diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b78de1c142..29bbf15fc3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,7 +57,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -69,7 +69,7 @@ jobs:
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
         timeout-minutes: 10
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -121,7 +121,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -133,7 +133,7 @@ jobs:
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
         timeout-minutes: 10
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -197,7 +197,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -255,7 +255,7 @@ jobs:
         run: |
           find _out -type f -executable > _out/executable-artifacts
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-artifacts
           path: |
@@ -263,7 +263,7 @@ jobs:
           retention-days: "5"
       - name: Retrieve PR labels
         id: retrieve-pr-labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           retries: "3"
           script: |
@@ -315,12 +315,12 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -338,7 +338,7 @@ jobs:
           make e2e-docker
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-e2e-docker-short
           path: |-
@@ -384,12 +384,12 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -406,7 +406,7 @@ jobs:
           sudo -E make e2e-iso
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-e2e-iso
           path: |-
@@ -452,12 +452,12 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -476,7 +476,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-e2e-qemu-short
           path: |-
@@ -522,7 +522,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -543,7 +543,7 @@ jobs:
           make target-grype-validate
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-grype-scan-result
           path: |
@@ -588,7 +588,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -601,7 +601,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -665,7 +665,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-airgapped
           path: |-
@@ -712,7 +712,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -731,7 +731,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -781,7 +781,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -848,7 +848,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -867,7 +867,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -908,7 +908,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -931,7 +931,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -1001,7 +1001,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1020,7 +1020,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1061,7 +1061,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -1084,7 +1084,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -1154,7 +1154,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1173,7 +1173,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1214,7 +1214,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -1237,7 +1237,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -1307,7 +1307,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1326,7 +1326,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1367,7 +1367,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -1390,7 +1390,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -1460,7 +1460,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1473,7 +1473,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1535,7 +1535,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-cilium
           path: |-
@@ -1581,7 +1581,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1600,7 +1600,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1668,7 +1668,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1681,7 +1681,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1716,7 +1716,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-conformance
           path: |-
@@ -1762,7 +1762,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1775,7 +1775,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1828,7 +1828,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-conformance-enforcing
           path: |-
@@ -1874,7 +1874,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1887,7 +1887,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -1918,7 +1918,7 @@ jobs:
           sudo -E make e2e-embedded
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-embedded
           path: |-
@@ -1964,7 +1964,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -1977,7 +1977,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2006,7 +2006,7 @@ jobs:
         run: |
           make talosctl-cni-bundle
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -2043,7 +2043,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-extensions
           path: |-
@@ -2089,7 +2089,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2108,7 +2108,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2155,7 +2155,7 @@ jobs:
         run: |
           make e2e-gcp-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
@@ -2222,7 +2222,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2235,7 +2235,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2285,7 +2285,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-image-cache
           path: |-
@@ -2331,7 +2331,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2344,7 +2344,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2457,7 +2457,7 @@ jobs:
           sudo -E make e2e-image-factory
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-image-factory
           path: |-
@@ -2503,7 +2503,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2516,7 +2516,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2585,7 +2585,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2598,7 +2598,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2665,7 +2665,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-0
           path: |-
@@ -2711,7 +2711,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2724,7 +2724,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2786,7 +2786,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-1
           path: |-
@@ -2832,7 +2832,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2845,7 +2845,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -2934,7 +2934,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-1-enforcing
           path: |-
@@ -2980,7 +2980,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -2993,7 +2993,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3098,7 +3098,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-2
           path: |-
@@ -3144,7 +3144,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3157,7 +3157,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3207,7 +3207,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-3
           path: |-
@@ -3253,7 +3253,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3266,7 +3266,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3340,7 +3340,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-3-enforcing
           path: |-
