diff --git a/apps-values/nextcloud.yaml b/apps-values/nextcloud.yaml
index 9d8dd0fe..510ae3ba 100644
--- a/apps-values/nextcloud.yaml
+++ b/apps-values/nextcloud.yaml
@@ -76,7 +76,7 @@ nextcloud:
   extraSidecarContainers:
     - name: ts-sidecar
       imagePullPolicy: Always
-      image: "ghcr.io/tailscale/tailscale:latest@sha256:8c42c4574ab066384fcb72f69e086a2ff1dd3652eb6f56856cee34bcf0d2f680"
+      image: "ghcr.io/tailscale/tailscale:latest@sha256:2667499ed87ae29218f292556ba062918402dd5e92e93637af14867e4df12dd3"
       resources:
         limits:
           devic.es/tun: "1"
diff --git a/argo-workflows/mattermost-te/build-mattermost-te.yaml b/argo-workflows/mattermost-te/build-mattermost-te.yaml
index 02e7915c..cb5b5869 100644
--- a/argo-workflows/mattermost-te/build-mattermost-te.yaml
+++ b/argo-workflows/mattermost-te/build-mattermost-te.yaml
@@ -18,7 +18,7 @@ spec:
       - name: base-image-tag
         value: "26.04"
       - name: base-image-arm64-digest
-        value: "sha256:513c074113a871b51a8d16ab445c88779d6452d937a164fb5cc479f32668a41d"
+        value: "sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78"
 
   templates:
     - name: main
@@ -46,7 +46,7 @@ spec:
           secret:
             secretName: smigtech-ca-cert
       container:
-        image: quay.io/buildah/stable:v1.43.2@sha256:82464727761208e2782447b52e25ffe0860b8a5f8b8e4085854ad0a1cd042b96
+        image: quay.io/buildah/stable:v1.43.2@sha256:704af5d17babbd88bd93c06ecea7554001a2e9570e1fd54687188d3ae5de0e55
         volumeMounts:
           - name: docker-config
             mountPath: /.docker
diff --git a/argo-workflows/templates/buildah.yaml b/argo-workflows/templates/buildah.yaml
index 500a7e08..846b6352 100644
--- a/argo-workflows/templates/buildah.yaml
+++ b/argo-workflows/templates/buildah.yaml
@@ -51,7 +51,7 @@ spec:
           secret:
             secretName: cr-smigz-com-registry
       container:
-        image: quay.io/buildah/stable:v1.43.2@sha256:82464727761208e2782447b52e25ffe0860b8a5f8b8e4085854ad0a1cd042b96
+        image: quay.io/buildah/stable:v1.43.2@sha256:704af5d17babbd88bd93c06ecea7554001a2e9570e1fd54687188d3ae5de0e55
         volumeMounts:
           - name: docker-config
             mountPath: /.docker
diff --git a/kustomizations/cnpg-databases/image-catalog.yaml b/kustomizations/cnpg-databases/image-catalog.yaml
index 684715ab..6a97fd37 100644
--- a/kustomizations/cnpg-databases/image-catalog.yaml
+++ b/kustomizations/cnpg-databases/image-catalog.yaml
@@ -15,10 +15,10 @@ spec:
   # OLTP databases whose heaviest plan costs ~6k against jit_above_cost=100000.
   images:
     - major: 15
-      image: ghcr.io/cloudnative-pg/postgresql:15.19-minimal-trixie@sha256:5cf5a9e916f1120e4c8165c96fbc0abc526cba28265a22e71faace576b6b3c91
+      image: ghcr.io/cloudnative-pg/postgresql:15.19-minimal-trixie@sha256:ec168ebce71eb35154a6292818006036d406abd4443a7e31410c6c1689673510
     - major: 16
-      image: ghcr.io/cloudnative-pg/postgresql:16.15-minimal-trixie@sha256:92f7c8bc5b482f71be8014e218799aaba952d1ae96951f72b06b1d719cd89be7
+      image: ghcr.io/cloudnative-pg/postgresql:16.15-minimal-trixie@sha256:0b3082c00f138c3d859bf495bccf77785a61ca03f876a72ca6826a6d9df5f528
     - major: 17
-      image: ghcr.io/cloudnative-pg/postgresql:17.11-minimal-trixie@sha256:3c8907d7725e93568134c32799bf235f75a9fd509cdcadb25bca706d94249327
+      image: ghcr.io/cloudnative-pg/postgresql:17.11-minimal-trixie@sha256:cfc42005357630d2c0bfca095c93a6abe44884486acb0de2e5e511a087b7eb15
     - major: 18
-      image: ghcr.io/cloudnative-pg/postgresql:18.6-minimal-trixie@sha256:d67f21ed2110b1f59349217760e389f1bded54cd0b6dee485ed152b4c8a8b9e2
+      image: ghcr.io/cloudnative-pg/postgresql:18.6-minimal-trixie@sha256:0fae0cb527912426a889ec0b21b9733e5b76fdc6ad8909914a6e8a6c8ba4f64b
diff --git a/kustomizations/home-assistant/deployment.yaml b/kustomizations/home-assistant/deployment.yaml
index 48908bc8..848e2484 100644
--- a/kustomizations/home-assistant/deployment.yaml
+++ b/kustomizations/home-assistant/deployment.yaml
@@ -21,7 +21,7 @@ spec:
     spec:
       containers:
         - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:stable@sha256:a1bc133af84ee6505fe2c266d9805b7c75b780dfdc188edfee3b11e8f3cd8efe
+          image: ghcr.io/home-assistant/home-assistant:stable@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196
           ports:
             - name: mdns
               containerPort: 5353
diff --git a/kustomizations/home-assistant/kustomization.yaml b/kustomizations/home-assistant/kustomization.yaml
index 2aa03adb..4c211ad6 100644
--- a/kustomizations/home-assistant/kustomization.yaml
+++ b/kustomizations/home-assistant/kustomization.yaml
@@ -5,7 +5,7 @@ resources:
 
