diff --git a/README.md b/README.md
index 79ecffb..62a24d5 100644
--- a/README.md
+++ b/README.md
@@ -5,14 +5,14 @@
 | ---- | ------- |
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
 | <a name="requirement_libvirt"></a> [libvirt](#requirement\_libvirt) | ~> 0.9.0 |
-| <a name="requirement_sops"></a> [sops](#requirement\_sops) | ~> 1.3.0 |
+| <a name="requirement_sops"></a> [sops](#requirement\_sops) | ~> 1.4.0 |
 
 ## Providers
 
 | Name | Version |
 | ---- | ------- |
 | <a name="provider_libvirt"></a> [libvirt](#provider\_libvirt) | ~> 0.9.0 |
-| <a name="provider_sops"></a> [sops](#provider\_sops) | ~> 1.3.0 |
+| <a name="provider_sops"></a> [sops](#provider\_sops) | ~> 1.4.0 |
 
 ## Modules
 
diff --git a/main.tf b/main.tf
index bdd3fe3..4261831 100644
--- a/main.tf
+++ b/main.tf
@@ -19,18 +19,18 @@ locals {
 
   # k3s
   k3s_ip      = "192.168.102.2"
-  k3s_version = "v1.31.4+k3s1" # bump as needed; see https://github.com/k3s-io/k3s/releases
+  k3s_version = "v1.31.13+k3s1" # bump as needed; see https://github.com/k3s-io/k3s/releases
 
   # argocd-operator (community) — provides the argoproj.io/v1beta1 ArgoCD CRD
   # consumed by kustomize-cluster/bootstrap/argocd-config.yaml
-  argocd_operator_version = "v0.14.0" # bump as needed; see https://github.com/argoproj-labs/argocd-operator/releases
+  argocd_operator_version = "v0.14.1" # bump as needed; see https://github.com/argoproj-labs/argocd-operator/releases
 
   # cert-manager — argocd-operator's config/default mounts a webhook-server-cert
   # Secret that only materializes via cert-manager. Installed during k3s
   # bootstrap (before argocd-operator) so argocd-operator can come up and
   # reconcile the ArgoCD CR; ClusterIssuer/Issuer resources are managed by
   # ArgoCD downstream.
-  cert_manager_version = "v1.20.2" # bump as needed; see https://github.com/cert-manager/cert-manager/releases
+  cert_manager_version = "v1.20.3" # bump as needed; see https://github.com/cert-manager/cert-manager/releases
 }
 
 # Dedicated libvirt pool on /mnt/nvme RAID-1 for cluster volumes (keeps cluster IO off the root LV).
diff --git a/providers.tf b/providers.tf
index c8ee67a..ec84aae 100644
--- a/providers.tf
+++ b/providers.tf
@@ -10,7 +10,7 @@ terraform {
     }
     sops = {
       source  = "carlpett/sops"
-      version = "~> 1.3.0"
+      version = "~> 1.4.0"
     }
   }
 }