@@ -3386,7 +3386,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3399,7 +3399,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3468,7 +3468,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-4
           path: |-
@@ -3514,7 +3514,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3527,7 +3527,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3623,7 +3623,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-4-enforcing
           path: |-
@@ -3669,7 +3669,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3682,7 +3682,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3731,7 +3731,7 @@ jobs:
           sudo -E make provision-tests-track-0
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-0
           path: |-
@@ -3777,7 +3777,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3790,7 +3790,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3825,7 +3825,7 @@ jobs:
           sudo -E make provision-tests-track-1
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-1
           path: |-
@@ -3871,7 +3871,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3884,7 +3884,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -3919,7 +3919,7 @@ jobs:
           sudo -E make provision-tests-track-2
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-2
           path: |-
@@ -3965,7 +3965,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -3978,7 +3978,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4015,7 +4015,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu
           path: |-
@@ -4061,7 +4061,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4074,7 +4074,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4103,7 +4103,7 @@ jobs:
         run: |
           make talosctl-cni-bundle
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -4144,7 +4144,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-longhorn
           path: |
@@ -4152,7 +4152,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-longhorn
           path: |-
@@ -4198,7 +4198,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4211,7 +4211,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4251,7 +4251,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-openebs
           path: |
@@ -4259,7 +4259,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-openebs
           path: |-
@@ -4305,7 +4305,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4318,7 +4318,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4357,7 +4357,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-rook-ceph
           path: |
@@ -4365,7 +4365,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-rook-ceph
           path: |-
@@ -4411,7 +4411,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4424,7 +4424,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4462,7 +4462,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-encrypted-vip
           path: |-
@@ -4508,7 +4508,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4521,7 +4521,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4576,7 +4576,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-enforcing
           path: |-
@@ -4622,7 +4622,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4635,7 +4635,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4684,7 +4684,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-race
           path: |-
@@ -4730,7 +4730,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4743,7 +4743,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4799,7 +4799,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4812,7 +4812,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4869,7 +4869,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-trusted-boot
           path: |-
@@ -4915,7 +4915,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -4928,7 +4928,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -4988,7 +4988,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-trusted-boot-enforcing
           path: |-
@@ -5032,7 +5032,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -5106,7 +5106,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
diff --git a/.github/workflows/dispatch.yaml b/.github/workflows/dispatch.yaml
index 965a98df2b..9d68ac9eed 100644
--- a/.github/workflows/dispatch.yaml
+++ b/.github/workflows/dispatch.yaml
@@ -52,7 +52,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
diff --git a/.github/workflows/grype-scan-cron.yaml b/.github/workflows/grype-scan-cron.yaml
index 4c03f34195..9007108964 100644
--- a/.github/workflows/grype-scan-cron.yaml
+++ b/.github/workflows/grype-scan-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -61,7 +61,7 @@ jobs:
           make target-grype-validate
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-grype-scan-result
           path: |
diff --git a/.github/workflows/integration-airgapped-cron.yaml b/.github/workflows/integration-airgapped-cron.yaml
index 622be40bc0..e059c67265 100644
--- a/.github/workflows/integration-airgapped-cron.yaml
+++ b/.github/workflows/integration-airgapped-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -117,7 +117,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-airgapped
           path: |-
diff --git a/.github/workflows/integration-aws-cron.yaml b/.github/workflows/integration-aws-cron.yaml
index ec9143c230..7e309cf66f 100644
--- a/.github/workflows/integration-aws-cron.yaml
+++ b/.github/workflows/integration-aws-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -109,7 +109,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-aws-nvidia-nonfree-lts-cron.yaml b/.github/workflows/integration-aws-nvidia-nonfree-lts-cron.yaml
index f6180394b9..e9c587df7a 100644
--- a/.github/workflows/integration-aws-nvidia-nonfree-lts-cron.yaml
+++ b/.github/workflows/integration-aws-nvidia-nonfree-lts-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -100,7 +100,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -123,7 +123,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-aws-nvidia-nonfree-production-cron.yaml b/.github/workflows/integration-aws-nvidia-nonfree-production-cron.yaml
index 35c898d864..232b73b6f3 100644
--- a/.github/workflows/integration-aws-nvidia-nonfree-production-cron.yaml
+++ b/.github/workflows/integration-aws-nvidia-nonfree-production-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -100,7 +100,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -123,7 +123,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-aws-nvidia-oss-lts-cron.yaml b/.github/workflows/integration-aws-nvidia-oss-lts-cron.yaml
index 9495b3fc88..046d6e5eb5 100644
--- a/.github/workflows/integration-aws-nvidia-oss-lts-cron.yaml
+++ b/.github/workflows/integration-aws-nvidia-oss-lts-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -100,7 +100,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -123,7 +123,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-aws-nvidia-oss-production-cron.yaml b/.github/workflows/integration-aws-nvidia-oss-production-cron.yaml
index 7b3b82ae52..b8c5abd4be 100644
--- a/.github/workflows/integration-aws-nvidia-oss-production-cron.yaml