 images:
   - name: ghcr.io/home-assistant/home-assistant
-    newTag: stable@sha256:a1bc133af84ee6505fe2c266d9805b7c75b780dfdc188edfee3b11e8f3cd8efe
+    newTag: stable@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196
 
 configMapGenerator:
   - name: home-assistant-config
diff --git a/kustomizations/redis/base/deployment.yaml b/kustomizations/redis/base/deployment.yaml
index 1161c272..549e9a18 100644
--- a/kustomizations/redis/base/deployment.yaml
+++ b/kustomizations/redis/base/deployment.yaml
@@ -27,7 +27,7 @@ spec:
             - --save
             - "60"
             - "1"
-          image: valkey/valkey:9.1.2-trixie@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
+          image: valkey/valkey:9.1.2-trixie@sha256:418652cfb58ef879d4978c33553735d7147016032d5aefaa14c828e611eb9dfd
           name: valkey
           ports:
             - containerPort: 6379
diff --git a/kustomizations/redis/base/kustomization.yaml b/kustomizations/redis/base/kustomization.yaml
index 54c1585f..ac4ec9e5 100644
--- a/kustomizations/redis/base/kustomization.yaml
+++ b/kustomizations/redis/base/kustomization.yaml
@@ -6,4 +6,4 @@ resources:
 
 images:
   - name: valkey/valkey
-    newTag: 9.1.2-trixie@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
+    newTag: 9.1.2-trixie@sha256:418652cfb58ef879d4978c33553735d7147016032d5aefaa14c828e611eb9dfd
diff --git a/kustomizations/renovate/renovate.yaml b/kustomizations/renovate/renovate.yaml
index ba416e7d..e8205cda 100644
--- a/kustomizations/renovate/renovate.yaml
+++ b/kustomizations/renovate/renovate.yaml
@@ -42,7 +42,7 @@ spec:
       template:
         spec:
           containers:
-            - image: renovate/renovate:full@sha256:53be5fbf5e70c1567a40ef1d1c3709ec7f6d7f4d98bb679395dd4fb8dc890228
+            - image: renovate/renovate:full@sha256:85177d95ce519469ed4183041cd041fb37786de661d54ad6271039f151ae3f28
               name: renovate-bot
               env:
                 - name: RENOVATE_PLATFORM