diff --git a/argocd-operator/common/defaults.go b/argocd-operator/common/defaults.go
index b402778a4b9..bbac4d8b7da 100644
--- a/argocd-operator/common/defaults.go
+++ b/argocd-operator/common/defaults.go
@@ -82,7 +82,7 @@ const (
 	ArgoCDDefaultArgoImage = "quay.io/argoproj/argocd"
 
 	// ArgoCDDefaultArgoVersion is the Argo CD container image digest to use when version not specified.
-	ArgoCDDefaultArgoVersion = "sha256:8e5cc5bb008df8a09dba439462e58c94c55b7735888d3ebde0c25fc05e4e5335" // v3.5.6
+	ArgoCDDefaultArgoVersion = "sha256:479514bfba432c5b9566d5ecc6e245d72afa2d9dd30e83f863dbdaf846292eb6" // v3.6.0-rc3
 
 	// ArgoCDDefaultBackupKeyLength is the length of the generated default backup key.
 	ArgoCDDefaultBackupKeyLength = 32
diff --git a/argocd-operator/controllers/argocd/deployment.go b/argocd-operator/controllers/argocd/deployment.go
index 1185c2cd1e4..67012bc9905 100644
--- a/argocd-operator/controllers/argocd/deployment.go
+++ b/argocd-operator/controllers/argocd/deployment.go
@@ -984,11 +984,7 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
 	if cr.Spec.Server.VolumeMounts != nil {
 		serverVolumeMounts = append(serverVolumeMounts, cr.Spec.Server.VolumeMounts...)
 	}
-	// argocd-server does not support --tlscurvepreferences yet; omit curves until a
-	// supporting image is the default. Keep min version and ciphers.
-	tlsProfileForServer := r.CentralTLSConfigProfile
-	tlsProfileForServer.CurvePreferences = nil
-	arguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForServer, "argocd-server")
+	arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-server")
 	if err != nil {
 		return err
 	}
diff --git a/argocd-operator/controllers/argocd/deployment_test.go b/argocd-operator/controllers/argocd/deployment_test.go
index 91cf025385a..28e4c468a88 100644
--- a/argocd-operator/controllers/argocd/deployment_test.go
+++ b/argocd-operator/controllers/argocd/deployment_test.go
@@ -3563,8 +3563,6 @@ func TestArgoCDServerAndRepoServerDeploymentArgs(t *testing.T) {
 			"ECDHE-RSA-AES128-GCM-SHA256",
 			"ECDHE-RSA-AES256-GCM-SHA384",
 		},
-		// Curve preferences are set on the central profile but omitted for
-		// server/repo-server until those components support --tlscurvepreferences.
 		CurvePreferences: []configv1.TLSGroup{
 			configv1.TLSGroupX25519,
 			configv1.TLSGroupSecP256r1,
@@ -3576,13 +3574,12 @@ func TestArgoCDServerAndRepoServerDeploymentArgs(t *testing.T) {
 	args := []string{
 		"--tlsminversion", "1.2",
 		"--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+		"--tlscurvepreferences", "X25519:CurveP256",
 	}
 	assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args)
-	assert.NotContains(t, deployment.Spec.Template.Spec.Containers[0].Args, "--tlscurvepreferences")
 	assert.NoError(t, r.reconcileRepoDeployment(a, false))
 	assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-repo-server", Namespace: a.Namespace}, deployment))
 	assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args)
-	assert.NotContains(t, deployment.Spec.Template.Spec.Containers[0].Args, "--tlscurvepreferences")
 }
 
 func TestReconcileServer_PromoterUIExtension(t *testing.T) {
diff --git a/argocd-operator/controllers/argocd/repo_server.go b/argocd-operator/controllers/argocd/repo_server.go
index 9292f5629a3..c626141856e 100644
--- a/argocd-operator/controllers/argocd/repo_server.go
+++ b/argocd-operator/controllers/argocd/repo_server.go
@@ -211,11 +211,7 @@ func (r *ReconcileArgoCD) reconcileRepoDeployment(cr *argocdoperatorv1beta1.Argo
 		repoServerVolumeMounts = append(repoServerVolumeMounts, cr.Spec.Repo.VolumeMounts...)
 	}
 
-	// argocd-repo-server does not support --tlscurvepreferences yet; omit curves until a
-	// supporting image is the default. Keep min version and ciphers.
-	tlsProfileForRepoServer := r.CentralTLSConfigProfile
-	tlsProfileForRepoServer.CurvePreferences = nil
-	arguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForRepoServer, "argocd-repo-server")
+	arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-repo-server")
 	if err != nil {
 		return err
 	}
diff --git a/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go b/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go
index c105cfb8572..6898475473b 100644
--- a/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go
+++ b/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go
@@ -85,9 +85,9 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {
 		It("verifies that toolchain versions have the expected values", Label("openshift"), func() {
 
 			// These variables need to be maintained according to the component matrix: https://spaces.redhat.com/display/GITOPS/GitOps+Component+Matrix
-			expected_kustomizeVersion := "v5.8.1"
-			expected_helmVersion := "v4.2.1"
-			expected_argocdVersion := "v3.5.6"
+			expected_kustomizeVersion := "v5.8.3"
+			expected_helmVersion := "v4.3.1"
+			expected_argocdVersion := "v3.6.0-rc3"
 
 			var expected_dexVersion string
 			var expected_redisVersion string