diff --git a/k8s/apps/media/arr/lidarr/deployment.yaml b/k8s/apps/media/arr/lidarr/deployment.yaml
index 62c6ed5..0e332f1 100644
--- a/k8s/apps/media/arr/lidarr/deployment.yaml
+++ b/k8s/apps/media/arr/lidarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lidarr
-          image: ghcr.io/home-operations/lidarr:2.11.1 # renovate: docker=ghcr.io/home-operations/lidarr
+          image: ghcr.io/home-operations/lidarr:2.12.1 # renovate: docker=ghcr.io/home-operations/lidarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/arr/prowlarr/deployment.yaml b/k8s/apps/media/arr/prowlarr/deployment.yaml
index 647d6b9..1f75111 100644
--- a/k8s/apps/media/arr/prowlarr/deployment.yaml
+++ b/k8s/apps/media/arr/prowlarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: prowlarr
-          image: ghcr.io/home-operations/prowlarr:1.34.0 # renovate: docker=ghcr.io/home-operations/prowlarr
+          image: ghcr.io/home-operations/prowlarr:1.37.0 # renovate: docker=ghcr.io/home-operations/prowlarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/arr/radarr/deployment.yaml b/k8s/apps/media/arr/radarr/deployment.yaml
index 82e36b6..01989ad 100644
--- a/k8s/apps/media/arr/radarr/deployment.yaml
+++ b/k8s/apps/media/arr/radarr/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: radarr
-          image: ghcr.io/home-operations/radarr:5.22.2 # renovate: docker=ghcr.io/home-operations/radarr
+          image: ghcr.io/home-operations/radarr:5.26.1 # renovate: docker=ghcr.io/home-operations/radarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/audiobookshelf/deployment.yaml b/k8s/apps/media/audiobookshelf/deployment.yaml
index f2dc622..1f65087 100644
--- a/k8s/apps/media/audiobookshelf/deployment.yaml
+++ b/k8s/apps/media/audiobookshelf/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.21.0 # renovate: docker=ghcr.io/advplyr/audiobookshelf
+          image: ghcr.io/advplyr/audiobookshelf:2.24.0 # renovate: docker=ghcr.io/advplyr/audiobookshelf
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/plex/deployment.yaml b/k8s/apps/media/plex/deployment.yaml
index 505a9ba..52df3a5 100644
--- a/k8s/apps/media/plex/deployment.yaml
+++ b/k8s/apps/media/plex/deployment.yaml
@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: plex
-          image: ghcr.io/home-operations/plex:1.41.6.9685 # renovate: docker=ghcr.io/home-operations/plex versioning=loose
+          image: ghcr.io/home-operations/plex:1.41.7.9823 # renovate: docker=ghcr.io/home-operations/plex versioning=loose
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/utils/torrent/deployment.yaml b/k8s/apps/utils/torrent/deployment.yaml
index fb8adb5..bf78c44 100644
--- a/k8s/apps/utils/torrent/deployment.yaml
+++ b/k8s/apps/utils/torrent/deployment.yaml
@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: git-sync-vuetorrent
-          image: registry.k8s.io/git-sync/git-sync:v4.4.0 # renovate: docker=registry.k8s.io/git-sync/git-sync
+          image: registry.k8s.io/git-sync/git-sync:v4.4.1 # renovate: docker=registry.k8s.io/git-sync/git-sync
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -57,7 +57,7 @@ spec:
             - name: tmp
               mountPath: /tmp
         - name: torrent
-          image: ghcr.io/home-operations/qbittorrent:5.0.4 # renovate: docker=ghcr.io/home-operations/qbittorrent
+          image: ghcr.io/home-operations/qbittorrent:5.1.0 # renovate: docker=ghcr.io/home-operations/qbittorrent
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/auth/authelia/kustomization.yaml b/k8s/infra/auth/authelia/kustomization.yaml
index 8cd889d..197e2f9 100644
--- a/k8s/infra/auth/authelia/kustomization.yaml
+++ b/k8s/infra/auth/authelia/kustomization.yaml
@@ -20,7 +20,7 @@ helmCharts:
     repo: https://charts.authelia.com
     releaseName: authelia
     namespace: authelia
-    version: 0.10.5
+    version: 0.10.11
     valuesFile: values.yaml
 
 patches:
diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml
index 4b01c5d..6cb2f3b 100644
--- a/k8s/infra/auth/authelia/values.yaml
+++ b/k8s/infra/auth/authelia/values.yaml
@@ -2,7 +2,7 @@
 image:
   registry: ghcr.io
   repository: authelia/authelia
-  tag: 4.39.1 # renovate: docker=ghcr.io/authelia/authelia
+  tag: 4.39.4 # renovate: docker=ghcr.io/authelia/authelia
   pullPolicy: IfNotPresent
 
 pod:
diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml
index 57c35c3..4116555 100644
--- a/k8s/infra/controllers/argocd/kustomization.yaml
+++ b/k8s/infra/controllers/argocd/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 7.8.26
+    version: 8.0.15
     releaseName: "argocd"
     namespace: argocd