+++ b/.github/workflows/integration-aws-nvidia-oss-production-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -100,7 +100,7 @@ jobs:
         run: |
           make image-aws
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -123,7 +123,7 @@ jobs:
         run: |
           make e2e-aws-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-cilium-cron.yaml b/.github/workflows/integration-cilium-cron.yaml
index c9aa8a5982..a59611d1a3 100644
--- a/.github/workflows/integration-cilium-cron.yaml
+++ b/.github/workflows/integration-cilium-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -115,7 +115,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-cilium
           path: |-
diff --git a/.github/workflows/integration-conformance-cron.yaml b/.github/workflows/integration-conformance-cron.yaml
index edfc223dd3..78048d6926 100644
--- a/.github/workflows/integration-conformance-cron.yaml
+++ b/.github/workflows/integration-conformance-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -88,7 +88,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-conformance
           path: |-
diff --git a/.github/workflows/integration-conformance-enforcing-cron.yaml b/.github/workflows/integration-conformance-enforcing-cron.yaml
index e116cfc137..2d695e0c6c 100644
--- a/.github/workflows/integration-conformance-enforcing-cron.yaml
+++ b/.github/workflows/integration-conformance-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -106,7 +106,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-conformance-enforcing
           path: |-
diff --git a/.github/workflows/integration-embedded-cron.yaml b/.github/workflows/integration-embedded-cron.yaml
index 25da78de6a..d6e3ba7402 100644
--- a/.github/workflows/integration-embedded-cron.yaml
+++ b/.github/workflows/integration-embedded-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -84,7 +84,7 @@ jobs:
           sudo -E make e2e-embedded
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-embedded
           path: |-
diff --git a/.github/workflows/integration-extensions-cron.yaml b/.github/workflows/integration-extensions-cron.yaml
index 629dc300ac..d200e48618 100644
--- a/.github/workflows/integration-extensions-cron.yaml
+++ b/.github/workflows/integration-extensions-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -82,7 +82,7 @@ jobs:
         run: |
           make talosctl-cni-bundle
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -119,7 +119,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-extensions
           path: |-
diff --git a/.github/workflows/integration-gcp-cron.yaml b/.github/workflows/integration-gcp-cron.yaml
index 9a32be1c07..945e76c4e4 100644
--- a/.github/workflows/integration-gcp-cron.yaml
+++ b/.github/workflows/integration-gcp-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -59,7 +59,7 @@ jobs:
           sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -106,7 +106,7 @@ jobs:
         run: |
           make e2e-gcp-prepare
       - name: checkout contrib
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/contrib
           ref: main
diff --git a/.github/workflows/integration-image-cache-cron.yaml b/.github/workflows/integration-image-cache-cron.yaml
index 4cea0e7dff..b17e903b2e 100644
--- a/.github/workflows/integration-image-cache-cron.yaml
+++ b/.github/workflows/integration-image-cache-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -103,7 +103,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-image-cache
           path: |-
diff --git a/.github/workflows/integration-image-factory-cron.yaml b/.github/workflows/integration-image-factory-cron.yaml
index f1cb604d99..109076ff3a 100644
--- a/.github/workflows/integration-image-factory-cron.yaml
+++ b/.github/workflows/integration-image-factory-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -166,7 +166,7 @@ jobs:
           sudo -E make e2e-image-factory
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-image-factory
           path: |-
diff --git a/.github/workflows/integration-images-cron.yaml b/.github/workflows/integration-images-cron.yaml
index 6863cda7fe..e7343b44e4 100644
--- a/.github/workflows/integration-images-cron.yaml
+++ b/.github/workflows/integration-images-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
diff --git a/.github/workflows/integration-misc-0-cron.yaml b/.github/workflows/integration-misc-0-cron.yaml
index 51269e99fd..564f5d2901 100644
--- a/.github/workflows/integration-misc-0-cron.yaml
+++ b/.github/workflows/integration-misc-0-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -120,7 +120,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-0
           path: |-
diff --git a/.github/workflows/integration-misc-1-cron.yaml b/.github/workflows/integration-misc-1-cron.yaml
index fa5263f548..f7ff918c49 100644
--- a/.github/workflows/integration-misc-1-cron.yaml
+++ b/.github/workflows/integration-misc-1-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -115,7 +115,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-1
           path: |-
diff --git a/.github/workflows/integration-misc-1-enforcing-cron.yaml b/.github/workflows/integration-misc-1-enforcing-cron.yaml
index 93dd0b1998..01ee6e2719 100644
--- a/.github/workflows/integration-misc-1-enforcing-cron.yaml
+++ b/.github/workflows/integration-misc-1-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -142,7 +142,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-1-enforcing
           path: |-
diff --git a/.github/workflows/integration-misc-2-cron.yaml b/.github/workflows/integration-misc-2-cron.yaml
index 0a84bf740c..0d37a7158f 100644
--- a/.github/workflows/integration-misc-2-cron.yaml
+++ b/.github/workflows/integration-misc-2-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -158,7 +158,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-2
           path: |-
diff --git a/.github/workflows/integration-misc-3-cron.yaml b/.github/workflows/integration-misc-3-cron.yaml
index 6a0355213e..c857e5dd8f 100644
--- a/.github/workflows/integration-misc-3-cron.yaml
+++ b/.github/workflows/integration-misc-3-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -103,7 +103,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-3
           path: |-
diff --git a/.github/workflows/integration-misc-3-enforcing-cron.yaml b/.github/workflows/integration-misc-3-enforcing-cron.yaml
index 8a7e9f3cbb..1852055335 100644
--- a/.github/workflows/integration-misc-3-enforcing-cron.yaml
+++ b/.github/workflows/integration-misc-3-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -127,7 +127,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-3-enforcing
           path: |-
diff --git a/.github/workflows/integration-misc-4-cron.yaml b/.github/workflows/integration-misc-4-cron.yaml
index 7d234c20b3..1cbec2140c 100644
--- a/.github/workflows/integration-misc-4-cron.yaml
+++ b/.github/workflows/integration-misc-4-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -122,7 +122,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-4
           path: |-
diff --git a/.github/workflows/integration-misc-4-enforcing-cron.yaml b/.github/workflows/integration-misc-4-enforcing-cron.yaml
