diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48d2dbe891..20bfffb729 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ Usage:
 * Fix #2257: Provide guidance when the final project packaged file is not found in Quarkus projeicts
 * Fix #1690: Base images based on ubi9
 * Fix #2070: build goals/tasks log warning if user forgets to run package/build goal/task
+* Fix #2389: Helm `values.yaml` sorted alphabetically
 * Fix #2390: support for all missing Chart.yaml fields
 * Fix #2391: Automatically add `values.schema.json` file if detected
 * Fix #2444: Add support for Spring Boot application properties placeholders
diff --git a/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/AuthConfigTest.java b/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/AuthConfigTest.java
index 04ea49cc97..e671bf8c81 100644
--- a/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/AuthConfigTest.java
+++ b/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/AuthConfigTest.java
@@ -36,7 +36,7 @@ void simpleConstructor() {
     // Since Base64.decodeBase64 handles URL-safe encoding, must explicitly check
     // the correct characters are used
     assertThat(config.toHeaderValue(new KitLogger.SilentLogger()))
-      .isEqualTo("eyJ1c2VybmFtZSI6InJvbGFuZCIsInBhc3N3b3JkIjoiIz5zZWNyZXRzPz8iLCJlbWFpbCI6InJvbGFuZEBqb2xva2lhLm9yZyJ9");
+      .isEqualTo("eyJlbWFpbCI6InJvbGFuZEBqb2xva2lhLm9yZyIsInBhc3N3b3JkIjoiIz5zZWNyZXRzPz8iLCJ1c2VybmFtZSI6InJvbGFuZCJ9");
 
     String header = new String(Base64.getDecoder().decode(config.toHeaderValue(new KitLogger.SilentLogger())));
 
diff --git a/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/RegistryAuthTest.java b/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/RegistryAuthTest.java
index 45d1716a8a..c9281e33eb 100644
--- a/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/RegistryAuthTest.java
+++ b/jkube-kit/build/api/src/test/java/org/eclipse/jkube/kit/build/api/auth/RegistryAuthTest.java
@@ -50,7 +50,7 @@ private void check(RegistryAuth config) {
         // Since Base64.decodeBase64 handles URL-safe encoding, must explicitly check
         // the correct characters are used
         assertThat(config.toHeaderValue())
-            .isEqualTo("eyJ1c2VybmFtZSI6InJvbGFuZCIsInBhc3N3b3JkIjoiIz5zZWNyZXRzPz8iLCJlbWFpbCI6InJvbGFuZEBqb2xva2lhLm9yZyJ9");
+            .isEqualTo("eyJlbWFpbCI6InJvbGFuZEBqb2xva2lhLm9yZyIsInBhc3N3b3JkIjoiIz5zZWNyZXRzPz8iLCJ1c2VybmFtZSI6InJvbGFuZCJ9");
 
         String header = new String(Base64.getDecoder().decode(config.toHeaderValue()));
 
diff --git a/jkube-kit/common/src/main/java/org/eclipse/jkube/kit/common/util/Serialization.java b/jkube-kit/common/src/main/java/org/eclipse/jkube/kit/common/util/Serialization.java
index 9394a8236f..f934119487 100644
--- a/jkube-kit/common/src/main/java/org/eclipse/jkube/kit/common/util/Serialization.java
+++ b/jkube-kit/common/src/main/java/org/eclipse/jkube/kit/common/util/Serialization.java
@@ -42,6 +42,7 @@ public class Serialization {
   static {
     for (ObjectMapper mapper : new ObjectMapper[]{JSON_MAPPER, YAML_MAPPER}) {
       mapper.enable(SerializationFeature.INDENT_OUTPUT)
+        .enable(SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS)
         .disable(SerializationFeature.WRITE_EMPTY_JSON_ARRAYS)
         .disable(SerializationFeature.WRITE_NULL_MAP_VALUES);
     }
diff --git a/jkube-kit/resource/helm/src/test/java/org/eclipse/jkube/kit/resource/helm/HelmServiceTest.java b/jkube-kit/resource/helm/src/test/java/org/eclipse/jkube/kit/resource/helm/HelmServiceTest.java
index 5aa9b5075a..7a200c75c4 100644
--- a/jkube-kit/resource/helm/src/test/java/org/eclipse/jkube/kit/resource/helm/HelmServiceTest.java
+++ b/jkube-kit/resource/helm/src/test/java/org/eclipse/jkube/kit/resource/helm/HelmServiceTest.java
@@ -213,6 +213,47 @@ void generateHelmCharts_withValidValuesYamlFragment_usesMergedValues() throws Ex
       );
   }
 
+  @Test
+  void generateHelmCharts_whenInvoked_thenGeneratedValuesYamlInAlphabeticalOrder() throws IOException {
+    // Given
+    Path unsortedValuesYaml = helmSourceDirectory.resolve("values.helm.yaml");
+    Files.write(unsortedValuesYaml, ("root:\n" +
+        "  ingress:\n" +
+        "    className: \"IngressClass\"\n" +
+        "    annotations:\n" +
+        "      tls-acme: \"true\"\n" +
+        "      ingress.class: nginx\n" +
+        "    enabled: false\n" +
+        "  country-codes:\n" +
+        "    countries:\n" +
+        "      spain: \"+34\"\n" +
+        "      france: \"+33\"\n" +
+        "      india: \"+91\"").getBytes());
+    resourceServiceConfig = ResourceServiceConfig.builder().resourceDirs(Collections.singletonList(helmSourceDirectory.toFile())).build();
+    helmConfig.types(Collections.singletonList(HelmType.KUBERNETES));
+
+    // When
+    new HelmService(jKubeConfiguration, resourceServiceConfig, new KitLogger.SilentLogger())
+        .generateHelmCharts(helmConfig.build());
+
+    // Then
+    File generatedValuesYaml = helmOutputDirectory.resolve("kubernetes").resolve("values.yaml").toFile();
+    assertThat(new String(Files.readAllBytes(generatedValuesYaml.toPath())))
+        .isEqualTo("---\n" +
+            "root:\n" +
+            "  country-codes:\n" +
+            "    countries:\n" +
+            "      france: \"+33\"\n" +
+            "      india: \"+91\"\n" +
+            "      spain: \"+34\"\n" +
+            "  ingress:\n" +
+            "    annotations:\n" +
+            "      ingress.class: nginx\n" +
+            "      tls-acme: \"true\"\n" +
+            "    className: IngressClass\n" +
+            "    enabled: false\n");
+  }
+
   @Test
   void createChartYamlWithDependencies() throws Exception {
     // Given