diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e708f01..b8fe32a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,46 +1,38 @@
-# https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions#github-context
-# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif
-# https://github.community/t/how-to-get-just-the-tag-name/16241/10
-
-name: CI
+name: Release
 
 on:
   push:
     tags:
       - "v*"
-    branches:
-      - master
-      - next
 
 jobs:
-  build:
+  release:
     runs-on: ubuntu-latest
-
     steps:
-      - name: cancel previous runs
-        uses: styfle/cancel-workflow-action@0.6.0
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
         with:
-          access_token: ${{ github.token }}
-
-      - uses: actions/checkout@v2
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: docker build
-        run: |
-          export ARCH=$([ $(uname -m) = "x86_64" ] && echo "amd64" || echo "arm64")
-          mkdir -p ~/.docker/cli-plugins/
-          wget -qO ~/.docker/cli-plugins/docker-buildx https://github.com/docker/buildx/releases/download/v0.8.1/buildx-v0.8.1.linux-${ARCH}
-          chmod a+x ~/.docker/cli-plugins/docker-buildx
-          docker info
-          docker buildx version
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-          docker buildx create --name xbuilder --use
-          docker buildx inspect --bootstrap
-          .github/bin/docker-release.sh
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          # list of Docker images to use as base name for tags
+          images: |
+            ghcr.io/ivx/argo-cd-helmfile
+          # generate Docker tags based on the following events/attributes
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
 
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-          GHCR_PASSWORD: ${{ secrets.GHCR_PASSWORD }}
-          DOCKER_CLI_EXPERIMENTAL: enabled
-          DOCKER_BUILD_PLATFORM: linux/amd64,linux/arm64/v8
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
new file mode 100644
index 0000000..d2bf604
--- /dev/null
+++ b/.github/workflows/pull-request.yml
@@ -0,0 +1,20 @@
+name: PR
+
+on:
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build
+        uses: docker/build-push-action@v7
+        with:
+          push: false
diff --git a/Dockerfile b/Dockerfile
index ba51195..b141a0f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -78,33 +78,36 @@ RUN groupadd -g $ARGOCD_USER_ID argocd && \
 
 # binary versions
 # https://github.com/FiloSottile/age/releases
-ARG AGE_VERSION="v1.2.0"
+ARG AGE_VERSION="v1.3.1"
 # install via apt for now
 #ARG JQ_VERSION="1.6"
 ARG HELM2_VERSION="v2.17.0"
 # https://github.com/helm/helm/releases
 ARG HELM3_VERSION="v3.17.3"
+# https://github.com/helm/helm/releases
+ARG HELM4_VERSION="v4.1.4"
 # https://github.com/helmfile/helmfile/releases
-ARG HELMFILE_VERSION="0.171.0"
+ARG HELMFILE_VERSION="1.4.4"
 # https://github.com/kubernetes-sigs/kustomize/releases
-ARG KUSTOMIZE5_VERSION="5.6.0"
+ARG KUSTOMIZE5_VERSION="5.8.1"
 # https://github.com/getsops/sops/releases
-ARG SOPS_VERSION="v3.10.2"
+ARG SOPS_VERSION="v3.12.2"
 # https://github.com/mikefarah/yq/releases
-ARG YQ_VERSION="v4.45.4"
+ARG YQ_VERSION="v4.53.2"
 
 # relevant for kubectl if installed
 ARG KUBESEAL_VERSION="0.30.0"
 # curl -v -L 'https://dl.k8s.io/release/stable.txt'
-ARG KUBECTL_VERSION="v1.32.5"
+ARG KUBECTL_VERSION="v1.36.0"
 # https://github.com/kubernetes-sigs/krew/releases/
-ARG KREW_VERSION="v0.4.5"
+ARG KREW_VERSION="v0.5.0"
 
 # wget -qO "/usr/local/bin/jq"       "https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64" && \
 RUN \
   GO_ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/') && \
   wget -qO-                          "https://get.helm.sh/helm-${HELM2_VERSION}-linux-${GO_ARCH}.tar.gz" | tar zxv --strip-components=1 -C /tmp linux-${GO_ARCH}/helm && mv /tmp/helm /usr/local/bin/helm-v2 && \
   wget -qO-                          "https://get.helm.sh/helm-${HELM3_VERSION}-linux-${GO_ARCH}.tar.gz" | tar zxv --strip-components=1 -C /tmp linux-${GO_ARCH}/helm && mv /tmp/helm /usr/local/bin/helm-v3 && \
+  wget -qO-                          "https://get.helm.sh/helm-${HELM4_VERSION}-linux-${GO_ARCH}.tar.gz" | tar zxv --strip-components=1 -C /tmp linux-${GO_ARCH}/helm && mv /tmp/helm /usr/local/bin/helm-v4 && \
   wget -qO "/usr/local/bin/sops"     "https://github.com/mozilla/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.${GO_ARCH}" && \
   wget -qO-                          "https://github.com/FiloSottile/age/releases/download/${AGE_VERSION}/age-${AGE_VERSION}-linux-${GO_ARCH}.tar.gz" | tar zxv --strip-components=1 -C /usr/local/bin age/age age/age-keygen && \
   wget -qO-                          "https://github.com/helmfile/helmfile/releases/download/v${HELMFILE_VERSION}/helmfile_${HELMFILE_VERSION}_linux_${GO_ARCH}.tar.gz" | tar zxv -C /usr/local/bin helmfile && \
@@ -118,7 +121,7 @@ RUN \
 COPY src/*.sh /usr/local/bin/
 
 RUN \
-  ln -sf /usr/local/bin/helm-v3 /usr/local/bin/helm && \
+  ln -sf /usr/local/bin/helm-v4 /usr/local/bin/helm && \
   chown root:root /usr/local/bin/* && chmod 755 /usr/local/bin/*
 
 ENV USER=argocd
@@ -142,16 +145,17 @@ ENV PATH="${KREW_ROOT}/bin:$PATH"
 
 # plugin versions
 # https://github.com/databus23/helm-diff/releases
-ARG HELM_DIFF_VERSION="3.12.2"
+ARG HELM_DIFF_VERSION="3.15.3"
 # https://github.com/aslafy-z/helm-git/releases
 ARG HELM_GIT_VERSION="1.4.0"
 # https://github.com/jkroepke/helm-secrets/releases
-ARG HELM_SECRETS_VERSION="4.6.5"
+ARG HELM_SECRETS_VERSION="4.7.4"
 
 RUN \
-  helm-v3 plugin install https://github.com/databus23/helm-diff   --version ${HELM_DIFF_VERSION} && \
-  helm-v3 plugin install https://github.com/aslafy-z/helm-git     --version ${HELM_GIT_VERSION} && \
-  helm-v3 plugin install https://github.com/jkroepke/helm-secrets --version ${HELM_SECRETS_VERSION} && \
+  helm-v4 plugin install https://github.com/databus23/helm-diff   --version ${HELM_DIFF_VERSION} --verify=false && \
+  helm-v4 plugin install https://github.com/aslafy-z/helm-git     --version ${HELM_GIT_VERSION} --verify=false && \
+  helm-v4 plugin install https://github.com/jkroepke/helm-secrets --version ${HELM_SECRETS_VERSION} --verify=false && \
+  helmfile init --force \
   kubectl krew update && \
   mkdir -p ${KREW_ROOT}/bin && \
   true