index e2b370e3d3..6023f13e69 100644
--- a/.github/workflows/integration-misc-4-enforcing-cron.yaml
+++ b/.github/workflows/integration-misc-4-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -149,7 +149,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-misc-4-enforcing
           path: |-
diff --git a/.github/workflows/integration-provision-0-cron.yaml b/.github/workflows/integration-provision-0-cron.yaml
index b57c335175..91a239ac9f 100644
--- a/.github/workflows/integration-provision-0-cron.yaml
+++ b/.github/workflows/integration-provision-0-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -102,7 +102,7 @@ jobs:
           sudo -E make provision-tests-track-0
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-0
           path: |-
diff --git a/.github/workflows/integration-provision-1-cron.yaml b/.github/workflows/integration-provision-1-cron.yaml
index 2c4a72150c..8b32b18369 100644
--- a/.github/workflows/integration-provision-1-cron.yaml
+++ b/.github/workflows/integration-provision-1-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -88,7 +88,7 @@ jobs:
           sudo -E make provision-tests-track-1
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-1
           path: |-
diff --git a/.github/workflows/integration-provision-2-cron.yaml b/.github/workflows/integration-provision-2-cron.yaml
index d2ecb6660a..e1a402666a 100644
--- a/.github/workflows/integration-provision-2-cron.yaml
+++ b/.github/workflows/integration-provision-2-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -88,7 +88,7 @@ jobs:
           sudo -E make provision-tests-track-2
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-provision-2
           path: |-
diff --git a/.github/workflows/integration-qemu-cron.yaml b/.github/workflows/integration-qemu-cron.yaml
index 793fff88e8..5837d59738 100644
--- a/.github/workflows/integration-qemu-cron.yaml
+++ b/.github/workflows/integration-qemu-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -90,7 +90,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu
           path: |-
diff --git a/.github/workflows/integration-qemu-csi-longhorn-cron.yaml b/.github/workflows/integration-qemu-csi-longhorn-cron.yaml
index b14d153ee9..5f2b6d0904 100644
--- a/.github/workflows/integration-qemu-csi-longhorn-cron.yaml
+++ b/.github/workflows/integration-qemu-csi-longhorn-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -82,7 +82,7 @@ jobs:
         run: |
           make talosctl-cni-bundle
       - name: checkout extensions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: _out/extensions
           ref: main
@@ -123,7 +123,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-longhorn
           path: |
@@ -131,7 +131,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-longhorn
           path: |-
diff --git a/.github/workflows/integration-qemu-csi-openebs-cron.yaml b/.github/workflows/integration-qemu-csi-openebs-cron.yaml
index acb909b70b..63854ad455 100644
--- a/.github/workflows/integration-qemu-csi-openebs-cron.yaml
+++ b/.github/workflows/integration-qemu-csi-openebs-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -93,7 +93,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-openebs
           path: |
@@ -101,7 +101,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-openebs
           path: |-
diff --git a/.github/workflows/integration-qemu-csi-rook-ceph-cron.yaml b/.github/workflows/integration-qemu-csi-rook-ceph-cron.yaml
index 7771c1b9c7..6bfa6ac6ae 100644
--- a/.github/workflows/integration-qemu-csi-rook-ceph-cron.yaml
+++ b/.github/workflows/integration-qemu-csi-rook-ceph-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -92,7 +92,7 @@ jobs:
         run: |
           sudo -E make e2e-qemu
       - name: save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: fio-integration-qemu-csi-rook-ceph
           path: |
@@ -100,7 +100,7 @@ jobs:
           retention-days: "180"
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-csi-rook-ceph
           path: |-
diff --git a/.github/workflows/integration-qemu-encrypted-vip-cron.yaml b/.github/workflows/integration-qemu-encrypted-vip-cron.yaml
index 8c1f35b4d9..7e5d8b61bd 100644
--- a/.github/workflows/integration-qemu-encrypted-vip-cron.yaml
+++ b/.github/workflows/integration-qemu-encrypted-vip-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -91,7 +91,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-encrypted-vip
           path: |-
diff --git a/.github/workflows/integration-qemu-enforcing-cron.yaml b/.github/workflows/integration-qemu-enforcing-cron.yaml
index bd7ba92ebd..406f14f2d4 100644
--- a/.github/workflows/integration-qemu-enforcing-cron.yaml
+++ b/.github/workflows/integration-qemu-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -108,7 +108,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-enforcing
           path: |-
diff --git a/.github/workflows/integration-qemu-race-cron.yaml b/.github/workflows/integration-qemu-race-cron.yaml
index 40da18df5f..7cda6eb892 100644
--- a/.github/workflows/integration-qemu-race-cron.yaml
+++ b/.github/workflows/integration-qemu-race-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -102,7 +102,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-qemu-race
           path: |-
diff --git a/.github/workflows/integration-reproducibility-test-cron.yaml b/.github/workflows/integration-reproducibility-test-cron.yaml
index 3c025f07d0..858a5c0a22 100644
--- a/.github/workflows/integration-reproducibility-test-cron.yaml
+++ b/.github/workflows/integration-reproducibility-test-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
diff --git a/.github/workflows/integration-trusted-boot-cron.yaml b/.github/workflows/integration-trusted-boot-cron.yaml
index fc2733172e..b05a5cf460 100644
--- a/.github/workflows/integration-trusted-boot-cron.yaml
+++ b/.github/workflows/integration-trusted-boot-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -110,7 +110,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-trusted-boot
           path: |-
diff --git a/.github/workflows/integration-trusted-boot-enforcing-cron.yaml b/.github/workflows/integration-trusted-boot-enforcing-cron.yaml
index bc3c30bbf6..42e47fb183 100644
--- a/.github/workflows/integration-trusted-boot-enforcing-cron.yaml
+++ b/.github/workflows/integration-trusted-boot-enforcing-cron.yaml
@@ -40,7 +40,7 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 10
       - name: Download artifacts
         if: github.event_name != 'schedule'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: talos-artifacts
           path: _out
@@ -113,7 +113,7 @@ jobs:
           sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: talos-logs-integration-trusted-boot-enforcing
           path: |-
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index c88b991a9c..34b79ab089 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           stale-issue-message: 'This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
           stale-pr-message: 'This PR is stale because it has been open 45 days with no activity.'
