diff --git a/kubernetes/apps/audiobookshelf/deployment.yaml b/kubernetes/apps/audiobookshelf/deployment.yaml
index f49105af..98d77438 100644
--- a/kubernetes/apps/audiobookshelf/deployment.yaml
+++ b/kubernetes/apps/audiobookshelf/deployment.yaml
@@ -48,7 +48,7 @@ spec:
         # cert when doing server-side OIDC token exchange. Bundle both
         # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
           command:
             - sh
             - -c
diff --git a/kubernetes/apps/evcc/deployment.yaml b/kubernetes/apps/evcc/deployment.yaml
index b255731e..cd048816 100644
--- a/kubernetes/apps/evcc/deployment.yaml
+++ b/kubernetes/apps/evcc/deployment.yaml
@@ -28,7 +28,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: evcc
-          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
+          image: evcc/evcc:0.318.2@sha256:7ef9bcb15a4fdbfe3bf75d7a0857c40b6272b8783ea833fcbb22f8f134b336c7
           # evcc auto-discovers /etc/evcc.yaml on its default search path;
           # the file is delivered (with the MQTT password) via the
           # sops-encrypted evcc-config Secret mounted below.
diff --git a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
index 21b8229e..632155d1 100644
--- a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
@@ -88,7 +88,7 @@ spec:
         # deliver, and the ClusterIP has no backend while HA restarts. The
         # trap forwards SIGTERM so the pod still terminates promptly.
         - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -130,7 +130,7 @@ spec:
         # depends on the kernel's bindv6only default rather than on anything
         # stated here, so the roles are made explicit instead of inherited.
         - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
diff --git a/kubernetes/apps/immich/server.yaml b/kubernetes/apps/immich/server.yaml
index fa132870..465c1bd2 100644
--- a/kubernetes/apps/immich/server.yaml
+++ b/kubernetes/apps/immich/server.yaml
@@ -66,7 +66,7 @@ spec:
         # The library PVC is populated by the seed phase before this
         # Deployment reconciles, so no rsync init is needed here.
         - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
           command:
             - sh
             - -c
diff --git a/kubernetes/apps/libation/cronjob.yaml b/kubernetes/apps/libation/cronjob.yaml
index 41564ff3..6e08211a 100644
--- a/kubernetes/apps/libation/cronjob.yaml
+++ b/kubernetes/apps/libation/cronjob.yaml
@@ -48,7 +48,7 @@ spec:
             # this sentinel: the entrypoint copies AccountsSettings.json
             # into ephemeral /config-internal rather than symlinking it.
             - name: seed-config
-              image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+              image: busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
               command: ["/bin/sh", "-eu", "-c"]
               args:
                 - |
@@ -94,7 +94,7 @@ spec:
             - name: libation
               # Pinned by digest: Spegel caches mutable tag resolutions, so
               # :latest stayed on 13.7.11 despite imagePullPolicy Always.
-              image: docker.io/rmcrackan/libation:14.2.2@sha256:fe188ac3c4ce63cc305971c76e648748341427e16bcf884011da8a384fd3908c
+              image: docker.io/rmcrackan/libation:14.2.5@sha256:7bb47a417311d154c6691747320d0b62ce15527280ad99f0e2a85ac9a6b07e40
               # The entrypoint stages config into ephemeral /config-internal
               # by copy (only the DB is symlinked to the PVC), so Audible
               # tokens refreshed during a run are lost at container exit.
diff --git a/kubernetes/apps/matrix/element.yaml b/kubernetes/apps/matrix/element.yaml
index 45fd852d..916d688f 100644
--- a/kubernetes/apps/matrix/element.yaml
+++ b/kubernetes/apps/matrix/element.yaml
@@ -72,7 +72,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.32@sha256:f8700633d4336258af7a05b53865a4f479e0d628cf2d9ca83d28b5939314d4ce
+          image: ghcr.io/element-hq/element-web:v1.12.33@sha256:b0aa4b5a4fc1afaaff62e2dbd0c92d57e2b20724f3ccb2fef53aae949088c3d2
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/kubernetes/apps/matrix/mas.yaml b/kubernetes/apps/matrix/mas.yaml
index bab8762c..8bf1d83d 100644
--- a/kubernetes/apps/matrix/mas.yaml
+++ b/kubernetes/apps/matrix/mas.yaml
@@ -137,7 +137,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1@sha256:02712e68c90f3743fedbd5e3343517481b2b4f246a9fd9e2f050dc2553033847
+          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0@sha256:494c67f08ee8344368f4ed336611dea02b26c4e058bf37a212d090d50b612659
