diff --git a/Makefile b/Makefile
index 0f96a0f7..8b65a599 100644
--- a/Makefile
+++ b/Makefile
@@ -152,6 +152,7 @@ ci-e2e-kind: $(KIND) $(YQ)
 export SKAFFOLD_BUILD_CONCURRENCY = 0
 extension-up extension-dev: export SKAFFOLD_DEFAULT_REPO = garden.local.gardener.cloud:5001
 extension-up extension-dev: export SKAFFOLD_PUSH = true
+extension-up extension-dev: export EXTENSION_VERSION = $(VERSION)
 # use static label for skaffold to prevent rolling all gardener components on every `skaffold` invocation
 extension-up extension-dev extension-down: export SKAFFOLD_LABEL = skaffold.dev/run-id=extension-local
 
diff --git a/skaffold.yaml b/skaffold.yaml
index 59fc860e..ccf8771e 100644
--- a/skaffold.yaml
+++ b/skaffold.yaml
@@ -1,4 +1,4 @@
-apiVersion: skaffold/v4beta3
+apiVersion: skaffold/v4beta7
 kind: Config
 metadata:
   name: rsyslog-relp-echo-server
@@ -24,13 +24,24 @@ deploy:
         setValues:
           service.clusterIP: 10.2.64.54
 ---
-apiVersion: skaffold/v4beta3
+apiVersion: skaffold/v4beta7
 kind: Config
 metadata:
   name: extension
 build:
   insecureRegistries:
     - garden.local.gardener.cloud:5001
+  tagPolicy:
+    customTemplate:
+      template: "{{.version}}-{{.sha}}"
+      components:
+        - name: version
+          envTemplate:
+            template: "{{.EXTENSION_VERSION}}"
+        # inputDigest is used to inject a digest of the artifact source into the built image tag
+        # and therefore into the SKAFFOLD_IMAGE environment variable which is used when generating the corresponding ControllerDeployment
+        - name: sha
+          inputDigest: {}
   artifacts:
     - image: local-skaffold/gardener-extension-shoot-rsyslog-relp
       ko:
@@ -73,9 +84,18 @@ manifests:
     paths:
     - local-setup
 deploy:
-  kubectl: {}
+  # --server-side apply is a workaround for https://github.com/gardener/gardener/issues/10267.
+  # kubectl apply attempts a strategic merge patch which fails for a ControllerDeployment.
+  # For more details, see https://github.com/gardener/gardener/issues/10267.
+  #
+  # TODO: Switch back to "kubectl: {}" when the above issue is resolved.
+  kubectl:
+    flags:
+      apply:
+        - --server-side
+        - --force-conflicts
 ---
-apiVersion: skaffold/v4beta3
+apiVersion: skaffold/v4beta7
 kind: Config
 metadata:
   name: admission