diff --git a/Makefile b/Makefile
index 98d5bebbb3..974a63aacc 100644
--- a/Makefile
+++ b/Makefile
@@ -91,7 +91,7 @@ PKG_ZSTD ?= $(PKGS_PREFIX)/zstd:$(PKGS)
 # renovate: datasource=github-tags depName=golang/go
 GO_VERSION ?= 1.25
 # renovate: datasource=npm depName=markdownlint-cli
-MARKDOWNLINTCLI_VERSION ?= 0.45.0
+MARKDOWNLINTCLI_VERSION ?= 0.46.0
 OPERATING_SYSTEM := $(shell uname -s | tr "[:upper:]" "[:lower:]")
 ARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
 TALOSCTL_DEFAULT_TARGET := talosctl-$(OPERATING_SYSTEM)
@@ -100,11 +100,11 @@ INTEGRATION_TEST := integration-test
 INTEGRATION_TEST_DEFAULT_TARGET := $(INTEGRATION_TEST)-$(OPERATING_SYSTEM)
 INTEGRATION_TEST_PROVISION_DEFAULT_TARGET := integration-test-provision-$(OPERATING_SYSTEM)
 # renovate: datasource=github-releases depName=kubernetes/kubernetes
-KUBECTL_VERSION ?= v1.35.0-alpha.3
+KUBECTL_VERSION ?= v1.35.0-beta.0
 # renovate: datasource=github-releases depName=kastenhq/kubestr
 KUBESTR_VERSION ?= v0.4.49
 # renovate: datasource=github-releases depName=helm/helm
-HELM_VERSION ?= v4.0.0
+HELM_VERSION ?= v4.0.1
 # renovate: datasource=github-releases depName=cilium/cilium-cli
 CILIUM_CLI_VERSION ?= v0.18.8
 # renovate: datasource=github-releases depName=microsoft/secureboot_objects
diff --git a/go.mod b/go.mod
index e7b195b854..150c6c714b 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.25.3
 
 replace (
 	// see e.g. https://github.com/grpc/grpc-go/issues/6696
-	cloud.google.com/go => cloud.google.com/go v0.100.2
+	cloud.google.com/go => cloud.google.com/go v0.123.0
 
 	// forked coredns so we don't carry caddy and other stuff into the Talos
 	github.com/coredns/coredns => github.com/siderolabs/coredns v1.12.54
@@ -13,7 +13,7 @@ replace (
 	github.com/mdlayher/ethtool => github.com/siderolabs/ethtool v0.4.0-sidero
 
 	// see https://github.com/mdlayher/kobject/pull/5
-	github.com/mdlayher/kobject => github.com/smira/kobject v0.0.0-20240304111826-49c8d4613389
+	github.com/mdlayher/kobject => github.com/smira/kobject 19ca17470d7d
 
 	// Use nested module.
 	github.com/siderolabs/talos/pkg/machinery => ./pkg/machinery
@@ -25,21 +25,21 @@ replace (
 // deadcode elimination fix replacement: https://github.com/siderolabs/talos/issues/11296
 // upstream PR: https://github.com/containerd/containerd/pull/12175
 // this a fork with containerd 2.1 branch + the commit from the PR above
-replace github.com/containerd/containerd/v2 => github.com/smira/containerd/v2 v2.0.0-20251113120816-51ecd22de074
+replace github.com/containerd/containerd/v2 => github.com/smira/containerd/v2 ddf6594fbeed
 
 // Kubernetes dependencies sharing the same version.
 require (
-	k8s.io/api v0.35.0-alpha.3
-	k8s.io/apiextensions-apiserver v0.35.0-alpha.3
-	k8s.io/apimachinery v0.35.0-alpha.3
-	k8s.io/apiserver v0.35.0-alpha.3
-	k8s.io/client-go v0.35.0-alpha.3
-	k8s.io/component-base v0.35.0-alpha.3
-	k8s.io/cri-api v0.35.0-alpha.3
-	k8s.io/kube-scheduler v0.35.0-alpha.3
-	k8s.io/kubectl v0.35.0-alpha.3
-	k8s.io/kubelet v0.35.0-alpha.3
-	k8s.io/pod-security-admission v0.35.0-alpha.3
+	k8s.io/api v0.35.0-beta.0
+	k8s.io/apiextensions-apiserver v0.35.0-beta.0
+	k8s.io/apimachinery v0.35.0-beta.0
+	k8s.io/apiserver v0.35.0-beta.0
+	k8s.io/client-go v11.0.0+incompatible
+	k8s.io/component-base v0.35.0-beta.0
+	k8s.io/cri-api v0.35.0-beta.0
+	k8s.io/kube-scheduler v0.35.0-beta.0
+	k8s.io/kubectl v0.35.0-beta.0
+	k8s.io/kubelet v0.35.0-beta.0
+	k8s.io/pod-security-admission v0.35.0-beta.0
 )
 
 require (
@@ -49,28 +49,28 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
 	github.com/alexflint/go-filemutex v1.3.0
-	github.com/aws/aws-sdk-go-v2/config v1.31.20
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13
-	github.com/aws/aws-sdk-go-v2/service/kms v1.46.0
+	github.com/aws/aws-sdk-go-v2/config v1.32.2
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14
+	github.com/aws/aws-sdk-go-v2/service/kms v1.49.1
 	github.com/aws/smithy-go v1.23.2
 	github.com/beevik/ntp v1.5.0
 	github.com/blang/semver/v4 v4.0.0
-	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/containerd/cgroups/v3 v3.0.5
-	github.com/containerd/containerd/api v1.9.0
-	github.com/containerd/containerd/v2 v2.1.5
+	github.com/cenkalti/backoff/v5 v5.0.3
+	github.com/containerd/cgroups/v3 v3.1.2
+	github.com/containerd/containerd/api v1.10.0
+	github.com/containerd/containerd/v2 v2.2.0
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/log v0.1.0
-	github.com/containerd/platforms v1.0.0-rc.1
+	github.com/containerd/platforms v1.0.0-rc.2
 	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/containernetworking/cni v1.3.0
 	github.com/containernetworking/plugins v1.8.0
