diff --git a/.github/workflows/auto-review.yml b/.github/workflows/auto-review.yml
index cb370a065..d4e012dfb 100644
--- a/.github/workflows/auto-review.yml
+++ b/.github/workflows/auto-review.yml
@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Install dependencies
         run: |
@@ -28,7 +28,7 @@ jobs:
 
       - name: Generate Bootc Actions Token
         id: bootc_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/autovendor.yml b/.github/workflows/autovendor.yml
index 13eb231ea..59a436609 100644
--- a/.github/workflows/autovendor.yml
+++ b/.github/workflows/autovendor.yml
@@ -12,7 +12,7 @@ jobs:
   vendor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - name: Install vendor tool
         run: cargo install cargo-vendor-filterer
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74df59abd..385b7ecaf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Mark git checkout as safe
@@ -54,7 +54,7 @@ jobs:
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Installdeps
         run: sudo apt update && sudo apt install just
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build and run container integration tests
         run: sudo just run-container-integration run-container-external-tests
   container-continuous:
@@ -69,13 +69,13 @@ jobs:
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Installdeps
         run: sudo apt update && sudo apt install just
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build with continuous repo enabled
         run: sudo just build --build-arg=continuous_repo=1
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: EmbarkStudios/cargo-deny-action@v2
       with:
         log-level: warn
@@ -93,7 +93,7 @@ jobs:
           sudo apt update
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Free up disk space on runner
         run: sudo ./ci/clean-gha-runner.sh
       - name: Enable fsverity for /
@@ -147,7 +147,7 @@ jobs:
     env:
       MDBOOK_VERSION: 0.4.37
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install mdBook
         run: |
           tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name')
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dd7f546fb..8fc73e9bd 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -26,7 +26,7 @@ jobs:
     env:
       MDBOOK_VERSION: 0.4.37
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install mdBook
         run: |
           tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name')
@@ -58,7 +58,7 @@ jobs:
       - name: Build with mdBook
         run: cd docs && mdbook-mermaid install && mdbook build
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
         with:
           path: ./docs/book/html
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index cc4a8781e..e92284077 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -9,5 +9,5 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/labeler@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a16ce105c..79363589f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/scheduled-release.yml b/.github/workflows/scheduled-release.yml
index 15025ce55..ea95fcb84 100644
--- a/.github/workflows/scheduled-release.yml
+++ b/.github/workflows/scheduled-release.yml
@@ -29,7 +29,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/Cargo.lock b/Cargo.lock
index 6d6579089..641aac9fc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -195,7 +195,7 @@ dependencies = [
  "composefs",
  "composefs-boot",
  "fn-error-context",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "toml 0.9.5",
 ]
@@ -211,7 +211,7 @@ dependencies = [
  "indoc",
  "libc",
  "regex",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "serde_json",
  "tempfile",
@@ -225,7 +225,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "chrono",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "serde_json",
  "shlex",
@@ -282,7 +282,7 @@ dependencies = [
  "openssl",
  "ostree-ext",
  "regex",
- "rustix 1.0.8",
+ "rustix",
  "schemars",
  "serde",
  "serde_ignored",
@@ -312,7 +312,7 @@ dependencies = [
  "fn-error-context",
  "indoc",
  "libc",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "tracing",
 ]
@@ -328,7 +328,7 @@ dependencies = [
  "fn-error-context",
  "hex",
  "indoc",
- "rustix 1.0.8",
+ "rustix",
  "similar-asserts",
  "tempfile",
  "thiserror 2.0.16",
@@ -345,7 +345,7 @@ dependencies = [
  "cap-std-ext",
  "fn-error-context",
  "indoc",
- "rustix 1.0.8",
+ "rustix",
  "similar-asserts",
  "tempfile",
  "thiserror 2.0.16",
@@ -414,7 +414,7 @@ dependencies = [
  "io-lifetimes 2.0.4",
  "ipnet",
  "maybe-owned",
- "rustix 1.0.8",
+ "rustix",
  "rustix-linux-procfs",
  "windows-sys 0.59.0",
  "winx",
@@ -430,7 +430,7 @@ dependencies = [
  "cap-primitives",
  "io-extras",
  "io-lifetimes 2.0.4",
- "rustix 1.0.8",
+ "rustix",
 ]
 
 [[package]]
@@ -442,7 +442,7 @@ dependencies = [
  "cap-primitives",
  "cap-tempfile",
  "libc",
- "rustix 1.0.8",
+ "rustix",
 ]
 
