diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index 5a710d2..fc4899f 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -125,7 +125,7 @@ func (r Runner) Run() error {
 			if err := renderCiliumConfig(filepath.Join(dir, "base", "cilium-config"), r.Config); err != nil {
 				return err
 			}
-			if err := renderDeliveryConfig(filepath.Join(dir, "base", "tekton"), r.Config); err != nil {
+			if err := copyAndRenderTektonBase(cicdTemplateDir, dir, r.Config); err != nil {
 				return err
 			}
 			if err := renderDeliveryConfig(filepath.Join(dir, "base", "tekton-triggers"), r.Config); err != nil {
@@ -256,6 +256,14 @@ func renderDeliveryConfig(dir string, cfg config.Config) error {
 	})
 }
 
+func copyAndRenderTektonBase(templateDir, repoDir string, cfg config.Config) error {
+	tektonDir := filepath.Join(repoDir, "base", "tekton")
+	if err := copyDir(filepath.Join(templateDir, "base", "tekton"), tektonDir, true); err != nil {
+		return err
+	}
+	return renderDeliveryConfig(tektonDir, cfg)
+}
+
 func writeDemocraticCSISecret(path string, csi config.DemocraticCSIConfig, ageKeyPath string) error {
 	plaintext, err := renderDemocraticCSISecret(csi)
 	if err != nil {
diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go
index 7afc789..36f3654 100644
--- a/internal/bootstrap/bootstrap_test.go
+++ b/internal/bootstrap/bootstrap_test.go
@@ -51,6 +51,37 @@ func TestRenderDeliveryConfig(t *testing.T) {
 	}
 }
 
+func TestCopyAndRenderTektonBaseOverwritesExistingMigrationOutput(t *testing.T) {
+	templateDir := t.TempDir()
+	repoDir := t.TempDir()
+	templateCatalog := filepath.Join(templateDir, "base", "tekton", "catalog-source.yaml")
+	outputCatalog := filepath.Join(repoDir, "base", "tekton", "catalog-source.yaml")
+	if err := os.MkdirAll(filepath.Dir(templateCatalog), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Dir(outputCatalog), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(templateCatalog, []byte("url: ${TEKTON_CATALOG_REPO_URL}\nref: ${TEKTON_CATALOG_REPO_REF}\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(outputCatalog, []byte("stale: catalog\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := config.Config{Templates: config.TemplateConfig{TektonCatalogRepoURL: "https://catalog.example.test/tekton.git", TektonCatalogRepoRef: "release"}}
+	if err := copyAndRenderTektonBase(templateDir, repoDir, cfg); err != nil {
+		t.Fatal(err)
+	}
+	content, err := os.ReadFile(outputCatalog)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(content) != "url: https://catalog.example.test/tekton.git\nref: release\n" {
+		t.Fatalf("Tekton catalog source was not copied and rendered: %q", content)
+	}
+}
+
 func TestRenderDemocraticCSISecret(t *testing.T) {
 	secret, err := renderDemocraticCSISecret(config.DemocraticCSIConfig{TrueNASAPIKey: "api-key", TrueNASHost: "truenas.example.test", TargetPortal: "truenas.example.test:3260", ShareHost: "truenas.example.test", DatasetParentNFS: "pool/kubernetes/nfs/v", DatasetSnapshotsNFS: "pool/kubernetes/nfs/s", AllowedNetworks: "192.168.45.0/24", NameSuffix: "-test", PortalGroup: "1", InitiatorGroup: "1"})
 	if err != nil {