-	github.com/coredns/coredns v1.12.3
+	github.com/coredns/coredns v1.13.1
 	github.com/coreos/go-iptables v0.8.0
-	github.com/cosi-project/runtime v1.12.0
+	github.com/cosi-project/runtime v1.13.0
 	github.com/detailyang/go-fallocate v0.0.0-20180908115635-432fa640bd2e
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v29.0.0+incompatible
+	github.com/docker/cli v29.1.1+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elastic/go-libaudit/v2 v2.6.2
 	github.com/equinix-ms/go-vmw-guestrpc v1.0.0
@@ -80,14 +80,14 @@ require (
 	github.com/freddierice/go-losetup/v2 v2.0.1
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/g0rbe/go-chattr v1.0.1
-	github.com/gdamore/tcell/v2 v2.9.0
+	github.com/gdamore/tcell/v2 v2.13.0
 	github.com/gertd/go-pluralize v0.2.1
 	github.com/gizak/termui/v3 v3.1.0
-	github.com/godbus/dbus/v5 v5.1.0
+	github.com/godbus/dbus/v5 v5.2.0
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/cadvisor v0.53.0
 	github.com/google/cel-go v0.26.1
-	github.com/google/go-containerregistry v0.20.6
+	github.com/google/go-containerregistry v0.20.7
 	github.com/google/go-tpm v0.9.7
 	github.com/google/nftables v0.3.0
 	github.com/google/uuid v1.6.0
@@ -98,7 +98,7 @@ require (
 	github.com/hashicorp/go-envparse v0.1.0
 	github.com/hashicorp/go-getter/v2 v2.2.3
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hetznercloud/hcloud-go/v2 v2.30.0
+	github.com/hetznercloud/hcloud-go/v2 v2.32.0
 	github.com/insomniacslk/dhcp v0.0.0-20251020182700-175e84fbb167
 	github.com/jeromer/syslogparser v1.1.0
 	github.com/jsimonetti/rtnetlink/v2 v2.1.0
@@ -109,7 +109,7 @@ require (
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mdlayher/arp v0.0.0-20220512170110-6706a2966875
-	github.com/mdlayher/ethtool v0.4.0
+	github.com/mdlayher/ethtool v0.5.0
 	github.com/mdlayher/genetlink v1.3.2
 	github.com/mdlayher/kobject v0.0.0-20200520190114-19ca17470d7d
 	github.com/mdlayher/netlink v1.8.0
@@ -117,11 +117,11 @@ require (
 	github.com/mdp/qrterminal/v3 v3.2.1
 	github.com/miekg/dns v1.1.68
 	github.com/moby/moby/api v1.52.0
-	github.com/moby/moby/client v0.1.0
+	github.com/moby/moby/client v0.2.1
 	github.com/nberlee/go-netstat v0.1.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/opencontainers/runtime-spec v1.2.1
+	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/packethost/packngo v0.31.0
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/pin/tftp/v3 v3.1.0
@@ -158,9 +158,9 @@ require (
 	github.com/siderolabs/grpc-proxy v0.5.1
 	github.com/siderolabs/kms-client v0.1.0
 	github.com/siderolabs/net v0.4.0
-	github.com/siderolabs/proto-codec v0.1.2
+	github.com/siderolabs/proto-codec v0.1.3
 	github.com/siderolabs/siderolink v0.3.15
-	github.com/siderolabs/talos/pkg/machinery v1.12.0-alpha.2
+	github.com/siderolabs/talos/pkg/machinery v1.12.0-beta.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
@@ -174,7 +174,7 @@ require (
 	go.etcd.io/etcd/client/v3 v3.6.6
 	go.etcd.io/etcd/etcdutl/v3 v3.6.6
 	go.uber.org/goleak v1.3.0
-	go.uber.org/zap v1.27.0
+	go.uber.org/zap v1.27.1
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
 	golang.org/x/net v0.47.0
@@ -185,7 +185,7 @@ require (
 	golang.org/x/text v0.31.0
 	golang.org/x/time v0.14.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
-	google.golang.org/grpc v1.76.0
+	google.golang.org/grpc v1.77.0
 	google.golang.org/protobuf v1.36.10
 	gopkg.in/typ.v4 v4.4.0
 	k8s.io/klog/v2 v2.130.1
diff --git a/hack/cloud-image-uploader/go.mod b/hack/cloud-image-uploader/go.mod
index 1b1b4ecfae..59b92c32ff 100644
--- a/hack/cloud-image-uploader/go.mod
+++ b/hack/cloud-image-uploader/go.mod
@@ -3,12 +3,12 @@ module github.com/siderolabs/cloud-image-uploader
 go 1.25.0
 
 require (
-	cloud.google.com/go/storage v1.57.1
-	github.com/aws/aws-sdk-go-v2 v1.39.6
-	github.com/aws/aws-sdk-go-v2/config v1.31.20
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.7
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.267.0
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.90.2
+	cloud.google.com/go/storage v1.57.2
+	github.com/aws/aws-sdk-go-v2 v1.40.0
+	github.com/aws/aws-sdk-go-v2/config v1.32.2
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.275.0
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.92.1
 	github.com/google/uuid v1.6.0
 	github.com/klauspost/compress v1.18.1
 	github.com/siderolabs/gen v0.8.6
diff --git a/internal/integration/k8s/constants.go b/internal/integration/k8s/constants.go
index 290a0abbf2..157c0c86f6 100644
--- a/internal/integration/k8s/constants.go
+++ b/internal/integration/k8s/constants.go
@@ -10,11 +10,11 @@ package k8s
 const (
 	// RookCephHelmChartVersion is the version of the Rook Ceph Helm chart to use.