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/cert-manager/kustomization.yaml b/k8s/infra/controllers/cert-manager/kustomization.yaml
index c732ec1..4039e13 100644
--- a/k8s/infra/controllers/cert-manager/kustomization.yaml
+++ b/k8s/infra/controllers/cert-manager/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://charts.jetstack.io
-    version: v1.17.1 # renovate: github-releases=cert-manager/cert-manager
+    version: v1.17.2 # renovate: github-releases=cert-manager/cert-manager
     releaseName: cert-manager
     namespace: cert-manager
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/intel-device-plugins/gpu/kustomization.yaml b/k8s/infra/controllers/intel-device-plugins/gpu/kustomization.yaml
index 42d3adf..20c63bf 100644
--- a/k8s/infra/controllers/intel-device-plugins/gpu/kustomization.yaml
+++ b/k8s/infra/controllers/intel-device-plugins/gpu/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: intel-device-plugins-gpu
     repo: https://intel.github.io/helm-charts/
-    version: 0.32.0
+    version: 0.32.1
     namespace: intel-device-plugins
     releaseName: intel-device-plugins-gpu
     includeCRDs: true
diff --git a/k8s/infra/controllers/intel-device-plugins/gpu/values.yaml b/k8s/infra/controllers/intel-device-plugins/gpu/values.yaml
index f4ca262..4379e1b 100644
--- a/k8s/infra/controllers/intel-device-plugins/gpu/values.yaml
+++ b/k8s/infra/controllers/intel-device-plugins/gpu/values.yaml
@@ -3,4 +3,4 @@ sharedDevNum: 5
 enableMonitoring: true
 nodeFeatureRule: false
 nodeSelector:
-  intel.feature.node.kubernetes.io/gpu: 'true'
\ No newline at end of file
+  intel.feature.node.kubernetes.io/gpu: 'true'
diff --git a/k8s/infra/controllers/intel-device-plugins/kustomization.yaml b/k8s/infra/controllers/intel-device-plugins/kustomization.yaml
index 083797b..543d7bf 100644
--- a/k8s/infra/controllers/intel-device-plugins/kustomization.yaml
+++ b/k8s/infra/controllers/intel-device-plugins/kustomization.yaml
@@ -4,4 +4,4 @@ kind: Kustomization
 resources:
   - ns.yaml
   - operator
-  - gpu
\ No newline at end of file
+  - gpu
diff --git a/k8s/infra/controllers/intel-device-plugins/operator/kustomization.yaml b/k8s/infra/controllers/intel-device-plugins/operator/kustomization.yaml
index 1a88f50..594fee0 100644
--- a/k8s/infra/controllers/intel-device-plugins/operator/kustomization.yaml
+++ b/k8s/infra/controllers/intel-device-plugins/operator/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: intel-device-plugins-operator
     repo: https://intel.github.io/helm-charts/
-    version: 0.32.0
+    version: 0.32.1
     namespace: intel-device-plugins
     releaseName: intel-device-plugins-operator
-    includeCRDs: true
\ No newline at end of file
+    includeCRDs: true
diff --git a/k8s/infra/controllers/node-feature-discovery/kustomization.yaml b/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
index 32fcc4f..234f2cc 100644
--- a/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
+++ b/k8s/infra/controllers/node-feature-discovery/kustomization.yaml
@@ -4,13 +4,13 @@ kind: Kustomization
 resources:
   - ns.yaml
   # NFD rules for Intel HW
-  - https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=v0.32.0
+  - https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=v0.32.1
 
 # https://kubernetes-sigs.github.io/node-feature-discovery/v0.16/deployment/helm.html
 helmCharts:
   - name: node-feature-discovery
     repo: https://kubernetes-sigs.github.io/node-feature-discovery/charts
-    version: 0.17.2
+    version: 0.17.3
     releaseName: nfd
     includeCRDs: true
     namespace: node-feature-discovery
diff --git a/k8s/infra/controllers/sealed-secrets/kustomization.yaml b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
index 492b828..8fde90e 100644
--- a/k8s/infra/controllers/sealed-secrets/kustomization.yaml
+++ b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: sealed-secrets
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 2.5.9
+    version: 2.5.13
     releaseName: sealed-secrets-controller
     namespace: sealed-secrets
     includeCRDs: true
diff --git a/k8s/infra/database/cnpg/kustomization.yaml b/k8s/infra/database/cnpg/kustomization.yaml
index 7dd0404..93d3e95 100644
--- a/k8s/infra/database/cnpg/kustomization.yaml
+++ b/k8s/infra/database/cnpg/kustomization.yaml
@@ -11,5 +11,5 @@ helmCharts:
     releaseName: cnpg
     namespace: cnpg-system
     includeCRDs: true
-    version: 0.23.2
+    version: 0.24.0
     valuesFile: values.yaml
diff --git a/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml b/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
index db25a32..83477a2 100644
--- a/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
