diff --git a/.github/workflows/boil_pr.yaml b/.github/workflows/boil_pr.yaml
index 774a76eef..fd053bffc 100644
--- a/.github/workflows/boil_pr.yaml
+++ b/.github/workflows/boil_pr.yaml
@@ -10,7 +10,7 @@ on:
       - "Cargo.*"
 
 env:
-  RUST_VERSION: 1.87.0
+  RUST_VERSION: 1.89.0
 
 jobs:
   # This job is always run to ensure we don't miss any new upstream advisories
@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+      - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.targets.target }}
diff --git a/.github/workflows/boil_release.yaml b/.github/workflows/boil_release.yaml
index e3f381389..3cb60ba82 100644
--- a/.github/workflows/boil_release.yaml
+++ b/.github/workflows/boil_release.yaml
@@ -7,7 +7,7 @@ on:
       - "boil-[0-9]+.[0-9]+.[0-9]+**"
 
 env:
-  RUST_VERSION: 1.87.0
+  RUST_VERSION: 1.89.0
 
 jobs:
   create-release:
@@ -28,7 +28,7 @@ jobs:
           args: --latest --strip header
 
       - name: Create Draft Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
         with:
           body: ${{ steps.changelog.outputs.content }}
           draft: true
@@ -51,7 +51,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+      - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.targets.target }}
@@ -67,7 +67,7 @@ jobs:
         run: mv "target/$TARGET/release/boil" "boil-$TARGET"
 
       - name: Upload Artifact to Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
         with:
           draft: false
           files: boil-${{ matrix.targets.target }}
diff --git a/.github/workflows/mirror.yaml b/.github/workflows/mirror.yaml
index f0435a461..a1b039b5c 100644
--- a/.github/workflows/mirror.yaml
+++ b/.github/workflows/mirror.yaml
@@ -36,7 +36,7 @@ jobs:
           - amd64
           - arm64
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
@@ -57,7 +57,7 @@ jobs:
           echo "IMAGE_REPOSITORY=$(.scripts/get_repo_name.sh)" | tee -a "$GITHUB_ENV"
 
       - name: Publish Container Image on oci.stackable.tech
-        uses: stackabletech/actions/publish-image@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/publish-image@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -73,7 +73,7 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
@@ -84,7 +84,7 @@ jobs:
           echo "IMAGE_REPOSITORY=$(.scripts/get_repo_name.sh)" | tee -a "$GITHUB_ENV"
 
       - name: Publish and Sign Image Index Manifest to oci.stackable.tech
-        uses: stackabletech/actions/publish-image-index-manifest@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/publish-image-index-manifest@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml
index 3a628989c..76bb86bc6 100644
--- a/.github/workflows/pr_pre-commit.yaml
+++ b/.github/workflows/pr_pre-commit.yaml
@@ -6,19 +6,19 @@ on:
 
 env:
   # Keep in sync with across other repos like operator-rs and operator-templating
-  RUST_TOOLCHAIN_VERSION: "nightly-2025-05-26"
-  HADOLINT_VERSION: "v2.12.0"
-  PYTHON_VERSION: "3.12"
+  RUST_TOOLCHAIN_VERSION: "nightly-2025-10-23"
+  HADOLINT_VERSION: "v2.14.0"
+  PYTHON_VERSION: "3.14"
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: stackabletech/actions/run-pre-commit@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+      - uses: stackabletech/actions/run-pre-commit@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
diff --git a/.github/workflows/preflight.yaml b/.github/workflows/preflight.yaml
index 6821739f0..a01d15551 100644
--- a/.github/workflows/preflight.yaml
+++ b/.github/workflows/preflight.yaml
@@ -22,24 +22,24 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Image version (0.0.0-dev, 23.11.0, etc)'
+        description: "Image version (0.0.0-dev, 23.11.0, etc)"
         required: true
-        default: '0.0.0-dev'
+        default: "0.0.0-dev"
         type: string
       submit:
-        description: 'Submit results to the RH portal'
+        description: "Submit results to the RH portal"
         required: true
         default: false
         type: boolean
       registry:
-        description: 'Image repository.'
+        description: "Image repository."
         required: true
-        default: 'oci.stackable.tech'
+        default: "oci.stackable.tech"
         type: string
       organization:
-        description: 'Organization name within the given registry'
+        description: "Organization name within the given registry"
         required: true
-        default: 'sdp'
+        default: "sdp"
         type: string
 jobs:
   preflight:
@@ -76,12 +76,12 @@ jobs:
     env:
       GITHUB_REF_NAME: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
-          python-version: '3.x'
+          python-version: "3.x"
       - run: pip install image-tools-stackabletech==0.0.16
       - name: Install preflight
         run: |
diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml
index e5dad443a..352db8a2d 100644
--- a/.github/workflows/reusable_build_image.yaml
+++ b/.github/workflows/reusable_build_image.yaml
@@ -30,7 +30,7 @@ jobs:
     name: Generate Runner Dimension
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
       - id: runners
@@ -55,11 +55,11 @@ jobs:
     name: Generate Version Dimension
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
       - id: shard
-        uses: stackabletech/actions/shard@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/shard@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           product-name: ${{ inputs.product-name }}
     outputs:
@@ -80,16 +80,16 @@ jobs:
         runner: ${{ fromJson(needs.generate_runner_dimension.outputs.runners) }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: Free Disk Space
-        uses: stackabletech/actions/free-disk-space@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/free-disk-space@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
 
       - name: Build Product Image
         id: build
-        uses: stackabletech/actions/build-product-image@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/build-product-image@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           registry-namespace: ${{ inputs.registry-namespace }}
           product-name: ${{ inputs.product-name }}
@@ -97,7 +97,7 @@ jobs:
           sdp-version: ${{ inputs.sdp-version }}
 
       - name: Publish Container Image on oci.stackable.tech
-        uses: stackabletech/actions/publish-image@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/publish-image@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
@@ -118,12 +118,12 @@ jobs:
         versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: Publish and Sign Image Index Manifest to oci.stackable.tech
-        uses: stackabletech/actions/publish-image-index-manifest@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/publish-image-index-manifest@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
@@ -138,7 +138,7 @@ jobs:
     if: failure() || (github.run_attempt > 1 && !cancelled())
     steps:
       - name: Send Notification
-        uses: stackabletech/actions/send-slack-notification@a5d39a4eb109bb6af3c152800701c86e98bfe1a5 # v0.10.1
+        uses: stackabletech/actions/send-slack-notification@75e0756966dea229d697165bfd06ba79abcda72c # v0.10.3
         with:
           publish-manifests-result: ${{ needs.publish_manifests.result }}
           build-result: ${{ needs.build.result }}
diff --git a/.github/workflows/ubi-rust-builder.yml b/.github/workflows/ubi-rust-builder.yml
index d58f24aa2..7f8f580f5 100644
--- a/.github/workflows/ubi-rust-builder.yml
+++ b/.github/workflows/ubi-rust-builder.yml
@@ -14,7 +14,7 @@ on:
       - .github/workflows/ubi-rust-builder.yml
       - .github/workflows/reusable_build_image.yaml
   schedule:
-    - cron: '30 4 * * *'
+    - cron: "30 4 * * *"
   workflow_dispatch:
 
 jobs:
@@ -28,11 +28,11 @@ jobs:
         ubi-version: ["ubi9"]
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
       - name: Login to Stackable Harbor
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: oci.stackable.tech
           username: robot$sdp+github-action-build
@@ -69,11 +69,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: ["build"]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
       - name: Login to Stackable Harbor
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: oci.stackable.tech
           username: robot$sdp+github-action-build
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4af07cfe2..0706f07eb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,7 +7,7 @@ default_language_version:
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # 5.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -26,7 +26,7 @@ repos:
       - id: markdownlint
 
   - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: 2491238703a5d3415bb2b7ff11388bf775372f29 # 0.10.0
+    rev: 99470f5e12208ff0fb17ab81c3c494f7620a1d8d # 0.11.0
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
@@ -35,7 +35,7 @@ repos:
   # If you do not, you will need to delete the cached ruff binary shown in the
   # error message
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: d19233b89771be2d89273f163f5edc5a39bbc34a # 0.11.12
+    rev: 3db93a2be6f214ed722bf7bce095ec1b1715422a # 0.14.2
     hooks:
       # Run the linter.
       - id: ruff-check
@@ -43,12 +43,12 @@ repos:
       - id: ruff-format
 
   - repo: https://github.com/rhysd/actionlint
-    rev: 03d0035246f3e81f36aed592ffb4bebf33a03106 # 1.7.7
+    rev: e7d448ef7507c20fc4c88a95d0c448b848cd6127 # 1.7.8
     hooks:
       - id: actionlint
 
   - repo: https://github.com/hadolint/hadolint
-    rev: b3555ba9c2bfd9401e79f2f0da68dd1ae38e10c7 # 2.12.0
+    rev: 57e1618d78fd469a92c1e584e8c9313024656623 # 2.14.0
     hooks:
       - id: hadolint
 
@@ -72,7 +72,7 @@ repos:
       - id: cargo-rustfmt
         name: cargo-rustfmt
         language: system
-        entry: cargo +nightly-2025-05-26 fmt --all -- --check
+        entry: cargo +nightly-2025-10-23 fmt --all -- --check
         stages: [pre-commit, pre-merge-commit]
         pass_filenames: false
         files: \.rs$
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 291696d0e..65c0d610c 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.87.0"
+channel = "1.89.0"
 profile = "default"