diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69c1d7fc..fcc079e7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ listed in the changelog.
 - Gradle task does not expose Nexus env variables ([#373](https://github.com/opendevstack/ods-pipeline/issues/373))
 - Gradle build fails when it contains more than one test class ([#414](https://github.com/opendevstack/ods-pipeline/issues/414))
 - Gradle proxy settings are set during prepare-local-env ([#291](https://github.com/opendevstack/ods-pipeline/issues/291))
+- Add `xargs` to helm image as `helm-secrets` depends on it ([#465](https://github.com/opendevstack/ods-pipeline/issues/465))
 - Pipeline creation fails when branch names contain slashes ([#466](https://github.com/opendevstack/ods-pipeline/issues/466))
 
 ## [0.2.0] - 2021-12-22
diff --git a/build/package/Dockerfile.helm b/build/package/Dockerfile.helm
index 7aa7469e..036e80ee 100644
--- a/build/package/Dockerfile.helm
+++ b/build/package/Dockerfile.helm
@@ -43,9 +43,12 @@ ENV HELM_PLUGIN_DIFF_VERSION=3.3.2 \
     HELM_PLUGINS=/usr/local/helm/plugins \
     SKOPEO_VERSION=1.5 \
     TAR_VERSION=1.30 \
-    GIT_VERSION=2.27
+    GIT_VERSION=2.27 \
+    FINDUTILS_VERSION=4.6
 
-RUN microdnf install skopeo-${SKOPEO_VERSION}* git-${GIT_VERSION}* tar-${TAR_VERSION}* && microdnf clean all
+# helm-secrets depends on xargs (from GNU findutils) in it's signal handlers,
+# c.f. https://github.com/jkroepke/helm-secrets/blob/main/scripts/commands/helm.sh#L34-L36
+RUN microdnf install skopeo-${SKOPEO_VERSION}* git-${GIT_VERSION}* tar-${TAR_VERSION}* findutils-${FINDUTILS_VERSION}* && microdnf clean all
 
 COPY --from=builder /usr/local/bin/deploy-with-helm /usr/local/bin/deploy-with-helm
 COPY --from=builder /usr/local/bin/helm /usr/local/bin/helm
diff --git a/docs/design/software-design-specification.adoc b/docs/design/software-design-specification.adoc
index b32db6b7..d69a2b26 100644
--- a/docs/design/software-design-specification.adoc
+++ b/docs/design/software-design-specification.adoc
@@ -560,6 +560,12 @@ For all repositories in scope, the artifacts in the corresponding groups in Nexu
 | Python 3.9 available as container is a base platform for building and running various Python applications and frameworks. It is maintained by Red Hat and updated regularly.
 | https://catalog.redhat.com/software/containers/ubi8/python-39/6065b24eb92fbda3a4c65d8f
 
+| SDS-EXT-29
+| GNU findutils
+| 4.6
+| Basic directory searching utilities, included due to the dependency of `helm-secrets` on `xargs`
+| https://www.gnu.org/software/findutils/
+
 |===
 
 == Appendix
diff --git a/test/tasks/ods-deploy-helm_test.go b/test/tasks/ods-deploy-helm_test.go
index 5d4bb851..7fb9b7bd 100644
--- a/test/tasks/ods-deploy-helm_test.go
+++ b/test/tasks/ods-deploy-helm_test.go
@@ -99,7 +99,7 @@ func TestTaskODSDeployHelm(t *testing.T) {
 					if strings.Contains(string(ctxt.CollectedLogs), doNotWantLogMsg) {
 						t.Fatalf("Do not want:\n%s\n\nGot:\n%s", doNotWantLogMsg, string(ctxt.CollectedLogs))
 					}
-					wantLogMsg := "plugin \"diff\" identified at least one change"
+					wantLogMsg := "identified at least one change"
 					if !strings.Contains(string(ctxt.CollectedLogs), wantLogMsg) {
 						t.Fatalf("Want:\n%s\n\nGot:\n%s", wantLogMsg, string(ctxt.CollectedLogs))
 					}