diff --git a/k8s/apps/media/arr/prowlarr/deployment.yaml b/k8s/apps/media/arr/prowlarr/deployment.yaml
index 94510db..06cc2e1 100644
--- a/k8s/apps/media/arr/prowlarr/deployment.yaml
+++ b/k8s/apps/media/arr/prowlarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: prowlarr
-          image: ghcr.io/onedr0p/prowlarr:1.30.2 # renovate: docker=ghcr.io/onedr0p/prowlarr
+          image: ghcr.io/onedr0p/prowlarr:1.32.2 # renovate: docker=ghcr.io/onedr0p/prowlarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/arr/radarr/deployment.yaml b/k8s/apps/media/arr/radarr/deployment.yaml
index 3b30be9..90938b5 100644
--- a/k8s/apps/media/arr/radarr/deployment.yaml
+++ b/k8s/apps/media/arr/radarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: radarr
-          image: ghcr.io/onedr0p/radarr:5.18.4 # renovate: docker=ghcr.io/onedr0p/radarr
+          image: ghcr.io/onedr0p/radarr:5.19.3 # renovate: docker=ghcr.io/onedr0p/radarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/arr/sonarr/deployment.yaml b/k8s/apps/media/arr/sonarr/deployment.yaml
index 25549b4..47451fa 100644
--- a/k8s/apps/media/arr/sonarr/deployment.yaml
+++ b/k8s/apps/media/arr/sonarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sonarr
-          image: ghcr.io/onedr0p/sonarr:4.0.12 # renovate: docker=ghcr.io/onedr0p/sonarr
+          image: ghcr.io/onedr0p/sonarr:4.0.13 # renovate: docker=ghcr.io/onedr0p/sonarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/arr/torrent/deployment.yaml b/k8s/apps/media/arr/torrent/deployment.yaml
index 1255e41..9784a7c 100644
--- a/k8s/apps/media/arr/torrent/deployment.yaml
+++ b/k8s/apps/media/arr/torrent/deployment.yaml
@@ -57,7 +57,7 @@ spec:
             - name: tmp
               mountPath: /tmp
         - name: torrent
-          image: ghcr.io/onedr0p/qbittorrent:5.0.3 # renovate: docker=ghcr.io/onedr0p/qbittorrent
+          image: ghcr.io/onedr0p/qbittorrent:5.0.4 # renovate: docker=ghcr.io/onedr0p/qbittorrent
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/jellyfin/deployment.yaml b/k8s/apps/media/jellyfin/deployment.yaml
index af6c121..5723751 100644
--- a/k8s/apps/media/jellyfin/deployment.yaml
+++ b/k8s/apps/media/jellyfin/deployment.yaml
@@ -25,7 +25,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jellyfin
-          image: ghcr.io/jellyfin/jellyfin:10.10.5 # renovate: docker=ghcr.io/jellyfin/jellyfin
+          image: ghcr.io/jellyfin/jellyfin:10.10.6 # renovate: docker=ghcr.io/jellyfin/jellyfin
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/plex/deployment.yaml b/k8s/apps/media/plex/deployment.yaml
index 4611d97..4444919 100644
--- a/k8s/apps/media/plex/deployment.yaml
+++ b/k8s/apps/media/plex/deployment.yaml
@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: plex
-          image: ghcr.io/onedr0p/plex:1.41.3.9314-a0bfb8370 # renovate: docker=ghcr.io/onedr0p/plex versioning=loose
+          image: ghcr.io/onedr0p/plex:1.41.5.9522 # renovate: docker=ghcr.io/onedr0p/plex versioning=loose
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/auth/authelia/kustomization.yaml b/k8s/infra/auth/authelia/kustomization.yaml
index 7516feb..e715d8b 100644
--- a/k8s/infra/auth/authelia/kustomization.yaml
+++ b/k8s/infra/auth/authelia/kustomization.yaml
@@ -19,7 +19,7 @@ helmCharts:
     repo: https://charts.authelia.com
     releaseName: authelia
     namespace: authelia
-    version: 0.9.15
+    version: 0.10.4
     valuesFile: values.yaml
 
 patches:
diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml
index 551ddc5..5441a3c 100644
--- a/k8s/infra/auth/authelia/values.yaml
+++ b/k8s/infra/auth/authelia/values.yaml
@@ -2,7 +2,7 @@
 image:
   registry: ghcr.io
   repository: authelia/authelia
-  tag: 4.38.18 # renovate: docker=ghcr.io/authelia/authelia
+  tag: 4.39.1 # renovate: docker=ghcr.io/authelia/authelia
   pullPolicy: IfNotPresent
 
 pod:
diff --git a/k8s/infra/auth/keycloak/kustomization.yaml b/k8s/infra/auth/keycloak/kustomization.yaml
index a9f497e..e1e9163 100644
--- a/k8s/infra/auth/keycloak/kustomization.yaml
+++ b/k8s/infra/auth/keycloak/kustomization.yaml
@@ -15,5 +15,5 @@ helmCharts:
     repo: oci://registry-1.docker.io/bitnamicharts
     releaseName: keycloak
     namespace: keycloak
-    version: 24.4.9
+    version: 24.4.13
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml
index 2261b61..7f4bdb2 100644
--- a/k8s/infra/controllers/argocd/kustomization.yaml
+++ b/k8s/infra/controllers/argocd/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 7.8.2
+    version: 7.8.13
     releaseName: "argocd"
     namespace: argocd
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/cert-manager/kustomization.yaml b/k8s/infra/controllers/cert-manager/kustomization.yaml
index 8feff51..c732ec1 100644
--- a/k8s/infra/controllers/cert-manager/kustomization.yaml
+++ b/k8s/infra/controllers/cert-manager/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://charts.jetstack.io
-    version: v1.17.0 # renovate: github-releases=cert-manager/cert-manager
+    version: v1.17.1 # renovate: github-releases=cert-manager/cert-manager
     releaseName: cert-manager
     namespace: cert-manager
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/crossplane/kustomization.yaml b/k8s/infra/controllers/crossplane/kustomization.yaml
index 0447ad1..8d93b2c 100644
--- a/k8s/infra/controllers/crossplane/kustomization.yaml
+++ b/k8s/infra/controllers/crossplane/kustomization.yaml
@@ -9,4 +9,4 @@ helmCharts:
     repo: https://charts.crossplane.io/stable
     releaseName: crossplane
     namespace: crossplane
-    version: 1.18.2
+    version: 1.19.0
diff --git a/k8s/infra/controllers/node-feature-discovery/kustomization.yaml b/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
index ae4011b..32fcc4f 100644
--- a/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
+++ b/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
@@ -10,7 +10,7 @@ resources:
 helmCharts:
   - name: node-feature-discovery
     repo: https://kubernetes-sigs.github.io/node-feature-discovery/charts
-    version: 0.17.1
+    version: 0.17.2
     releaseName: nfd
     includeCRDs: true
     namespace: node-feature-discovery
diff --git a/k8s/infra/controllers/sealed-secrets/kustomization.yaml b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
index 7c5c42d..43e7e09 100644
--- a/k8s/infra/controllers/sealed-secrets/kustomization.yaml
+++ b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: sealed-secrets
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 2.5.6
+    version: 2.5.7
     releaseName: sealed-secrets-controller
     namespace: sealed-secrets
     includeCRDs: true
diff --git a/k8s/infra/crossplane-crds/functions/auto-ready.yaml b/k8s/infra/crossplane-crds/functions/auto-ready.yaml
index 48a4636..6e79c67 100644
--- a/k8s/infra/crossplane-crds/functions/auto-ready.yaml
+++ b/k8s/infra/crossplane-crds/functions/auto-ready.yaml
@@ -3,4 +3,4 @@ kind: Function
 metadata:
   name: function-auto-ready
 spec:
-  package: xpkg.upbound.io/crossplane-contrib/function-auto-ready:v0.4.1 # renovate: github-releases=crossplane-contrib/function-auto-ready
+  package: xpkg.upbound.io/crossplane-contrib/function-auto-ready:v0.4.2 # renovate: github-releases=crossplane-contrib/function-auto-ready
diff --git a/k8s/infra/crossplane-crds/functions/go-templating.yaml b/k8s/infra/crossplane-crds/functions/go-templating.yaml
index 2444ebc..825f800 100644
--- a/k8s/infra/crossplane-crds/functions/go-templating.yaml
+++ b/k8s/infra/crossplane-crds/functions/go-templating.yaml
@@ -3,4 +3,4 @@ kind: Function
 metadata:
   name: function-go-templating
 spec:
-  package: xpkg.upbound.io/crossplane-contrib/function-go-templating:v0.9.1 # renovate: github-releases=crossplane-contrib/function-go-templating
\ No newline at end of file
