diff --git a/.github/actions/setup-caches/action.yaml b/.github/actions/setup-caches/action.yaml
index 39dc8ffb8..f6cbcc59f 100644
--- a/.github/actions/setup-caches/action.yaml
+++ b/.github/actions/setup-caches/action.yaml
@@ -9,11 +9,11 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+    - uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
-    - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+    - uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
       if: ${{ inputs.build-cache-key }}
       with:
         path: ~/.cache/go-build
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 1973d3b54..1fbcadd1d 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -48,7 +48,7 @@ jobs:
     steps:
       - name: Checkout Source
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
       - name: Run Gosec Security Scanner
@@ -65,7 +65,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
       - name: Unit Test
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index ad94b7197..d28116145 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
 
@@ -58,7 +58,7 @@ jobs:
           repository: ${{ github.event.client_payload.repo }}
           ref: ${{ github.event.client_payload.sha }}
 
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 50e8f6e4d..60cfe5e58 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
       - name: Generate manifests
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
       - name: Run golangci-lint
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 14add66d4..36ec0673c 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Install Go
-        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: 'go.mod'
       - name: Setup caches
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 97bd747bf..83337a050 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -37,6 +37,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
         with:
           sarif_file: results.sarif
diff --git a/hack/distro/argocd/release.flux.yaml b/hack/distro/argocd/release.flux.yaml
index 45f92bbad..ae34bf9be 100644
--- a/hack/distro/argocd/release.flux.yaml
+++ b/hack/distro/argocd/release.flux.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: argo-cd
-      version: "9.2.4"
+      version: "9.3.4"
       sourceRef:
         kind: HelmRepository
         name: argocd
diff --git a/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml b/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
index 661a6a426..ac77a2375 100644
--- a/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
+++ b/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "80.13.3"
+      version: "80.14.4"
       sourceRef:
         kind: HelmRepository
         name: kube-prometheus-stack
diff --git a/hack/distro/monitoring/pyroscope/release.flux.yaml b/hack/distro/monitoring/pyroscope/release.flux.yaml
index 61babce24..810d32f62 100644
--- a/hack/distro/monitoring/pyroscope/release.flux.yaml
+++ b/hack/distro/monitoring/pyroscope/release.flux.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: pyroscope
-      version: "1.17.0"
+      version: "1.18.0"
       sourceRef:
         kind: HelmRepository
         name: pyroscope