diff --git a/.github/workflows/buf.yaml b/.github/workflows/buf.yaml
index c070080b7..57cdeda05 100644
--- a/.github/workflows/buf.yaml
+++ b/.github/workflows/buf.yaml
@@ -12,9 +12,9 @@ permissions:
 
 env:
   # renovate: datasource=docker depName=golang versioning=docker
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
   # renovate: datasource=github-releases depName=bufbuild/buf
-  BUF_CLI_VERSION: '1.48.0'
+  BUF_CLI_VERSION: '1.61.0'
   # renovate: datasource=github-releases depName=favadi/protoc-go-inject-tag
   PROTOC_GO_INJECT_TAG_VERSION: '1.4.0'
 
diff --git a/.github/workflows/ci-go-libs.yaml b/.github/workflows/ci-go-libs.yaml
index a4a0a1137..b644e3fe7 100644
--- a/.github/workflows/ci-go-libs.yaml
+++ b/.github/workflows/ci-go-libs.yaml
@@ -10,7 +10,7 @@ on:
 
 env:
   # renovate: datasource=docker depName=golang versioning=docker
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 jobs:
 
diff --git a/.github/workflows/cicd-go.yaml b/.github/workflows/cicd-go.yaml
index 76ff6d746..c8379c8a3 100644
--- a/.github/workflows/cicd-go.yaml
+++ b/.github/workflows/cicd-go.yaml
@@ -23,7 +23,7 @@ permissions:
 
 env:
   # renovate: datasource=docker depName=golang versioning=docker
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 jobs:
 
diff --git a/.github/workflows/fly-deploy.yaml b/.github/workflows/fly-deploy.yaml
index c0e974f2c..2b459f4f0 100644
--- a/.github/workflows/fly-deploy.yaml
+++ b/.github/workflows/fly-deploy.yaml
@@ -5,7 +5,7 @@ name: 'Deploy to Fly'
 
 env:
   # renovate: datasource=github-releases depName=superfly/flyctl versioning=semver
-  FLY_CLI_VERSION: '0.3.57'
+  FLY_CLI_VERSION: '0.3.228'
 
 on:
   workflow_call:
diff --git a/.github/workflows/migrations.yaml b/.github/workflows/migrations.yaml
index e6712c0b8..9a17ac4a4 100644
--- a/.github/workflows/migrations.yaml
+++ b/.github/workflows/migrations.yaml
@@ -9,11 +9,11 @@ permissions:
 
 env:
   # renovate: datasource=github-releases depName=golang-migrate/migrate
-  MIGRATE_VERSION: '4.18.1'
+  MIGRATE_VERSION: '4.19.1'
   # renovate: datasource=github-releases depName=superfly/flyctl versioning=semver
-  FLY_CLI_VERSION: '0.3.57'
+  FLY_CLI_VERSION: '0.3.228'
   # renovate: datasource=github-releases depName=sqlc-dev/sqlc
-  SQLC_VERSION: '1.27.0'
+  SQLC_VERSION: '1.30.0'
 
 jobs:
   detect-changes:
diff --git a/.github/workflows/publish-bufs.yaml b/.github/workflows/publish-bufs.yaml
index 2b76fda09..89d419384 100644
--- a/.github/workflows/publish-bufs.yaml
+++ b/.github/workflows/publish-bufs.yaml
@@ -9,10 +9,10 @@ on:
 
 env:
   # renovate: datasource=github-releases depName=bufbuild/buf
-  BUF_CLI_VERSION: '1.48.0'
+  BUF_CLI_VERSION: '1.61.0'
   NODE_VERSION: '18.x'
   # renovate: datasource=dart-version depName=dart
-  DART_VERSION: '3.6.0'
+  DART_VERSION: '3.10.3'
 
 jobs:
   check-preconditions:
diff --git a/.github/workflows/spicedb.yaml b/.github/workflows/spicedb.yaml
index 4c9b17205..6c3c92984 100644
--- a/.github/workflows/spicedb.yaml
+++ b/.github/workflows/spicedb.yaml
@@ -2,7 +2,7 @@ name: spicedb
 
 env:
   # renovate: datasource=github-releases depName=authzed/zed
-  ZED_VERSION: '0.23.0'
+  ZED_VERSION: '0.33.1'
 
 on:
   pull_request:
diff --git a/Dockerfile.apisix b/Dockerfile.apisix
index 0d741b73e..e2c99c4de 100644
--- a/Dockerfile.apisix
+++ b/Dockerfile.apisix
@@ -3,7 +3,7 @@ FROM debian:bookworm AS deps
 # renovate: datasource=github-releases depName=DarthSim/hivemind
 ARG HIVEMIND_VERSION=1.1.0
 # renovate: datasource=github-releases depName=dapr/dapr
-ARG DAPR_VERSION=1.14.4
+ARG DAPR_VERSION=1.16.3
 
 RUN apt update && \
 	apt install -y wget
diff --git a/Dockerfile.service b/Dockerfile.service
index 998cf01a1..902b02f25 100644
--- a/Dockerfile.service
+++ b/Dockerfile.service
@@ -8,7 +8,7 @@ FROM debian:12.8 AS deps
 
