diff --git a/Makefile b/Makefile
index a8e4797..ca4f039 100644
--- a/Makefile
+++ b/Makefile
@@ -16,8 +16,8 @@ GROUP        ?= my-group
 MAX          ?= 10
 PARTITIONS   ?= 1
 REPLICAS     ?= 1
-KAFKA_VER    ?= 4.1.0
-METADATA_VER ?= 4.1-IV0
+KAFKA_VER    ?= 4.3.1
+METADATA_VER ?= 4.3-IV0
 
 KUBECTL   := kubectl -n $(NAMESPACE)
 KEXEC     := $(KUBECTL) exec $(BROKER) --
diff --git a/README.md b/README.md
index e511e72..277dcce 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ Single-broker Kafka cluster for dev/test, deployed via the [Strimzi](https://str
 ```
 kafka namespace
 ├── strimzi-cluster-operator   Strimzi operator — reconciles Kafka/KafkaUser/KafkaTopic CRs
-├── kafka-dual-role-0          Kafka 4.1.0 broker (KRaft, controller + broker in one pod)
+├── kafka-dual-role-0          Kafka 4.3.1 broker (KRaft, controller + broker in one pod)
 └── kafka-entity-operator      Topic Operator + User Operator (manages topics and users)
 ```
 
@@ -40,6 +40,12 @@ kafka-kafka-bootstrap.kafka.svc.cluster.local:9093
 |---|---|---|
 | `kafka-admin` | `kafka-admin` | Super user — unrestricted access |
 | `kafka-client` | `kafka-client` | Application user — Read/Write all topics and groups |
+| `classic-models-api` | `classic-models-api` | Producer for `classic-models.*` — **Write and Describe only**, no Read |
+
+`classic-models-api` publishes domain events and consumes nothing, so it is
+write-only and prefix-scoped. A producer that can also read every topic is a
+producer that exfiltrates every other domain's events if it is ever
+compromised.
 
 Strimzi stores credentials in Kubernetes secrets. Each secret contains two keys:
 - `password` — the SCRAM password
diff --git a/kafka-users.yaml b/kafka-users.yaml
index 8fd2c9a..d3c097e 100644
--- a/kafka-users.yaml
+++ b/kafka-users.yaml
@@ -52,3 +52,30 @@ spec:
         operations:
           - Describe
           - Write
+---
+# The classic-models API, which publishes domain events and consumes nothing.
+#
+# Write-only and topic-scoped: a producer that can also read every topic is a
+# producer that can exfiltrate every other domain's events if it is ever
+# compromised. Describe is needed for metadata; it does not grant reads.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-api
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.
+          patternType: prefix
+        operations:
+          - Write
+          - Describe
+
diff --git a/kafka.yaml b/kafka.yaml
index 20ed5e8..584afd7 100644
--- a/kafka.yaml
+++ b/kafka.yaml
@@ -36,8 +36,7 @@ metadata:
     strimzi.io/kraft: enabled
 spec:
   kafka:
-    version: 4.1.0
-    metadataVersion: "4.1-IV0"
+    version: 4.3.1
     listeners:
       - name: tls
         port: 9093