diff --git a/.github/actions/kind-create/action.yaml b/.github/actions/kind-create/action.yaml
index 5e133cf13..c1b84160d 100644
--- a/.github/actions/kind-create/action.yaml
+++ b/.github/actions/kind-create/action.yaml
@@ -25,7 +25,7 @@ runs:
   - name: Set up Docker Buildx
     uses: docker/setup-buildx-action@v3
   - name: Setup Kind
-    uses: helm/kind-action@v1.12.0
+    uses: helm/kind-action@v1.13.0
     with:
       cluster_name: ${{ inputs.kind_cluster_name }}
       version: v0.30.0
diff --git a/Dockerfile b/Dockerfile
index 7c3e172c3..b92a16fc5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.25@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.25@sha256:516827db2015144cf91e042d1b6a3aca574d013a4705a6fdc4330444d47169d5 AS builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
diff --git a/Makefile b/Makefile
index be702f1f6..d19f0226b 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ RELEASE_MSG ?= "koperator release"
 REL_TAG = $(shell ./scripts/increment_version.sh -${RELEASE_TYPE} ${TAG})
 
 # Version constants
-GOLANGCI_VERSION = 2.6.0 # renovate: datasource=github-releases depName=golangci/golangci-lint
+GOLANGCI_VERSION = 2.6.1 # renovate: datasource=github-releases depName=golangci/golangci-lint
 LICENSEI_VERSION = 0.9.0 # renovate: datasource=github-releases depName=goph/licensei
 CONTROLLER_GEN_VERSION = v0.19.0 # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
 ENVTEST_K8S_VERSION = 1.34.1 # renovate: datasource=github-releases depName=kubernetes/kubernetes
diff --git a/api/v1beta1/kafkacluster_types.go b/api/v1beta1/kafkacluster_types.go
index c629d6b6e..a73290471 100644
--- a/api/v1beta1/kafkacluster_types.go
+++ b/api/v1beta1/kafkacluster_types.go
@@ -62,7 +62,7 @@ const (
 	DefaultMonitorImage = "ghcr.io/adobe/koperator/jmx-javaagent:1.4.0" // renovate: datasource=docker depName=ghcr.io/adobe/koperator/jmx-javaagent
 
 	// DefaultEnvoyImage is the default Envoy proxy image used when users don't specify it in EnvoyConfig.Image
-	DefaultEnvoyImage = "envoyproxy/envoy:v1.22.2" // renovate: datasource=docker depName=envoyproxy/envoy
+	DefaultEnvoyImage = "envoyproxy/envoy:v1.36.2" // renovate: datasource=docker depName=envoyproxy/envoy
 
 	// ControllerNodeProcessRole represents the node is a controller node
 	ControllerNodeProcessRole = "controller"
diff --git a/docker/jmx_exporter/Dockerfile b/docker/jmx_exporter/Dockerfile
index 031278085..b6b1814fb 100644
--- a/docker/jmx_exporter/Dockerfile
+++ b/docker/jmx_exporter/Dockerfile
@@ -1,6 +1,6 @@
 ARG JMX_EXPORTER_VERSION=1.5.0 # renovate: datasource=github-releases depName=prometheus/jmx_exporter
 
-FROM maven:3-amazoncorretto-21@sha256:0d4b06890e8ecece68c7854e606f09dcdbc11644c98fb4a96a24193f3084275a AS build
+FROM maven:3-amazoncorretto-21@sha256:b2479a898b51c8eb90fbeec9499e7b43d8ac7bd803833141094726f227cfe13e AS build
 ARG JMX_EXPORTER_VERSION
 
 # Install wget to download the release tarball
diff --git a/docker/kafka/Dockerfile b/docker/kafka/Dockerfile
index 3e3a0d6df..ed89b5c96 100644
--- a/docker/kafka/Dockerfile
+++ b/docker/kafka/Dockerfile
@@ -28,7 +28,7 @@ RUN apk add --no-cache gnupg wget && \
 
 
 # backported from https://github.com/docker-library/openjdk/blob/master/18/jdk/slim-bullseye/Dockerfile
-FROM debian:bullseye-slim@sha256:52927eff8153b563244f98cdc802ba97918afcdf67f9e4867cbf1f7afb3d147b
+FROM debian:bullseye-slim@sha256:75e0b7a6158b4cc911d4be07d9f6b8a65254eb8c58df14023c3da5c462335593
 
 ARG scala_version
 ARG kafka_version
diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
index d82dd55bf..353d818dd 100644
--- a/hack/kafka-test-pod/Dockerfile
+++ b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 as builder
+FROM golang:1.25@sha256:516827db2015144cf91e042d1b6a3aca574d013a4705a6fdc4330444d47169d5 as builder
 
 WORKDIR /workspace
 
diff --git a/tests/e2e/versions.go b/tests/e2e/versions.go
index 9c079081e..0f0aa7d0b 100644
--- a/tests/e2e/versions.go
+++ b/tests/e2e/versions.go
@@ -19,7 +19,7 @@ package e2e
 // These versions are monitored by Renovate for automatic updates
 const (
 	// CertManagerVersion is the version of cert-manager Helm chart
-	CertManagerVersion = "v1.18.2" // renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
+	CertManagerVersion = "v1.19.1" // renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
 
 	// ContourVersion is the version of Contour ingress controller Helm chart
 	ContourVersion = "0.1.0" // renovate: datasource=helm depName=contour registryUrl=https://projectcontour.github.io/helm-charts