 	// renovate: datasource=helm versioning=helm depName=rook-ceph registryUrl=https://charts.rook.io/release
-	RookCephHelmChartVersion = "v1.18.6"
+	RookCephHelmChartVersion = "v1.18.7"
 	// LongHornHelmChartVersion is the version of the Longhorn Helm chart to use.
 	// renovate: datasource=helm versioning=helm depName=longhorn registryUrl=https://charts.longhorn.io
 	LongHornHelmChartVersion = "v1.10.1"
 	// OpenEBSChartVersion is the version of the OpenEBS Helm chart to use.
 	// renovate: datasource=helm versioning=helm depName=openebs registryUrl=https://openebs.github.io/openebs
-	OpenEBSChartVersion = "v4.3.3"
+	OpenEBSChartVersion = "4.4.0"
 )
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index 19533ed93d..fcdd7cd09f 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -401,7 +401,7 @@ const (
 
 	// DefaultKubernetesVersion is the default target version of the control plane.
 	// renovate: datasource=github-releases depName=kubernetes/kubernetes
-	DefaultKubernetesVersion = "1.35.0-alpha.3"
+	DefaultKubernetesVersion = "1.35.0-beta.0"
 
 	// SupportedKubernetesVersions is the number of Kubernetes versions supported by Talos starting from DefaultKubernesVersion going backwards.
 	SupportedKubernetesVersions = 6
diff --git a/pkg/machinery/go.mod b/pkg/machinery/go.mod
index 4502e89786..fdba2a6f61 100644
--- a/pkg/machinery/go.mod
+++ b/pkg/machinery/go.mod
@@ -8,7 +8,7 @@ replace github.com/mdlayher/ethtool => github.com/siderolabs/ethtool v0.4.0-side
 require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/containerd/go-cni v1.1.13
-	github.com/cosi-project/runtime v1.12.0
+	github.com/cosi-project/runtime v1.13.0
 	github.com/dustin/go-humanize v1.0.1
 	github.com/emicklei/dot v1.9.2
 	github.com/evanphx/json-patch v5.9.11+incompatible
@@ -18,11 +18,12 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hexops/gotextdiff v1.0.3
 	github.com/jsimonetti/rtnetlink/v2 v2.1.0
-	github.com/mdlayher/ethtool v0.4.0
-	github.com/opencontainers/runtime-spec v1.2.1
-	github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2
+	github.com/mdlayher/ethtool v0.5.0
+	github.com/opencontainers/runtime-spec v1.3.0
+	github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25
 	github.com/ryanuber/go-glob v1.0.0
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/siderolabs/crypto v0.6.4
 	github.com/siderolabs/gen v0.8.6
 	github.com/siderolabs/go-api-signature v0.3.12
@@ -32,10 +33,11 @@ require (
 	github.com/stretchr/testify v1.11.1
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
 	golang.org/x/net v0.47.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba
-	google.golang.org/grpc v1.76.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846
+	google.golang.org/grpc v1.77.0
 	google.golang.org/protobuf v1.36.10
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
@@ -74,5 +76,4 @@ require (
 	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/pkg/machinery/go.sum b/pkg/machinery/go.sum
index 195866db04..687da92a93 100644
--- a/pkg/machinery/go.sum
+++ b/pkg/machinery/go.sum
@@ -26,6 +26,8 @@ github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEm
 github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
 github.com/cosi-project/runtime v1.12.0 h1:fsX1VKn9atthccDMhWDHM+t1hdW6eDKAPa2t/Rd/dfI=
 github.com/cosi-project/runtime v1.12.0/go.mod h1:/9fspODJfZrO5dQatMRgN440K8DjWP1jFSgiLX+FmQc=
+github.com/cosi-project/runtime v1.13.0 h1:EKy/GwhVTgq131w0g3pbB0bTEf6FiZFjbK6go/I0pmE=
+github.com/cosi-project/runtime v1.13.0/go.mod h1:/9fspODJfZrO5dQatMRgN440K8DjWP1jFSgiLX+FmQc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -91,6 +93,8 @@ github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 h1:Dx7Ovyv/SFnMFw3fD4oEoeorXc6saIiQ23LrGLth0Gw=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
@@ -99,6 +103,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2 h1:1sLMdKq4gNANTj0dUibycTLzpIEKVnLnbaEkxws78nw=
 github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25 h1:S1hI5JiKP7883xBzZAr1ydcxrKNSVNm7+3+JwjxZEsg=
+github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25/go.mod h1:ZQntvDG8TkPgljxtA0R9frDoND4QORU1VXz015N5Ks4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -107,6 +113,7 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/siderolabs/crypto v0.6.4 h1:uMoe/X/mABOv6yOgvKcjmjIMdv6U8JegBXlPKtyjn3g=
@@ -212,10 +219,16 @@ gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4=
 google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U=
+google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 h1:ZdyUkS9po3H7G0tuh955QVyyotWvOD4W0aEapeGeUYk=