+  package: xpkg.upbound.io/crossplane-contrib/function-go-templating:v0.9.2 # renovate: github-releases=crossplane-contrib/function-go-templating
\ No newline at end of file
diff --git a/k8s/infra/crossplane-crds/providers/keycloak.yaml b/k8s/infra/crossplane-crds/providers/keycloak.yaml
index 7eb1192..25ee442 100644
--- a/k8s/infra/crossplane-crds/providers/keycloak.yaml
+++ b/k8s/infra/crossplane-crds/providers/keycloak.yaml
@@ -3,4 +3,4 @@ kind: Provider
 metadata:
   name: provider-keycloak
 spec:
-  package: xpkg.upbound.io/crossplane-contrib/provider-keycloak:v1.11.0 # renovate: github-releases=crossplane-contrib/provider-keycloak
+  package: xpkg.upbound.io/crossplane-contrib/provider-keycloak:v2.0.0 # renovate: github-releases=crossplane-contrib/provider-keycloak
diff --git a/k8s/infra/database/cnpg/kustomization.yaml b/k8s/infra/database/cnpg/kustomization.yaml
index c855cbf..7dd0404 100644
--- a/k8s/infra/database/cnpg/kustomization.yaml
+++ b/k8s/infra/database/cnpg/kustomization.yaml
@@ -11,5 +11,5 @@ helmCharts:
     releaseName: cnpg
     namespace: cnpg-system
     includeCRDs: true
-    version: 0.23.0
+    version: 0.23.2
     valuesFile: values.yaml
diff --git a/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml b/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
index 135fa6c..2aaa4dd 100644
--- a/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
+++ b/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
@@ -10,7 +10,7 @@ spec:
   sources:
     - repoURL: https://prometheus-community.github.io/helm-charts
       chart: kube-prometheus-stack
-      targetRevision: 69.2.0 # renovate: docker=ghcr.io/prometheus-community/charts/kube-prometheus-stack
+      targetRevision: 70.2.1 # renovate: docker=ghcr.io/prometheus-community/charts/kube-prometheus-stack
       helm:
         valueFiles:
           - $values/k8s/infra/monitoring/prometheus-stack/values.yaml
diff --git a/k8s/infra/network/cilium/kustomization.yaml b/k8s/infra/network/cilium/kustomization.yaml
index 675d4ce..267d80a 100644
--- a/k8s/infra/network/cilium/kustomization.yaml
+++ b/k8s/infra/network/cilium/kustomization.yaml
@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io
-    version: 1.17.0 # renovate: github-releases=cilium/cilium
+    version: 1.17.2 # renovate: github-releases=cilium/cilium
     releaseName: "cilium"
     includeCRDs: true
     namespace: kube-system
diff --git a/k8s/infra/network/cloudflared/daemon-set.yaml b/k8s/infra/network/cloudflared/daemon-set.yaml
index cff6597..2356311 100644
--- a/k8s/infra/network/cloudflared/daemon-set.yaml
+++ b/k8s/infra/network/cloudflared/daemon-set.yaml
@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2025.2.0 # renovate: docker=cloudflare/cloudflared
+          image: cloudflare/cloudflared:2025.2.1 # renovate: docker=cloudflare/cloudflared
           imagePullPolicy: IfNotPresent
           args:
             - tunnel
diff --git a/k8s/infra/network/dns/adguard/deployment.yaml b/k8s/infra/network/dns/adguard/deployment.yaml
index 89ce4e0..02adf0f 100644
--- a/k8s/infra/network/dns/adguard/deployment.yaml
+++ b/k8s/infra/network/dns/adguard/deployment.yaml
@@ -49,7 +49,7 @@ spec:
               mountPath: /opt/adguardhome/conf
       containers:
         - name: adguard
-          image: docker.io/adguard/adguardhome:v0.107.56 # renovate: docker=docker.io/adguard/adguardhome
+          image: docker.io/adguard/adguardhome:v0.107.59 # renovate: docker=docker.io/adguard/adguardhome
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
index d2086b0..90ec0ec 100644
--- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml
+++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
@@ -22,7 +22,7 @@ spec:
             value: "1"
       containers:
         - name: agent
-          image: docker.io/netbirdio/netbird:0.36.5 # renovate: docker=docker.io/netbirdio/netbird