 
 # renovate: datasource=github-releases depName=golang-migrate/migrate
-ARG MIGRATE_VERSION=4.18.1
+ARG MIGRATE_VERSION=4.19.1
 
 
 RUN apt update && \
diff --git a/Dockerfile.standalone b/Dockerfile.standalone
index 4264ae330..eb1be4547 100644
--- a/Dockerfile.standalone
+++ b/Dockerfile.standalone
@@ -47,9 +47,9 @@ FROM debian:12.8 AS deps
 # renovate: datasource=github-releases depName=DarthSim/hivemind
 ARG HIVEMIND_VERSION=1.1.0
 # renovate: datasource=github-releases depName=golang-migrate/migrate
-ARG MIGRATE_VERSION=4.18.1
+ARG MIGRATE_VERSION=4.19.1
 # renovate: datasource=github-releases depName=dapr/dapr
-ARG DAPR_VERSION=1.14.4
+ARG DAPR_VERSION=1.16.3
 
 RUN apt update && \
 	apt install -y wget
diff --git a/go.mod b/go.mod
index 0bb49ea29..c491a7e95 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module devtools
 
-go 1.23
+go 1.25
 
 replace (
 	common => ./libs/common
diff --git a/images/dev-go/Dockerfile b/images/dev-go/Dockerfile
index c85f15c48..348c03f68 100644
--- a/images/dev-go/Dockerfile
+++ b/images/dev-go/Dockerfile
@@ -33,7 +33,7 @@ RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - \
 # install buf
 #  https://buf.build/
 # renovate: datasource=github-releases depName=bufbuild/buf
-ENV BUF_VERSION=1.48.0
+ENV BUF_VERSION=1.61.0
 RUN wget https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-x86_64 -O /usr/local/bin/buf \
     && chmod +x /usr/local/bin/buf
 
@@ -48,7 +48,7 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
 # install zed, CLI for SpiceDB
 #  https://github.com/authzed/zed
 # renovate: datasource=github-releases depName=authzed/zed
-ENV ZED_VERSION=0.23.0
+ENV ZED_VERSION=0.33.1
 RUN wget https://github.com/authzed/zed/releases/download/v${ZED_VERSION}/zed_${ZED_VERSION}_linux_amd64.deb -O zed.deb \
     && apt install -y ./zed.deb \
     && rm zed.deb
@@ -74,16 +74,16 @@ ENV HOME="/home/${UNAME}"
 # install air
 #  https://github.com/air-verse/air
 # renovate: datasource=github-releases depName=air-verse/air
-ENV AIR_VERSION=1.61.5
+ENV AIR_VERSION=1.63.4
 RUN curl -sSfL https://raw.githubusercontent.com/air-verse/air/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v${AIR_VERSION}
 
 # install dapr-cli
 #  https://docs.dapr.io/
 
 # renovate: datasource=github-releases depName=dapr/cli
-ENV DAPR_CLI_VERSION=1.14.1
+ENV DAPR_CLI_VERSION=1.16.5
 # renovate: datasource=github-releases depName=dapr/dapr
-ENV DAPR_RT_VERSION=1.14.4
+ENV DAPR_RT_VERSION=1.16.3
 
 ENV PATH="$PATH:$HOME/dapr"
 RUN mkdir "$HOME/dapr" \
@@ -98,21 +98,21 @@ ENV PATH="$PATH:$HOME/.fly/bin"
 # install go-migrate
 #  https://github.com/golang-migrate/migrate
 # renovate: datasource=github-releases depName=golang-migrate/migrate
-ENV MIGRATE_VERSION=4.18.1
+ENV MIGRATE_VERSION=4.19.1
 RUN go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@v${MIGRATE_VERSION} \
 	&& go clean -modcache
 
 # install grpcurl
 #  https://github.com/fullstorydev/grpcurl
 # renovate: datasource=github-releases depName=fullstorydev/grpcurl
-ENV GRPCURL_VERSION=1.9.2
+ENV GRPCURL_VERSION=1.9.3
 RUN go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v${GRPCURL_VERSION} \
 	&& go clean -modcache
 
 # install sqlc
 #  https://sqlc.dev/
 # renovate: datasource=github-releases depName=sqlc-dev/sqlc
-ENV SQLC_VERSION=1.27.0
+ENV SQLC_VERSION=1.30.0
 RUN go install github.com/sqlc-dev/sqlc/cmd/sqlc@v${SQLC_VERSION}\
 	&& go clean -modcache
 
@@ -128,14 +128,14 @@ RUN go install github.com/favadi/protoc-go-inject-tag@v${GO_INJECT_TAG_VERSION}
 # install gofumpt, a stricter gofmt
 #  https://github.com/mvdan/gofumpt
 # renovate: datasource=github-releases depName=mvdan/gofumpt
-ENV GOFUMPT_VERSION=0.7.0
+ENV GOFUMPT_VERSION=0.9.2
 RUN go install mvdan.cc/gofumpt@v${GOFUMPT_VERSION} \
 	&& go clean -modcache
 
 # install golangci-lint, the linter we also use in the CI
 #  https://golangci-lint.run/
 # renovate: datasource=github-releases depName=golangci/golangci-lint
-ENV GOLANGCI_LINT_VERSION=1.63.4
+ENV GOLANGCI_LINT_VERSION=1.64.8
 RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh \
 	| sh -s -- -b $(go env GOPATH)/bin v${GOLANGCI_LINT_VERSION}
 
diff --git a/libs/common/go.mod b/libs/common/go.mod
index eb7f61e63..c7164c88d 100644
--- a/libs/common/go.mod
+++ b/libs/common/go.mod
@@ -1,6 +1,6 @@
 module common
 
-go 1.23
+go 1.25
 
 replace (
 	hwlocale => ../hwlocale
diff --git a/libs/decaying-lru/go.mod b/libs/decaying-lru/go.mod
index fdddd6f2f..13bfb5faa 100644
--- a/libs/decaying-lru/go.mod
+++ b/libs/decaying-lru/go.mod
@@ -1,6 +1,6 @@
 module decayinglru
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../common
diff --git a/libs/hwauthz/go.mod b/libs/hwauthz/go.mod
index 81cff8bfb..920a35a8b 100644
--- a/libs/hwauthz/go.mod
+++ b/libs/hwauthz/go.mod
@@ -1,6 +1,6 @@
 module hwauthz
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../common
diff --git a/libs/hwdb/go.mod b/libs/hwdb/go.mod
index 45c4c4a3b..d5480a388 100644
--- a/libs/hwdb/go.mod
+++ b/libs/hwdb/go.mod
@@ -1,6 +1,6 @@
 module hwdb
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../common
diff --git a/libs/hwes/go.mod b/libs/hwes/go.mod
index 8fa8c634e..da880a896 100644
--- a/libs/hwes/go.mod
+++ b/libs/hwes/go.mod
@@ -1,6 +1,6 @@
 module hwes
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../common
diff --git a/libs/hwlocale/go.mod b/libs/hwlocale/go.mod
index b04469b14..ff54d4fff 100644
--- a/libs/hwlocale/go.mod
+++ b/libs/hwlocale/go.mod
@@ -1,6 +1,6 @@
 module hwlocale
 
-go 1.23
+go 1.25
 
 replace hwutil => ../hwutil
 
diff --git a/libs/hwtesting/go.mod b/libs/hwtesting/go.mod
index ed772c57a..7a28b0421 100644
--- a/libs/hwtesting/go.mod
+++ b/libs/hwtesting/go.mod
@@ -1,6 +1,6 @@
 module hwtesting
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../common
diff --git a/libs/hwutil/go.mod b/libs/hwutil/go.mod
index 2e02c3da6..a5c49478e 100644
--- a/libs/hwutil/go.mod
+++ b/libs/hwutil/go.mod
@@ -1,6 +1,6 @@
 module hwutil
 
-go 1.23
+go 1.25
 
 require (
 	github.com/go-playground/validator/v10 v10.23.0
diff --git a/libs/telemetry/go.mod b/libs/telemetry/go.mod
index bb4dec800..8e592d53e 100644
--- a/libs/telemetry/go.mod
+++ b/libs/telemetry/go.mod
@@ -1,6 +1,6 @@
 module telemetry
 
-go 1.23
+go 1.25
 
 replace hwutil => ../hwutil
 
diff --git a/services/property-svc/go.mod b/services/property-svc/go.mod
index 2514b0f26..02ae0698e 100644
--- a/services/property-svc/go.mod
+++ b/services/property-svc/go.mod
@@ -1,6 +1,6 @@
 module property-svc
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../../libs/common
diff --git a/services/tasks-svc/go.mod b/services/tasks-svc/go.mod
index edc1b3d90..905a933a1 100644
--- a/services/tasks-svc/go.mod
+++ b/services/tasks-svc/go.mod
@@ -1,6 +1,6 @@
 module tasks-svc
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../../libs/common
diff --git a/services/updates-svc/go.mod b/services/updates-svc/go.mod
index 6e3fbb058..6001fdf0c 100644
--- a/services/updates-svc/go.mod
+++ b/services/updates-svc/go.mod
@@ -1,6 +1,6 @@
 module updates-svc
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../../libs/common
diff --git a/services/user-svc/go.mod b/services/user-svc/go.mod
index 1c25b094e..b09b88b47 100644
--- a/services/user-svc/go.mod
+++ b/services/user-svc/go.mod
@@ -1,6 +1,6 @@
 module user-svc
 
-go 1.23
+go 1.25
 
 replace (
 	common => ../../libs/common
diff --git a/spicedb/migrations/go.mod b/spicedb/migrations/go.mod
index e01f637c8..c90a508e8 100644
--- a/spicedb/migrations/go.mod
+++ b/spicedb/migrations/go.mod
@@ -1,6 +1,6 @@
 module hooks
 
-go 1.23
+go 1.25
 
 require github.com/authzed/authzed-go v1.2.0