diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b24793a2..eead931d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-27T17:13:19Z by kres f51cb9c-dirty.
+# Generated on 2026-05-28T10:32:12Z by kres 100288b-dirty.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
@@ -62,7 +62,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -83,7 +83,7 @@ jobs:
           make kres
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # version: v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # version: v4.2.0
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
@@ -168,7 +168,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -215,7 +215,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -227,7 +227,7 @@ jobs:
         run: |
           make unit-tests-race
       - name: coverage
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # version: v6.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # version: v6.0.1
         with:
           files: _out/coverage-unit-tests.txt
           flags: unit-tests
diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
index 7ee873ce..fc9e9c5c 100644
--- a/.github/workflows/helm.yaml
+++ b/.github/workflows/helm.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-17T08:55:31Z by kres 359ab16-dirty.
+# Generated on 2026-05-28T10:32:12Z by kres 100288b-dirty.
 
 concurrency:
   group: helm-${{ github.head_ref || github.run_id }}
@@ -60,14 +60,14 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
         timeout-minutes: 10
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # version: v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # version: v4.2.0
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 7edc88d3..ace3438e 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-12-17T11:13:19Z by kres 4b09af7-dirty.
+# Generated on 2026-05-28T10:32:12Z by kres 100288b-dirty.
 
 "on":
   schedule:
@@ -14,7 +14,7 @@ jobs:
       - ubuntu-latest
     steps:
       - name: Lock old issues
-        uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # version: v6.0.0
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # version: v6.0.2
         with:
           issue-inactive-days: "60"
           log-output: "true"
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index e81c4ab8..a9867689 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-04T13:41:46Z by kres 6458cfd-dirty.
+# Generated on 2026-05-28T10:32:12Z by kres 100288b-dirty.
 
 "on":
   schedule:
@@ -15,7 +15,7 @@ jobs:
       - ubuntu-latest
     steps:
       - name: Close stale issues and PRs
-        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # version: v10.2.0
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # version: v10.3.0
         with:
           close-issue-message: This issue was closed because it has been stalled for 7 days with no activity.
           days-before-issue-close: "5"
diff --git a/go.mod b/go.mod
index a3bc7f01..ede9869b 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module github.com/siderolabs/kres
 go 1.26.3
 
 require (
-	github.com/go-git/go-git/v5 v5.19.0
-	github.com/google/go-github/v87 v87.0.0
+	github.com/go-git/go-git/v5 v5.19.1
+	github.com/google/go-github/v88 v88.0.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/siderolabs/gen v0.8.6
 	github.com/spf13/cobra v1.10.2
diff --git a/go.sum b/go.sum
index 16da8c27..5196c4ca 100644
--- a/go.sum
+++ b/go.sum
@@ -29,15 +29,15 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc=
-github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v87 v87.0.0 h1:9Ck3dcOxWJyfsN8tzdah4YvmqB/7ZsstMglv/PkOsl0=
-github.com/google/go-github/v87 v87.0.0/go.mod h1:hGUoT5pwm/ck5uLL+wroSVQfg8mpe+buxllCcGV4VaM=
+github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
+github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
diff --git a/internal/config/constants.go b/internal/config/constants.go
index 334c54dc..6e3fae19 100644
--- a/internal/config/constants.go
+++ b/internal/config/constants.go
@@ -20,8 +20,8 @@ const (
 	CheckOutActionRef     = "de0fac2e4500dabe0009e67214ff5f5447ce83dd"
 	// CodeCovActionVersion is the version of codecov github action.
 	// renovate: datasource=github-tags depName=codecov/codecov-action
-	CodeCovActionVersion = "v6.0.0"
-	CodeCovActionRef     = "57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"
+	CodeCovActionVersion = "v6.0.1"
+	CodeCovActionRef     = "e79a6962e0d4c0c17b229090214935d2e33f8354"
 	// DeepCopyVersion is the version of deepcopy.
 	// renovate: datasource=go depName=github.com/siderolabs/deep-copy
 	DeepCopyVersion = "v0.5.8"
@@ -77,8 +77,8 @@ const (
 	HelmDocsVersion = "v1.14.2"
 	// LoginActionVersion is the version of login github action.
 	// renovate: datasource=github-tags depName=docker/login-action
-	LoginActionVersion = "v4.1.0"
-	LoginActionRef     = "4907a6ddec9925e35a0a9e82d7399ccc52663121"
+	LoginActionVersion = "v4.2.0"
+	LoginActionRef     = "650006c6eb7dba73a995cc03b0b2d7f5ca915bee"
 	// MarkdownLintCLIVersion is the version of markdownlint.
 	// renovate: datasource=npm depName=markdownlint-cli
 	MarkdownLintCLIVersion = "0.48.0"
@@ -91,7 +91,7 @@ const (
 	// As a rule of thumb, we bump only to the versions promoted to be LTS (even [not odd] major versions get promoted after a while, always check).
 	//
 	// renovate: datasource=docker versioning=docker depName=node
-	NodeContainerImageVersion = "24.15.0-alpine"
+	NodeContainerImageVersion = "24.16.0-alpine"
 	// PkgsVersion is the version of pkgs.
 	// renovate: datasource=github-tags depName=siderolabs/pkgs
 	PkgsVersion = "v1.13.0"
@@ -110,15 +110,15 @@ const (
 	SentencesPerLineVersion = "0.5.2"
 	// SetupBuildxActionVersion is the version of setup-buildx github action.
 	// renovate: datasource=github-tags depName=docker/setup-buildx-action
-	SetupBuildxActionVersion = "v4.0.0"
-	SetupBuildxActionRef     = "4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"
+	SetupBuildxActionVersion = "v4.1.0"
+	SetupBuildxActionRef     = "d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5"
 	// SetupTerraformActionVersion is the version of setup terraform github action.
 	// renovate: datasource=github-tags depName=hashicorp/setup-terraform
 	SetupTerraformActionVersion = "v4.0.1"
 	SetupTerraformActionRef     = "dfe3c3f87815947d99a8997f908cb6525fc44e9e"
 	// SyftVersion is the version of syft used for SBOM generation.
 	// renovate: datasource=go depName=github.com/anchore/syft
-	SyftVersion = "v1.42.3"
+	SyftVersion = "v1.44.0"
 	// SlackNotifyActionVersion is the version of slack notify github action.
 	// renovate: datasource=github-tags depName=slackapi/slack-github-action
 	SlackNotifyActionVersion = "v3.0.3"
@@ -136,10 +136,10 @@ const (
 	VTProtobufVersion = "v0.6.0"
 	// StaleActionVersion is the version of stale github action.
 	// renovate: datasource=github-tags depName=actions/stale
-	StaleActionVersion = "v10.2.0"
-	StaleActionRef     = "b5d41d4e1d5dceea10e7104786b73624c18a190f"
+	StaleActionVersion = "v10.3.0"
+	StaleActionRef     = "eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899"
 	// LockThreadsActionVersion is the version of lock threads github action.
 	// renovate: datasource=github-tags depName=dessant/lock-threads
-	LockThreadsActionVersion = "v6.0.0"
-	LockThreadsActionRef     = "7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7"
+	LockThreadsActionVersion = "v6.0.2"
+	LockThreadsActionRef     = "89ae32b08ed1a541efecbab17912962a5e38981c"
 )
diff --git a/internal/output/ghworkflow/testdata/TestGHWorkflowSuite/TestDefaultWorkflows/ci.yaml b/internal/output/ghworkflow/testdata/TestGHWorkflowSuite/TestDefaultWorkflows/ci.yaml
index 13e29a64..5036c2d5 100644
--- a/internal/output/ghworkflow/testdata/TestGHWorkflowSuite/TestDefaultWorkflows/ci.yaml
+++ b/internal/output/ghworkflow/testdata/TestGHWorkflowSuite/TestDefaultWorkflows/ci.yaml
@@ -61,7 +61,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/output/github/github.go b/internal/output/github/github.go
index 4d2a48d8..4fb09b9d 100644
--- a/internal/output/github/github.go
+++ b/internal/output/github/github.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/google/go-github/v87/github"
+	"github.com/google/go-github/v88/github"
 )
 