           # The server applies database migrations and syncs the upstream
           # providers from the config on start.
           args: ["server", "--config", "/config/config.yaml"]
diff --git a/kubernetes/apps/matrix/synapse.yaml b/kubernetes/apps/matrix/synapse.yaml
index 6071d6b6..ad767f58 100644
--- a/kubernetes/apps/matrix/synapse.yaml
+++ b/kubernetes/apps/matrix/synapse.yaml
@@ -179,7 +179,7 @@ spec:
         # first. The marker on the data PVC makes later starts skip it.
         # Debug image: the plain one has no shell for the marker check.
         - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1-debug@sha256:75f369b206785f1480f4a9f8dd81d7f9f3c6793c40fd184358ecd5d7acae17d4
+          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0-debug@sha256:362b8cc6b1176aec059f3539da2d47c8b47587d1584431bf1aca285146d42b08
           command:
             - /busybox/sh
             - -ec
@@ -234,7 +234,7 @@ spec:
               mountPath: /data
       containers:
         - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.163.2@sha256:c3c21919a322f74d177a43bce8031adc81ef839ddd117a8dd03cfec350e76e02
+          image: ghcr.io/element-hq/synapse:v1.164.1@sha256:fa4aa980f279bcf26d4e7ecc2a2c9a701c73f2ebe8841da9bdcf3b2fdf693d75
           # Bypass /start.py: it expects to run as root and template a config
           # from env. Default mode is generate-missing-and-run, which creates
           # the signing key on first start.
diff --git a/kubernetes/apps/monitoring/helmrelease-prometheus.yaml b/kubernetes/apps/monitoring/helmrelease-prometheus.yaml
index 440690ad..0f5727f4 100644
--- a/kubernetes/apps/monitoring/helmrelease-prometheus.yaml
+++ b/kubernetes/apps/monitoring/helmrelease-prometheus.yaml
@@ -17,7 +17,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "92.13.1"
+      version: "92.17.0"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
diff --git a/kubernetes/apps/otbr/dataset-bootstrap.yaml b/kubernetes/apps/otbr/dataset-bootstrap.yaml
index 244d1458..8578fd02 100644
--- a/kubernetes/apps/otbr/dataset-bootstrap.yaml
+++ b/kubernetes/apps/otbr/dataset-bootstrap.yaml
@@ -74,7 +74,7 @@ spec:
           # alpine/kubectl is the maintained replacement. Pin the tag
           # to the cluster's server version so kubectl is in lock-step
           # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7
+          image: docker.io/alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a
           env:
             - name: DATASET_TLV
               valueFrom:
diff --git a/kubernetes/apps/otbr/deployment.yaml b/kubernetes/apps/otbr/deployment.yaml
index 9581b1f5..ebf876a6 100644
--- a/kubernetes/apps/otbr/deployment.yaml
+++ b/kubernetes/apps/otbr/deployment.yaml
@@ -47,7 +47,7 @@ spec:
         #
         # Hence socat is installed at startup and run inside this container.
         - name: otbr
-          image: openthread/otbr:latest@sha256:f3e43ccd86d6da87323873efa0c9b6f92a2a8cc75a804ea50e34c96680363e2e
+          image: openthread/otbr:latest@sha256:51f9af250252f4faae85d0197574a7c17ada873c78799854461a93e3e42cf324
           command:
             - bash
             - -c
diff --git a/kubernetes/apps/paperless/paperless.yaml b/kubernetes/apps/paperless/paperless.yaml
index 44893359..963a88c7 100644
--- a/kubernetes/apps/paperless/paperless.yaml
+++ b/kubernetes/apps/paperless/paperless.yaml
@@ -287,7 +287,7 @@ spec:
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         # anchor: bridge-tls-proxy
         - name: bridge-tls-proxy
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
           args:
             - "-d"
             - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"
diff --git a/kubernetes/apps/renovate/cronjob.yaml b/kubernetes/apps/renovate/cronjob.yaml
index fa80a4d4..b08a7e84 100644
--- a/kubernetes/apps/renovate/cronjob.yaml
+++ b/kubernetes/apps/renovate/cronjob.yaml
@@ -59,7 +59,7 @@ spec:
             - name: renovate
               # Pinned by tag and digest. Renovate updates itself through
               # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.181.8@sha256:b28b2de1dfd35de7e8198756d7f7cdd84ebc28c3f25e80f5b09e598d3faefb2a
+              image: docker.io/renovate/renovate:44.199.2@sha256:0538f498be1b074e2434f8449cab7b2be30f8c0d0baf3b72814010f19db5bcfb
               env:
                 - name: RENOVATE_CONFIG_FILE
                   value: /config/config.json
diff --git a/kubernetes/apps/uptime-monitor/deployment.yaml b/kubernetes/apps/uptime-monitor/deployment.yaml
index da879bc2..c3b838ca 100644
--- a/kubernetes/apps/uptime-monitor/deployment.yaml
+++ b/kubernetes/apps/uptime-monitor/deployment.yaml
@@ -57,7 +57,7 @@ spec:
           # Pinned, and deliberately NOT under Flux image automation. rbac.yaml
           # is derived from what this exact version calls; an automatic bump
           # could add a call the Role does not cover, silently.
-          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.13@sha256:3301afb61c10abc4e334deab9cd8601cef069e352b4d7f4dd0897787fca32eac
+          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.14@sha256:6d7b7fcb39d72296b6b6c0301b443fb31e12d86c55e706adcc7e4f92a887a3ba
           command: ["/manager"]
           args:
             - --health-probe-bind-address=:8081
diff --git a/kubernetes/apps/wiki/cronjobs.yaml b/kubernetes/apps/wiki/cronjobs.yaml
index 1c00168d..23515a96 100644
--- a/kubernetes/apps/wiki/cronjobs.yaml
+++ b/kubernetes/apps/wiki/cronjobs.yaml
@@ -68,7 +68,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: sync
-              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
               command:
                 - sh
                 - -c
@@ -128,7 +128,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: run
-              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
               command:
                 - sh
                 - -c
diff --git a/kubernetes/apps/wordpress/deployment.yaml b/kubernetes/apps/wordpress/deployment.yaml
index 7de4c8ef..ffa86068 100644
--- a/kubernetes/apps/wordpress/deployment.yaml
+++ b/kubernetes/apps/wordpress/deployment.yaml
@@ -25,7 +25,7 @@ spec:
         fsGroup: 33
       containers:
         - name: wordpress
-          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
+          image: wordpress:7.1.4-php8.5-apache@sha256:131532d893b5dc4fdf4312a878b7e5e4e4d1d40eb54c854c78eddf6282457dfb
           ports:
             - name: http
               containerPort: 80
diff --git a/kubernetes/infrastructure-inhouse/bird/daemonset.yaml b/kubernetes/infrastructure-inhouse/bird/daemonset.yaml
index e7d91d64..c747f0f3 100644
--- a/kubernetes/infrastructure-inhouse/bird/daemonset.yaml
+++ b/kubernetes/infrastructure-inhouse/bird/daemonset.yaml
@@ -69,7 +69,7 @@ spec:
           # first build of that day — imagePullPolicy: Always does not help,
           # because the tag itself resolves stale. Update this when the image
           # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
+          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -95,7 +95,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
+          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
           resources:
             requests:
               cpu: "50m"
diff --git a/review-bot/Containerfile b/review-bot/Containerfile
index da85f286..75af189b 100644
--- a/review-bot/Containerfile
+++ b/review-bot/Containerfile
@@ -2,7 +2,7 @@
 #
 # Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
 # (the binary has no shell and no package manager to patch or to exec).
-FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
+FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build
 
 WORKDIR /build
 COPY go.mod go.sum ./
diff --git a/secret-rotator/Containerfile b/secret-rotator/Containerfile
index f7b62919..1a365479 100644
--- a/secret-rotator/Containerfile
+++ b/secret-rotator/Containerfile
@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.99-alpine@sha256:b1d5dd5a22a09404d3e798c0cf051b689077360374eb505fa5bb93c479693d87 AS build
+FROM rust:1.99-alpine@sha256:7e9e2d068a107a2adafd19930011178d14a78326053cd4c3a9f7ad3fd049557d AS build
 
 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.