diff --git a/3rdparty/bazel/com_github_kubernetes_sigs_aws_load_balancer_controller/source.bzl b/3rdparty/bazel/com_github_kubernetes_sigs_aws_load_balancer_controller/source.bzl
index e2c1e8034d..c6901cf4c5 100644
--- a/3rdparty/bazel/com_github_kubernetes_sigs_aws_load_balancer_controller/source.bzl
+++ b/3rdparty/bazel/com_github_kubernetes_sigs_aws_load_balancer_controller/source.bzl
@@ -7,9 +7,9 @@ def aws_load_balancer_controller_deps():
         name = "com_github_kubernetes_sigs_aws_load_balancer_controller",
         urls = [
             "https://cdn.confidential.cloud/constellation/cas/sha256/422af7c03ebc73e1be6aea563475ec9ea6396071fa03158b9a3984aa621b8cb1",
-            "https://github.com/kubernetes-sigs/aws-load-balancer-controller/archive/refs/tags/v2.12.0.tar.gz",
+            "https://github.com/kubernetes-sigs/aws-load-balancer-controller/archive/refs/tags/v2.17.0.tar.gz",
         ],
-        strip_prefix = "aws-load-balancer-controller-2.12.0",
+        strip_prefix = "aws-load-balancer-controller-2.17.0",
         build_file_content = """
 filegroup(
     srcs = ["docs/install/iam_policy.json"],
diff --git a/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl b/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
index aa81fc947b..6c7c6da553 100644
--- a/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
+++ b/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
@@ -7,9 +7,9 @@ def node_maintainance_operator_deps():
         name = "com_github_medik8s_node_maintainance_operator",
         urls = [
             "https://cdn.confidential.cloud/constellation/cas/sha256/6ccc7f152e5c595ab24eaadcda77870101eccc482694dc6f0d93be2528406ae2",
-            "https://github.com/medik8s/node-maintenance-operator/archive/refs/tags/v0.17.0.tar.gz",
+            "https://github.com/medik8s/node-maintenance-operator/archive/refs/tags/v0.19.0.tar.gz",
         ],
-        strip_prefix = "node-maintenance-operator-0.17.0",
+        strip_prefix = "node-maintenance-operator-0.19.0",
         build_file_content = """
 api_v1beta1 = glob(["api/v1beta1/*.go"])
 filegroup(
diff --git a/bazel/toolchains/container_images.bzl b/bazel/toolchains/container_images.bzl
index 1c405484f8..a0374a44b1 100644
--- a/bazel/toolchains/container_images.bzl
+++ b/bazel/toolchains/container_images.bzl
@@ -7,7 +7,7 @@ load("@rules_oci//oci:pull.bzl", "oci_pull")
 def containter_image_deps():
     oci_pull(
         name = "distroless_static",
-        digest = "sha256:3d0f463de06b7ddff27684ec3bfd0b54a425149d0f8685308b1fdf297b0265e9",
+        digest = "sha256:4b2a093ef4649bccd586625090a3c668b254cfe180dee54f4c94f3e9bd7e381e",
         image = "gcr.io/distroless/static",
         platforms = [
             "linux/amd64",
diff --git a/bazel/toolchains/oci_deps.bzl b/bazel/toolchains/oci_deps.bzl
index f425e9066c..d4ff8c3ce1 100644
--- a/bazel/toolchains/oci_deps.bzl
+++ b/bazel/toolchains/oci_deps.bzl
@@ -7,11 +7,11 @@ def oci_deps():
     # Remove this override once https://github.com/bazel-contrib/rules_oci/issues/420 is fixed.
     http_archive(
         name = "rules_oci",
-        strip_prefix = "rules_oci-2.2.5",
+        strip_prefix = "rules_oci-2.2.7",
         type = "tar.gz",
         urls = [
             "https://cdn.confidential.cloud/constellation/cas/sha256/361c417e8c95cd7c3d8b5cf4b202e76bac8d41532131534ff8e6fa43aa161142",
-            "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.5/rules_oci-v2.2.5.tar.gz",
+            "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.7/rules_oci-v2.2.7.tar.gz",
         ],
         sha256 = "361c417e8c95cd7c3d8b5cf4b202e76bac8d41532131534ff8e6fa43aa161142",
         patches = ["//bazel/toolchains:0001-disable-Windows-support.patch"],