diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0da40a5..3dc6e98 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v4.3.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
@@ -26,6 +26,6 @@ repos:
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/stackrox/kube-linter
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: kube-linter
diff --git a/bootstrap/argocd-config.yaml b/bootstrap/argocd-config.yaml
index 480624b..5e0766d 100644
--- a/bootstrap/argocd-config.yaml
+++ b/bootstrap/argocd-config.yaml
@@ -69,15 +69,15 @@ spec:
     initContainers:
       # Use alpine to download and install KSOPS binaries
       - name: install-ksops
-        image: docker.io/alpine:3.21
+        image: docker.io/alpine:3.23
         command: ["/bin/sh", "-c"]
         args:
           - |
             set -e
-            echo "Downloading kustomize v5.8.0..."
-            wget -qO- https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.8.0/kustomize_v5.8.0_linux_amd64.tar.gz | tar xz -C /custom-tools
-            echo "Downloading KSOPS v4.4.0..."
-            wget -qO- https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.4.0/ksops_4.4.0_Linux_x86_64.tar.gz | tar xz -C /custom-tools
+            echo "Downloading kustomize v5.8.1..."
+            wget -qO- https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.8.1/kustomize_v5.8.1_linux_amd64.tar.gz | tar xz -C /custom-tools
+            echo "Downloading KSOPS v4.5.1..."
+            wget -qO- https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.5.1/ksops_4.5.1_Linux_x86_64.tar.gz | tar xz -C /custom-tools
             chmod +x /custom-tools/kustomize /custom-tools/ksops
             echo "Done."
         volumeMounts:
diff --git a/operators/arc/arcsystem.yaml b/operators/arc/arcsystem.yaml
index 3daade6..4a7c67f 100644
--- a/operators/arc/arcsystem.yaml
+++ b/operators/arc/arcsystem.yaml
@@ -34,7 +34,7 @@ spec:
   source:
     chart: gha-runner-scale-set-controller
     repoURL: ghcr.io/actions/actions-runner-controller-charts
-    targetRevision: 0.13.1
+    targetRevision: 0.14.2
     helm:
       releaseName: arc
       valuesObject:
diff --git a/operators/forgejo/application.yaml b/operators/forgejo/application.yaml
index 5f61354..17b6219 100644
--- a/operators/forgejo/application.yaml
+++ b/operators/forgejo/application.yaml
@@ -14,7 +14,7 @@ spec:
   source:
     chart: forgejo
     repoURL: code.forgejo.org/forgejo-helm
-    targetRevision: 17.0.1
+    targetRevision: 17.1.4
     helm:
       releaseName: forgejo
       valuesObject:
diff --git a/operators/grafana/kustomization.yaml b/operators/grafana/kustomization.yaml
index ab5bedc..aa874ec 100644
--- a/operators/grafana/kustomization.yaml
+++ b/operators/grafana/kustomization.yaml
@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/grafana/grafana-operator.git/deploy/kustomize/overlays/cluster_scoped?ref=v5.22.2
+  - https://github.com/grafana/grafana-operator.git/deploy/kustomize/overlays/cluster_scoped?ref=v5.24.0
 
 patches:
   # Drop resource requests/limits — single-node cluster doesn't need them.
diff --git a/operators/sops-secrets-operator/application.yaml b/operators/sops-secrets-operator/application.yaml
index e57c503..15c0adc 100644
--- a/operators/sops-secrets-operator/application.yaml
+++ b/operators/sops-secrets-operator/application.yaml
@@ -17,7 +17,7 @@ spec:
   source:
     chart: sops-secrets-operator
     repoURL: https://isindir.github.io/sops-secrets-operator/
-    targetRevision: 0.27.1
+    targetRevision: 0.27.2
     helm:
       releaseName: sops-secrets-operator
       valuesObject:
diff --git a/workloads/arc/arc-tf-application.yaml b/workloads/arc/arc-tf-application.yaml
index 5284e7d..645268f 100644
--- a/workloads/arc/arc-tf-application.yaml
+++ b/workloads/arc/arc-tf-application.yaml
@@ -17,7 +17,7 @@ spec:
   source:
     chart: gha-runner-scale-set
     repoURL: ghcr.io/actions/actions-runner-controller-charts
-    targetRevision: 0.13.1
+    targetRevision: 0.14.2
     helm:
       releaseName: arc-tf
       valuesObject:
diff --git a/workloads/warp/cloudflared.yaml b/workloads/warp/cloudflared.yaml
index ed800b0..aa863d6 100644
--- a/workloads/warp/cloudflared.yaml
+++ b/workloads/warp/cloudflared.yaml
@@ -41,7 +41,7 @@ spec:
         runAsUser: 65532
       containers:
         - name: cloudflared
-          image: docker.io/cloudflare/cloudflared:2026.2.0
+          image: docker.io/cloudflare/cloudflared:2026.8.1
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false