+          image: docker.io/netbirdio/netbird:0.39.1 # renovate: docker=docker.io/netbirdio/netbird
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
diff --git a/k8s/infra/vpn/netbird/dashboard/deployment.yaml b/k8s/infra/vpn/netbird/dashboard/deployment.yaml
index a15d722..ba58a1b 100644
--- a/k8s/infra/vpn/netbird/dashboard/deployment.yaml
+++ b/k8s/infra/vpn/netbird/dashboard/deployment.yaml
@@ -17,7 +17,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: dashboard
-          image: docker.io/netbirdio/dashboard:v2.9.0 # renovate: docker=docker.io/netbirdio/dashboard
+          image: docker.io/netbirdio/dashboard:v2.10.0 # renovate: docker=docker.io/netbirdio/dashboard
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
diff --git a/k8s/infra/vpn/netbird/management/deployment.yaml b/k8s/infra/vpn/netbird/management/deployment.yaml
index c02c001..b1a6c79 100644
--- a/k8s/infra/vpn/netbird/management/deployment.yaml
+++ b/k8s/infra/vpn/netbird/management/deployment.yaml
@@ -58,7 +58,7 @@ spec:
               mountPath: /tmp/netbird
       containers:
         - name: management
-          image: docker.io/netbirdio/management:0.36.5 # renovate: docker=docker.io/netbirdio/management
+          image: docker.io/netbirdio/management:0.39.1 # renovate: docker=docker.io/netbirdio/management
           args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console, --idp-sign-key-refresh-enabled ]
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/k8s/infra/vpn/netbird/relay/deployment.yaml b/k8s/infra/vpn/netbird/relay/deployment.yaml
index 7a304d8..be33775 100644
--- a/k8s/infra/vpn/netbird/relay/deployment.yaml
+++ b/k8s/infra/vpn/netbird/relay/deployment.yaml
@@ -16,7 +16,7 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       containers:
-        - image: docker.io/netbirdio/relay:0.36.5 # renovate: docker=netbirdio/relay
+        - image: docker.io/netbirdio/relay:0.39.1 # renovate: docker=netbirdio/relay
           imagePullPolicy: IfNotPresent
           name: relay
           securityContext:
diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml
index 8eaba52..294c70e 100644
--- a/k8s/infra/vpn/netbird/signal/deployment.yaml
+++ b/k8s/infra/vpn/netbird/signal/deployment.yaml
@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: signal
-          image: docker.io/netbirdio/signal:0.36.5 # renovate: docker=docker.io/netbirdio/signal
+          image: docker.io/netbirdio/signal:0.39.1 # renovate: docker=docker.io/netbirdio/signal
           args: [ --port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console ]
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/tofu/home-assistant/main.tf b/tofu/home-assistant/main.tf
index 414043c..2193180 100644
--- a/tofu/home-assistant/main.tf
+++ b/tofu/home-assistant/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.70.1"
+      version = "0.73.2"
     }
   }
 }
diff --git a/tofu/kubernetes/providers.tf b/tofu/kubernetes/providers.tf
index 3465bba..8a58d70 100644
--- a/tofu/kubernetes/providers.tf
+++ b/tofu/kubernetes/providers.tf
@@ -2,11 +2,11 @@ terraform {
   required_providers {
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "2.35.1"
+      version = "2.36.0"
     }
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.70.1"
+      version = "0.73.2"
     }
     talos = {
       source  = "siderolabs/talos"
diff --git a/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml b/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
index 3db7b48..79d66bc 100644
--- a/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
+++ b/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
@@ -75,7 +75,7 @@ spec:
         command:
           - cilium
           - install
-          - --version=v1.17.0 # renovate: github-releases=cilium/cilium
+          - --version=v1.17.2 # renovate: github-releases=cilium/cilium
           - --set
           - kubeProxyReplacement=true
           - --values