diff --git a/codefresh/Chart.lock b/codefresh/Chart.lock
index fa7fd4808..d2b9950c0 100644
--- a/codefresh/Chart.lock
+++ b/codefresh/Chart.lock
@@ -7,13 +7,13 @@ dependencies:
   version: 0.10.2
 - name: consul
   repository: https://charts.bitnami.com/bitnami
-  version: 11.4.19
+  version: 11.4.23
 - name: mongodb
   repository: https://charts.bitnami.com/bitnami
   version: 15.6.26
 - name: postgresql
   repository: https://charts.bitnami.com/bitnami
-  version: 16.7.4
+  version: 16.7.15
 - name: postgresql-ha
   repository: oci://quay.io/codefresh/charts
   version: 12.0.4
@@ -28,7 +28,7 @@ dependencies:
   version: 15.5.3
 - name: nats
   repository: https://charts.bitnami.com/bitnami
-  version: 9.0.17
+  version: 9.0.22
 - name: builder
   repository: oci://quay.io/codefresh/charts
   version: 1.4.0
@@ -64,58 +64,58 @@ dependencies:
   version: 1.14.23
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.279.5
+  version: 21.279.6
 - name: cfui
   repository: oci://quay.io/codefresh/charts
   version: 14.98.27
@@ -148,13 +148,13 @@ dependencies:
   version: 0.50.2
 - name: argo-platform
   repository: oci://quay.io/codefresh/charts
-  version: 1.3525.0-onprem-8f99809
+  version: 1.3525.1-onprem-d2885a5
 - name: argo-hub-platform
   repository: oci://quay.io/codefresh/charts
   version: 0.1.26
 - name: cf-oidc-provider
   repository: oci://quay.io/codefresh/charts
-  version: 0.0.16
+  version: 0.1.0
 - name: mailer
   repository: oci://quay.io/codefresh/charts
   version: 1.20.8
@@ -167,5 +167,5 @@ dependencies:
 - name: salesforce-reporter
   repository: oci://quay.io/codefresh/charts
   version: 1.30.11
-digest: sha256:b95487cfdfbafff3c65bf1bf6a6a52ee4b4505b75f90e0561c499b4e0da5db89
-generated: "2025-07-04T19:13:30.959254+03:00"
+digest: sha256:9f284e26aae3a4f6bb1476f304e4975283f23cb56c9545f602fb1921d46fe96c
+generated: "2025-07-10T12:42:44.366546+03:00"
diff --git a/codefresh/Chart.yaml b/codefresh/Chart.yaml
index e189049bd..b057ba6ee 100644
--- a/codefresh/Chart.yaml
+++ b/codefresh/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 description: Helm Chart for Codefresh On-Prem
 name: codefresh
-version: 2.8.8
+version: 2.8.9
 keywords:
   - codefresh
 home: https://codefresh.io/
@@ -18,8 +18,15 @@ annotations:
   # artifacthub.io/containsSecurityUpdates: "true"
   # supported kinds are added, changed, deprecated, removed, fixed and security.
   artifacthub.io/changes: |
+    - kind: security
+      description: "Contains security fixes"
     - kind: fixed
-      description: "Fix image repository for argo-platform"
+      description: "Fixed an issue with labels being ignored for Product promotion rules (#6506)"
+    - kind: added
+      description: "cf-api - added logs to verifyUpdate"
+      links:
+        - name: Jira Issue
+          url: https://codefresh-io.atlassian.net/browse/CR-27521
 dependencies:
   - name: cf-common
     repository: oci://quay.io/codefresh/charts
@@ -29,7 +36,7 @@ dependencies:
     version: 0.10.2
     condition: internal-gateway.enabled
   - name: consul
-    version: 11.4.19
+    version: 11.4.23
     repository: https://charts.bitnami.com/bitnami
     condition: consul.enabled
   - name: mongodb
@@ -37,7 +44,7 @@ dependencies:
     repository: https://charts.bitnami.com/bitnami
     condition: mongodb.enabled,mongo.enabled,global.mongoDeploy
   - name: postgresql
-    version: 16.7.4
+    version: 16.7.15
     repository: https://charts.bitnami.com/bitnami
     condition: postgresql.enabled
   - name: postgresql-ha
@@ -57,7 +64,7 @@ dependencies:
     repository: https://charts.bitnami.com/bitnami
     condition: rabbitmq.enabled
   - name: nats
-    version: 9.0.17
+    version: 9.0.22
     repository: https://charts.bitnami.com/bitnami
     condition: nats.enabled
   - name: builder
@@ -237,7 +244,7 @@ dependencies:
     repository: oci://quay.io/codefresh/charts
     condition: argo-platform.enabled
   - name: argo-platform
-    version: "1.3525.0-onprem-8f99809"
+    version: "1.3525.1-onprem-d2885a5"
     repository: oci://quay.io/codefresh/charts
     condition: argo-platform.enabled
   - name: argo-hub-platform
diff --git a/codefresh/README.md b/codefresh/README.md
index 257ff2ecb..e669d659c 100644
--- a/codefresh/README.md
+++ b/codefresh/README.md
@@ -1,6 +1,6 @@
 ## Codefresh On-Premises
 
-![Version: 2.8.8](https://img.shields.io/badge/Version-2.8.8-informational?style=flat-square) ![AppVersion: 2.8.0](https://img.shields.io/badge/AppVersion-2.8.0-informational?style=flat-square)
+![Version: 2.8.9](https://img.shields.io/badge/Version-2.8.9-informational?style=flat-square) ![AppVersion: 2.8.0](https://img.shields.io/badge/AppVersion-2.8.0-informational?style=flat-square)
 
 Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/getting-started/intro-to-codefresh/) to Kubernetes.
 
@@ -2450,7 +2450,7 @@ After platform upgrade, Consul fails with the error `refusing to rejoin cluster
 | argo-platform.runtime-monitor | object | See below | runtime-monitor Don't enable! Not used in onprem! |
 | argo-platform.ui | object | See below | ui |
 | argo-platform.useExternalSecret | bool | `false` | Use regular k8s secret object. Keep `false`! |
-| builder | object | `{"affinity":{},"container":{"image":{"registry":"docker.io","repository":"library/docker","tag":"28.2-dind"}},"enabled":true,"imagePullSecrets":[],"initContainers":{"register":{"image":{"registry":"us-docker.pkg.dev/codefresh-inc/public-gcr-io","repository":"codefresh/curl","tag":"8.11.1"}}},"nodeSelector":{},"podSecurityContext":{},"resources":{},"tolerations":[]}` | builder |
+| builder | object | `{"affinity":{},"container":{"image":{"registry":"docker.io","repository":"library/docker","tag":"28.3-dind"}},"enabled":true,"imagePullSecrets":[],"initContainers":{"register":{"image":{"registry":"us-docker.pkg.dev/codefresh-inc/public-gcr-io","repository":"codefresh/curl","tag":"8.11.1"}}},"nodeSelector":{},"podSecurityContext":{},"resources":{},"tolerations":[]}` | builder |
 | cf-broadcaster | object | See below | broadcaster |
 | cf-oidc-provider | object | See below | cf-oidc-provider |
 | cf-platform-analytics-etlstarter | object | See below | etl-starter |
diff --git a/codefresh/values.yaml b/codefresh/values.yaml
index b1a4f8b10..8dfd8dcd7 100644
--- a/codefresh/values.yaml
+++ b/codefresh/values.yaml
@@ -500,19 +500,19 @@ postgresqlCleanJob:
 # -- runtimeImages
 # @default -- See below
 runtimeImages:
-  COMPOSE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/compose:v2.32.2-1.5.2
-  CONTAINER_LOGGER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-container-logger:1.12.5
-  DIND_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/dind:26.1.4-1.28.8
-  DOCKER_BUILDER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-builder:1.4.6
-  DOCKER_PULLER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-puller:8.0.20
-  DOCKER_PUSHER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-pusher:6.0.17
-  DOCKER_TAG_PUSHER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-tag-pusher:1.3.17
-  ENGINE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/engine:1.178.0
-  FS_OPS_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/fs-ops:1.2.10
-  GIT_CLONE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-git-cloner:10.2.0
-  KUBE_DEPLOY: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-deploy-kubernetes:16.2.6
-  PIPELINE_DEBUGGER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-debugger:1.3.9
-  TEMPLATE_ENGINE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/pikolo:0.14.3
+  COMPOSE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/compose:v2.37.0-1.5.4@sha256:e74494370100678ccb1c1058e6ef3ddcf67b21fcd37da8b3482376c8282549ad
+  CONTAINER_LOGGER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-container-logger:1.12.7@sha256:83bf409f43502748cce98798197dd7daa29c8844069b6f4e5bf3790966be60a2
+  DIND_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/dind:26.1.4-1.28.8@sha256:33c343dd01e8a24f0b4a872bbe62884320719f9d9dc27b7a8fed9f7e9fc7e80e
+  DOCKER_BUILDER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-builder:1.4.7@sha256:1d02df4dcf703a97c7a64b147cd2c3f6ec2c708aad16be5abbd337f3c13a48ad
+  DOCKER_PULLER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-puller:8.0.22@sha256:914f071bcb1893bcb42c3f8907f8f3874f1f30db1a2ccaa4b825dab9bb157e60
+  DOCKER_PUSHER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-pusher:6.0.20@sha256:bad3773029a68f33953f1dc245cb92c386b5311a996340eea41fe6b9cc52a96c
+  DOCKER_TAG_PUSHER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-docker-tag-pusher:1.3.18@sha256:0833366c74055251fefba728807b847b8d8a5e094d94ccc0912ec7d6f0fedf51
+  ENGINE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/engine:1.178.1@sha256:3a9b6724c4d21ae58317f4d861c603dcf35d24b0b2df43507c58322850387c1c
+  FS_OPS_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/fs-ops:1.2.10@sha256:70d53821b9314d88e3571dfb096e8f577caf3e4c2199253621b8d0c85d20b8ad
+  GIT_CLONE_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-git-cloner:10.3.2@sha256:2e09eef18d5caddae708058ec63247825ac4e4ee5e5763986f65e1312fbcc449
+  KUBE_DEPLOY: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-deploy-kubernetes:16.2.9@sha256:35649b14eb43717d3752d08597ada77d3737b2508f1b8e1f52f67b7a0e5ff263
+  PIPELINE_DEBUGGER_IMAGE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/cf-debugger:1.3.9@sha256:37975653b4ef5378bd1e38d453c7dac4721cba1c1977a5ca6118a67b98a47925
+  TEMPLATE_ENGINE: us-docker.pkg.dev/codefresh-inc/public-gcr-io/codefresh/pikolo:0.14.6@sha256:b3f499fcf93037e69fba599d2f292cfc9f28a158052dd57d5de9cdf9756f1f60
   CR_6177_FIXER: docker.io/library/alpine:3.21
   GC_BUILDER_IMAGE: docker.io/library/alpine:3.21
 
@@ -1159,7 +1159,7 @@ postgresql:
   image:
     registry: us-docker.pkg.dev/codefresh-inc/public-gcr-io
     repository: codefresh/postgresql
-    tag: 17
+    tag: 17.5.0-debian-12-r15
   auth:
     enablePostgresUser: true
     postgresPassword: "eC9arYka4ZbH"
@@ -1268,7 +1268,7 @@ builder:
     image:
       registry: docker.io
       repository: library/docker
-      tag: 28.2-dind
+      tag: 28.3-dind
   affinity: {}
   nodeSelector: {}
   podSecurityContext: {}
@@ -1285,12 +1285,12 @@ runner:
       image:
         registry: us-docker.pkg.dev/codefresh-inc/public-gcr-io
         repository: codefresh/curl
-        tag: 8.11.1
+        tag: 8.14.1
   container:
     image:
       registry: docker.io
       repository: library/docker
-      tag: 28.2-dind
+      tag: 28.3-dind
   affinity: {}
   nodeSelector: {}
   podSecurityContext: {}