 [[package]]
@@ -454,7 +454,7 @@ dependencies = [
  "camino",
  "cap-std",
  "rand 0.8.5",
- "rustix 1.0.8",
+ "rustix",
  "rustix-linux-procfs",
  "uuid",
 ]
@@ -565,11 +565,11 @@ checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
 [[package]]
 name = "comfy-table"
-version = "7.1.4"
+version = "7.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a65ebfec4fb190b6f90e944a817d60499ee0744e582530e2c9900a22e591d9a"
+checksum = "3f8e18d0dca9578507f13f9803add0df13362b02c501c1c17734f0dbb52eaf0b"
 dependencies = [
- "crossterm 0.28.1",
+ "crossterm",
  "unicode-segmentation",
  "unicode-width",
 ]
@@ -590,7 +590,7 @@ dependencies = [
  "log",
  "once_cell",
  "rand 0.9.2",
- "rustix 1.0.8",
+ "rustix",
  "sha2",
  "tempfile",
  "thiserror 2.0.16",
@@ -625,7 +625,7 @@ dependencies = [
  "hex",
  "indicatif 0.17.11",
  "oci-spec",
- "rustix 1.0.8",
+ "rustix",
  "sha2",
  "tar",
  "tokio",
@@ -640,7 +640,6 @@ dependencies = [
  "encode_unicode",
  "libc",
  "once_cell",
- "unicode-width",
  "windows-sys 0.59.0",
 ]
 
@@ -687,7 +686,7 @@ dependencies = [
  "futures-util",
  "itertools",
  "oci-spec",
- "rustix 1.0.8",
+ "rustix",
  "semver",
  "serde",
  "serde_json",
@@ -729,19 +728,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crossterm"
-version = "0.28.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
-dependencies = [
- "bitflags 2.9.1",
- "crossterm_winapi",
- "parking_lot",
- "rustix 0.38.44",
- "winapi",
-]
-
 [[package]]
 name = "crossterm"
 version = "0.29.0"
@@ -754,7 +740,7 @@ dependencies = [
  "document-features",
  "mio",
  "parking_lot",
- "rustix 1.0.8",
+ "rustix",
  "signal-hook",
  "signal-hook-mio",
  "winapi",
@@ -874,14 +860,13 @@ checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04"
 
 [[package]]
 name = "dialoguer"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de"
+checksum = "25f104b501bf2364e78d0d3974cbc774f738f5865306ed128e1e0d7499c0ad96"
 dependencies = [
- "console 0.15.11",
+ "console 0.16.0",
  "shell-words",
  "tempfile",
- "thiserror 1.0.69",
  "zeroize",
 ]
 
@@ -1029,7 +1014,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"
 dependencies = [
  "io-lifetimes 2.0.4",
- "rustix 1.0.8",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
@@ -1326,9 +1311,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "indexmap"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
+checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -1540,12 +1525,6 @@ dependencies = [
  "syn 2.0.104",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.9.4"
@@ -1731,9 +1710,9 @@ dependencies = [
 
 [[package]]
 name = "ocidir"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ca884bf1922890f5fb3c48bbe92b450781ddb4754a4efd6b2dd1667730f9dab"
+checksum = "064ca2e1e98a3cdf7c8af88397abda407fa4fe6ce7411a49646628d032002141"
 dependencies = [
  "camino",
  "canon-json",
@@ -1864,7 +1843,7 @@ dependencies = [
  "pin-project",
  "quickcheck",
  "regex",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "serde_json",
  "similar-asserts",
@@ -2200,19 +2179,6 @@ version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags 2.9.1",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.0.8"
@@ -2222,7 +2188,7 @@ dependencies = [
  "bitflags 2.9.1",
  "errno",
  "libc",
- "linux-raw-sys 0.9.4",
+ "linux-raw-sys",
  "windows-sys 0.59.0",
 ]
 
@@ -2233,7 +2199,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2fc84bf7e9aa16c4f2c758f27412dc9841341e16aa682d9c7ac308fe3ee12056"
 dependencies = [
  "once_cell",
- "rustix 1.0.8",
+ "rustix",
 ]
 
 [[package]]
@@ -2552,12 +2518,12 @@ dependencies = [
  "bootc-internal-utils",
  "bootc-mount",
  "clap",
- "crossterm 0.29.0",
+ "crossterm",
  "dialoguer",
  "indoc",
  "log",
  "openssh-keys",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -2586,14 +2552,14 @@ checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
 
 [[package]]
 name = "tempfile"
-version = "3.20.0"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
+checksum = "15b61f8f20e3a6f7e0649d825294eaf317edce30f82cf6026e7e4cb9222a7d1e"
 dependencies = [
  "fastrand",
  "getrandom 0.3.3",
  "once_cell",
- "rustix 1.0.8",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
@@ -2610,7 +2576,7 @@ dependencies = [
  "libtest-mimic",
  "oci-spec",
  "rexpect",
- "rustix 1.0.8",
+ "rustix",
  "serde",
  "serde_json",
  "tempfile",
@@ -2934,9 +2900,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
+checksum = "f33196643e165781c20a5ead5582283a7dacbb87855d867fbc2df3f81eddc1be"
 dependencies = [
  "getrandom 0.3.3",
  "js-sys",
@@ -3068,7 +3034,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3fabb953106c3c8eea8306e4393700d7657561cb43122571b172bbfb7c7ba1d"
 dependencies = [
  "env_home",
- "rustix 1.0.8",
+ "rustix",
  "winsafe",
 ]
 
@@ -3350,7 +3316,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af3a19837351dc82ba89f8a125e22a3c475f05aba604acc023d62b2739ae2909"
 dependencies = [
  "libc",
- "rustix 1.0.8",
+ "rustix",
 ]
 
 [[package]]
diff --git a/crates/ostree-ext/.github/workflows/rust.yml b/crates/ostree-ext/.github/workflows/rust.yml
index 91c971ea0..34c9df4fc 100644
--- a/crates/ostree-ext/.github/workflows/rust.yml
+++ b/crates/ostree-ext/.github/workflows/rust.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Code lints
         run: ./ci/lints.sh
       - name: Install deps
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Cache Dependencies
@@ -67,7 +67,7 @@ jobs:
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Detect crate MSRV
@@ -91,8 +91,8 @@ jobs:
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: EmbarkStudios/cargo-deny-action@v1
+    - uses: actions/checkout@v5
+    - uses: EmbarkStudios/cargo-deny-action@v2
       with:
         log-level: warn
         command: check bans sources licenses
@@ -103,9 +103,9 @@ jobs:
     container: quay.io/fedora/fedora-coreos:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v5.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -119,9 +119,9 @@ jobs:
     container: quay.io/fedora/fedora-coreos:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v5.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -133,13 +133,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     container:
-      image: quay.io/fedora/fedora-bootc:41
+      image: quay.io/fedora/fedora-bootc:44
       options: "--privileged --pid=host -v /var/tmp:/var/tmp -v /run/dbus:/run/dbus -v /run/systemd:/run/systemd -v /:/run/host"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Download
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v5.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -152,14 +152,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Checkout coreos-layering-examples
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           repository: coreos/coreos-layering-examples
           path: coreos-layering-examples
       - name: Download
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v5.0.0
         with:
           name: ostree-ext-cli
       - name: Integration tests
diff --git a/crates/ostree-ext/Cargo.toml b/crates/ostree-ext/Cargo.toml
index bf40e2773..2895fc93f 100644
--- a/crates/ostree-ext/Cargo.toml
+++ b/crates/ostree-ext/Cargo.toml
@@ -48,7 +48,7 @@ gvariant = "0.5.0"
 indexmap = { version = "2.2.2", features = ["serde"] }
 io-lifetimes = "3"
 libsystemd = "0.7.0"
-ocidir = "0.4.0"
+ocidir = "0.5.0"
 # We re-export this library too.
 ostree = { features = ["v2025_3"], version = "0.20.3" }
 pin-project = "1.0"
@@ -57,7 +57,7 @@ tokio-stream = { features = ["sync"], version = "0.1.8" }
 zstd = { version = "0.13.1", features = ["pkg-config"] }
 
 [dev-dependencies]
-quickcheck = "1"
+quickcheck = "=1.0.3"
 # https://github.com/rust-lang/cargo/issues/2911
 # https://github.com/rust-lang/rfcs/pull/1956
 ostree-ext = { path = ".", features = ["internal-testing-api"] }
diff --git a/crates/system-reinstall-bootc/Cargo.toml b/crates/system-reinstall-bootc/Cargo.toml
index c15177bb8..d8291a1dc 100644
--- a/crates/system-reinstall-bootc/Cargo.toml
+++ b/crates/system-reinstall-bootc/Cargo.toml
@@ -32,7 +32,7 @@ uzers = { workspace = true }
 
 # Crate-specific dependencies
 crossterm = "0.29.0"
-dialoguer = "0.11.0"
+dialoguer = "0.12.0"
 openssh-keys = "0.6.4"
 serde_yaml = "0.9.22"
 which = "8.0.0"