4
     - name: Delete non-semver tags
       run: 'git tag -d $(git tag -l | grep -v "^v")'
+    - name: Set LDFLAGS
+      run: echo LDFLAGS="$(make ldflags)" >> $GITHUB_ENV
     - name: Run GoReleaser on tag
       if: github.event_name != 'pull_request'
       uses: goreleaser/goreleaser-action@v3
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 3f782402a..cfd6ce492 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,9 +1,18 @@
 version: 2
+
+git:
+  tag_sort: -version:refname
+  ignore_tags:
+  - "cli/*"
+  - "sdk/*"
+
 builds:
 - id: "kubectl-bind"
   dir: cli
   main: ./cmd/kubectl-bind
   binary: bin/kubectl-bind
+  ldflags:
+  - "{{ .Env.LDFLAGS }}"
   goos:
   - linux
   - darwin
diff --git a/Makefile b/Makefile
index 89a511a57..e47869d10 100644
--- a/Makefile
+++ b/Makefile
@@ -482,6 +482,11 @@ helm-build-local: ## Build and package Helm charts locally for testing
 helm-clean: ## Clean up built helm charts
 	rm -f ./bin/*.tgz
 
+.PHONY: goreleaser-test
+goreleaser-test: ## Test GoReleaser flow locally
+	@command -v goreleaser >/dev/null 2>&1 || { echo "goreleaser not found. Install from: https://goreleaser.com/install/"; exit 1; }
+	LDFLAGS="$(LDFLAGS)" goreleaser release --snapshot --clean
+
 .PHONY: helm-push-local
 helm-push-local: ## Push Helm charts to IMAGE_REPO registry
 	@echo "Pushing Helm charts to registry: $(IMAGE_REPO)"
diff --git a/docs/content/setup/kubectl-plugin.md b/docs/content/setup/kubectl-plugin.md
index ce24c4d31..8a04cf66f 100644
--- a/docs/content/setup/kubectl-plugin.md
+++ b/docs/content/setup/kubectl-plugin.md
@@ -35,9 +35,12 @@ The `kubectl bind` plugin is the primary command-line interface for interacting
 
     ```bash
     # Download and install for Linux/macOS
-    curl -LO https://github.com/kube-bind/kube-bind/releases/latest/download/kubectl-bind-linux-amd64
-    chmod +x kubectl-bind-linux-amd64
-    sudo mv kubectl-bind-linux-amd64 /usr/local/bin/kubectl-bind
+    OS=$(uname | tr '[:upper:]' '[:lower:]')
+    ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+    VERSION=$(curl -s https://api.github.com/repos/kube-bind/kube-bind/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
+    curl -LO https://github.com/kube-bind/kube-bind/releases/download/${VERSION}/kubectl-bind_${VERSION#v}_${OS}_${ARCH}.tar.gz
+    tar -xzf kubectl-bind_${VERSION#v}_${OS}_${ARCH}.tar.gz
+    sudo mv bin/kubectl-bind /usr/local/bin/kubectl-bind
     ```
 
 ## Basic Usage
diff --git a/pkg/konnector/controllers/cluster/serviceexport/status/status_controller.go b/pkg/konnector/controllers/cluster/serviceexport/status/status_controller.go
index 8897623d5..ae32ad3ee 100644
--- a/pkg/konnector/controllers/cluster/serviceexport/status/status_controller.go
+++ b/pkg/konnector/controllers/cluster/serviceexport/status/status_controller.go
@@ -185,7 +185,7 @@ func (c *controller) enqueueProvider(logger klog.Logger, obj any) {
 	// Try to map the provider name back to the consumer name,
 	// but only to check if we "own" the object; we will actually
 	// enqueue the provider key after all.
-	consumerKey, err := c.isolationStrategy.ToConsumerKey(types.NamespacedName{
+	consumerKey, err := c.reconciler.isolationStrategy.ToConsumerKey(types.NamespacedName{
 		Namespace: ns,
 		Name:      name,
 	})
@@ -216,7 +216,7 @@ func (c *controller) enqueueConsumer(logger klog.Logger, obj any) {
 		return
 	}
 
-	providerKey, err := c.isolationStrategy.ToProviderKey(types.NamespacedName{
+	providerKey, err := c.reconciler.isolationStrategy.ToProviderKey(types.NamespacedName{
 		Namespace: ns,
 		Name:      name,
 	})
@@ -250,7 +250,7 @@ func (c *controller) enqueueServiceNamespace(logger klog.Logger, obj any) {
 		return // not for us
 	}
 
-	strategy := c.isolationStrategy.(*isolation.ServiceNamespacedStrategy)
+	strategy := c.reconciler.isolationStrategy.(*isolation.ServiceNamespacedStrategy)
 	nsOnProviderCluster, err := strategy.ProviderNamespace(name)
 	if err != nil {
 		runtime.HandleError(err)
@@ -289,7 +289,7 @@ func (c *controller) Start(ctx context.Context, numThreads int) {
 	// APIServiceNamespaces are only of interest when syncing namespaced
 	// objects, and since these event handlers need the appropriate isolation
 	// strategy, we only start them when necessary.
-	if _, ok := c.isolationStrategy.(*isolation.ServiceNamespacedStrategy); ok {
+	if _, ok := c.reconciler.isolationStrategy.(*isolation.ServiceNamespacedStrategy); ok {
 		c.serviceNamespaceInformer.Informer().AddDynamicEventHandler(ctx, controllerName, cache.ResourceEventHandlerFuncs{
 			AddFunc: func(obj any) {
 				c.enqueueServiceNamespace(logger, obj)