+google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846/go.mod h1:Fk4kyraUvqD7i5H6S43sj2W98fbZa75lpZz/eUyhfO0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba h1:UKgtfRM7Yh93Sya0Fo8ZzhDP4qBckrrxEr2oF5UIVb8=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 h1:Wgl1rcDNThT+Zn47YyCXOXyX/COgMTIdhJ717F0l4xk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
 google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
+google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
 google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
 google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/tools/docgen/go.mod b/tools/docgen/go.mod
index 4addcda8ec..249059e300 100644
--- a/tools/docgen/go.mod
+++ b/tools/docgen/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/gomarkdown/markdown v0.0.0-20250810172220-2e2c11897d1a
 	github.com/invopop/jsonschema v0.13.0
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/siderolabs/gen v0.8.6
 	github.com/wk8/go-ordered-map/v2 v2.1.8
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
diff --git a/tools/go.mod b/tools/go.mod
index 86d5448e3d..d9c6e68d76 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -36,9 +36,9 @@ replace (
 
 replace (
 	// Changes from https://github.com/anchore/grype/pull/2798 for using VEX with SBOM
-	github.com/anchore/grype => github.com/dsseng/grype v0.96.1-0.20251110164253-c75bac6b74ba
+	github.com/anchore/grype => github.com/dsseng/grype 9b7e8e23d161
 	// Changes from https://github.com/anchore/syft/pull/3932 for deterministic SBOM
-	github.com/anchore/syft => github.com/dsseng/syft v1.28.1-0.20251110165056-be9d22809c28
+	github.com/anchore/syft => github.com/dsseng/syft 31c1be6d4d3b
 )
 
 require (
@@ -129,10 +129,10 @@ require (
 	github.com/anchore/go-struct-converter v0.0.0-20250211213226-cce56d595160 // indirect
 	github.com/anchore/go-sync v0.0.0-20250714163430-add63db73ad1 // indirect
 	github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4 // indirect
-	github.com/anchore/grype v0.103.0 // indirect
+	github.com/anchore/grype v0.104.1 // indirect
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
 	github.com/anchore/stereoscope v0.1.12 // indirect
-	github.com/anchore/syft v1.37.0 // indirect
+	github.com/anchore/syft v1.38.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/aokoli/goutils v1.0.1 // indirect
@@ -179,7 +179,7 @@ require (
 	github.com/bombsimon/wsl/v5 v5.3.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
-	github.com/bufbuild/buf v1.59.0 // indirect
+	github.com/bufbuild/buf v1.61.0 // indirect
 	github.com/bufbuild/protocompile v0.14.2-0.20251017200126-6da99d83224e // indirect
 	github.com/bufbuild/protoplugin v0.0.0-20250218205857-750e09ce93e1 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
@@ -285,7 +285,7 @@ require (
 	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/golangci-lint/v2 v2.6.1 // indirect
+	github.com/golangci/golangci-lint/v2 v2.6.2 // indirect
 	github.com/golangci/golines v0.0.0-20250217134842-442fd0091d95 // indirect
 	github.com/golangci/misspell v0.7.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
@@ -421,7 +421,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pkg/xattr v0.4.12 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/planetscale/vtprotobuf ba97887b0a25 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/polyfloyd/go-errorlint v1.8.0 // indirect
 	github.com/prometheus/client_golang v1.20.5 // indirect
@@ -463,9 +463,9 @@ require (
 	github.com/siderolabs/deep-copy v0.5.8 // indirect
 	github.com/siderolabs/gen v0.8.6 // indirect
 	github.com/siderolabs/importvet v0.2.0 // indirect
-	github.com/siderolabs/talos/tools/docgen v0.0.0-20251112150910-859194e67800 // indirect
-	github.com/siderolabs/talos/tools/gotagsrewrite v0.0.0-20251112150910-859194e67800 // indirect
-	github.com/siderolabs/talos/tools/structprotogen v0.0.0-20251112150910-859194e67800 // indirect
+	github.com/siderolabs/talos/tools/docgen ab149750d475 // indirect
+	github.com/siderolabs/talos/tools/gotagsrewrite ab149750d475 // indirect
+	github.com/siderolabs/talos/tools/structprotogen ab149750d475 // indirect
 	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
@@ -566,7 +566,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20251007200510-49b9836ed3ff // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251007200510-49b9836ed3ff // indirect
 	google.golang.org/grpc v1.75.0 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.0 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/typ.v4 v4.4.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect