diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b33a173217f..d314276b892 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,7 +34,7 @@ env:
   # are we on a release branch?
   DO_REALEASE: ${{ github.ref_name == github.event.repository.default_branch || github.ref_name == 'next' || startsWith(github.ref_name, 'maint/')}}
   NODE_VERSION: 22
-  PDM_VERSION: 2.25.5 # renovate: datasource=pypi depName=pdm
+  PDM_VERSION: 2.25.6 # renovate: datasource=pypi depName=pdm
   DRY_RUN: true
   TEST_LEGACY_DECRYPTION: true
   SPARSE_CHECKOUT: |-
diff --git a/lib/data/monorepo.json b/lib/data/monorepo.json
index 7fff356f4b3..4ab16713e4f 100644
--- a/lib/data/monorepo.json
+++ b/lib/data/monorepo.json
@@ -357,6 +357,10 @@
     "guava": "https://github.com/google/guava",
     "happy-dom": "https://github.com/capricorn86/happy-dom",
     "Hangfire": "https://github.com/HangfireIO/Hangfire",
+    "hibernate-models": "https://github.com/hibernate/hibernate-models",
+    "hibernate-orm": "https://github.com/hibernate/hibernate-orm",
+    "hibernate-search": "https://github.com/hibernate/hibernate-search",
+    "hibernate-tools": "https://github.com/hibernate/hibernate-tools",
     "hickory-dns": "https://github.com/hickory-dns/hickory-dns",
     "html-eslint": "https://github.com/yeonjuan/html-eslint",
     "humanizer": "https://github.com/Humanizr/Humanizer",
diff --git a/lib/modules/manager/azure-pipelines/readme.md b/lib/modules/manager/azure-pipelines/readme.md
index 05d7999a882..8face382d80 100644
--- a/lib/modules/manager/azure-pipelines/readme.md
+++ b/lib/modules/manager/azure-pipelines/readme.md
@@ -44,7 +44,7 @@ resources:
     - container: linux
       image: ubuntu:24.04
     - container: python
-      image: python:3.13@sha256:a66f18ee22c568a3d45191dfd70bdea2e1bd8d303f982ea1bca276a065285a21
+      image: python:3.13@sha256:819daf0e0d5e5bb88927aea18a9279f870f746c234d45468fd493ab618729866
 
 stages:
   - stage: StageOne
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index eedd76bf30d..b096f8d3237 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -5,19 +5,19 @@ ARG BASE_IMAGE_TYPE=slim
 # --------------------------------------
 # slim image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:10.30.2@sha256:be33db220685839c49f7daa1975e917270d24c59af3abceeb5233a73270afa24 AS slim-base
+FROM ghcr.io/renovatebot/base-image:10.30.3@sha256:fea558db27d9c51827ad03e114b601264d0145320a610ce0b5881cc6f294d3d5 AS slim-base
 
 # --------------------------------------
 # full image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:10.30.2-full@sha256:22cdb60deaba8d26afbf8fd6951d8e5c3066c7050b915ff11db752d1dd6e4131 AS full-base
+FROM ghcr.io/renovatebot/base-image:10.30.3-full@sha256:6cf3e675133829d851e545939258f3ff7b59fbca5983a5b26bc39153334d969e AS full-base
 
 ENV RENOVATE_BINARY_SOURCE=global
 
 # --------------------------------------
 # build image
 # --------------------------------------
-FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:10.30.2@sha256:be33db220685839c49f7daa1975e917270d24c59af3abceeb5233a73270afa24 AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:10.30.3@sha256:fea558db27d9c51827ad03e114b601264d0145320a610ce0b5881cc6f294d3d5 AS build
 
 # We want a specific node version here
 # renovate: datasource=github-releases packageName=containerbase/node-prebuild versioning=node