 // Output implements interface to GitHub API.
diff --git a/internal/project/common/repository.go b/internal/project/common/repository.go
index 6ecc1556..1bda1246 100644
--- a/internal/project/common/repository.go
+++ b/internal/project/common/repository.go
@@ -12,7 +12,7 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/google/go-github/v87/github"
+	"github.com/google/go-github/v88/github"
 	"github.com/siderolabs/gen/xslices"
 
 	"github.com/siderolabs/kres/internal/config"
diff --git a/internal/project/common/testdata/TestFlatJobMatrix/ci.yaml b/internal/project/common/testdata/TestFlatJobMatrix/ci.yaml
index 6b6c7c9d..bc2cabe0 100644
--- a/internal/project/common/testdata/TestFlatJobMatrix/ci.yaml
+++ b/internal/project/common/testdata/TestFlatJobMatrix/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/project/common/testdata/TestFlatJobMatrixTriggeredNotGated/ci.yaml b/internal/project/common/testdata/TestFlatJobMatrixTriggeredNotGated/ci.yaml
index 04247d74..0b2dc964 100644
--- a/internal/project/common/testdata/TestFlatJobMatrixTriggeredNotGated/ci.yaml
+++ b/internal/project/common/testdata/TestFlatJobMatrixTriggeredNotGated/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/project/common/testdata/TestMatrixConditionResolution/ci.yaml b/internal/project/common/testdata/TestMatrixConditionResolution/ci.yaml
index 35d6eae7..2ae96c3a 100644
--- a/internal/project/common/testdata/TestMatrixConditionResolution/ci.yaml
+++ b/internal/project/common/testdata/TestMatrixConditionResolution/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/project/common/testdata/TestMatrixLabelKeysExpansion/ci.yaml b/internal/project/common/testdata/TestMatrixLabelKeysExpansion/ci.yaml
index bd390a2a..985019c5 100644
--- a/internal/project/common/testdata/TestMatrixLabelKeysExpansion/ci.yaml
+++ b/internal/project/common/testdata/TestMatrixLabelKeysExpansion/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/project/common/testdata/TestMatrixPerEntryTriggerLabels/ci.yaml b/internal/project/common/testdata/TestMatrixPerEntryTriggerLabels/ci.yaml
index 378164ba..062d006e 100644
--- a/internal/project/common/testdata/TestMatrixPerEntryTriggerLabels/ci.yaml
+++ b/internal/project/common/testdata/TestMatrixPerEntryTriggerLabels/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
diff --git a/internal/project/common/testdata/TestTriggeredRunIDAutoInject/ci.yaml b/internal/project/common/testdata/TestTriggeredRunIDAutoInject/ci.yaml
index 76cc71b5..1b2e1f91 100644
--- a/internal/project/common/testdata/TestTriggeredRunIDAutoInject/ci.yaml
+++ b/internal/project/common/testdata/TestTriggeredRunIDAutoInject/ci.yaml
@@ -63,7 +63,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234