+++ b/k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml
@@ -10,7 +10,7 @@ spec:
   sources:
     - repoURL: https://prometheus-community.github.io/helm-charts
       chart: kube-prometheus-stack
-      targetRevision: 70.7.0 # renovate: docker=ghcr.io/prometheus-community/charts/kube-prometheus-stack
+      targetRevision: 73.2.0 # renovate: docker=ghcr.io/prometheus-community/charts/kube-prometheus-stack
       helm:
         valueFiles:
           - $values/k8s/infra/monitoring/prometheus-stack/values.yaml
diff --git a/k8s/infra/network/cilium/kustomization.yaml b/k8s/infra/network/cilium/kustomization.yaml
index d001039..64fca5d 100644
--- a/k8s/infra/network/cilium/kustomization.yaml
+++ b/k8s/infra/network/cilium/kustomization.yaml
@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io
-    version: 1.17.3 # renovate: github-releases=cilium/cilium
+    version: 1.17.4 # renovate: github-releases=cilium/cilium
     releaseName: "cilium"
     includeCRDs: true
     namespace: kube-system
diff --git a/k8s/infra/network/cloudflared/daemon-set.yaml b/k8s/infra/network/cloudflared/daemon-set.yaml
index fa1d73e..34de931 100644
--- a/k8s/infra/network/cloudflared/daemon-set.yaml
+++ b/k8s/infra/network/cloudflared/daemon-set.yaml
@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2025.4.0 # renovate: docker=cloudflare/cloudflared
+          image: cloudflare/cloudflared:2025.5.0 # renovate: docker=cloudflare/cloudflared
           imagePullPolicy: IfNotPresent
           args:
             - tunnel
diff --git a/k8s/infra/network/dns/adguard/deployment.yaml b/k8s/infra/network/dns/adguard/deployment.yaml
index 03dc72f..8d7c1c3 100644
--- a/k8s/infra/network/dns/adguard/deployment.yaml
+++ b/k8s/infra/network/dns/adguard/deployment.yaml
@@ -49,7 +49,7 @@ spec:
               mountPath: /opt/adguardhome/conf
       containers:
         - name: adguard
-          image: docker.io/adguard/adguardhome:v0.107.60 # renovate: docker=docker.io/adguard/adguardhome
+          image: docker.io/adguard/adguardhome:v0.107.62 # renovate: docker=docker.io/adguard/adguardhome
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/storage/proxmox-csi/kustomization.yaml b/k8s/infra/storage/proxmox-csi/kustomization.yaml
index c083921..cfe1cd1 100644
--- a/k8s/infra/storage/proxmox-csi/kustomization.yaml
+++ b/k8s/infra/storage/proxmox-csi/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: proxmox-csi-plugin
     repo: oci://ghcr.io/sergelogvinov/charts
-    version: 0.3.5
+    version: 0.3.7
     releaseName: proxmox-csi-plugin
     includeCRDs: true
     namespace: csi-proxmox
diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
index 2a4d39c..2b02252 100644
--- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml
+++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
@@ -22,7 +22,7 @@ spec:
             value: "1"
       containers:
         - name: agent
-          image: docker.io/netbirdio/netbird:0.41.3 # renovate: docker=docker.io/netbirdio/netbird
+          image: docker.io/netbirdio/netbird:0.46.0 # renovate: docker=docker.io/netbirdio/netbird
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
diff --git a/k8s/infra/vpn/netbird/dashboard/deployment.yaml b/k8s/infra/vpn/netbird/dashboard/deployment.yaml
index ba58a1b..394974f 100644
--- a/k8s/infra/vpn/netbird/dashboard/deployment.yaml
+++ b/k8s/infra/vpn/netbird/dashboard/deployment.yaml
@@ -17,7 +17,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: dashboard
-          image: docker.io/netbirdio/dashboard:v2.10.0 # renovate: docker=docker.io/netbirdio/dashboard
+          image: docker.io/netbirdio/dashboard:v2.13.1 # renovate: docker=docker.io/netbirdio/dashboard
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
diff --git a/k8s/infra/vpn/netbird/management/deployment.yaml b/k8s/infra/vpn/netbird/management/deployment.yaml
index c946fa2..08561be 100644
--- a/k8s/infra/vpn/netbird/management/deployment.yaml
+++ b/k8s/infra/vpn/netbird/management/deployment.yaml
@@ -58,7 +58,7 @@ spec:
               mountPath: /tmp/netbird
       containers:
         - name: management
-          image: docker.io/netbirdio/management:0.41.3 # renovate: docker=docker.io/netbirdio/management
+          image: docker.io/netbirdio/management:0.46.0 # renovate: docker=docker.io/netbirdio/management
           args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console, --idp-sign-key-refresh-enabled ]
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/k8s/infra/vpn/netbird/relay/deployment.yaml b/k8s/infra/vpn/netbird/relay/deployment.yaml
index e220e4f..4682f19 100644
--- a/k8s/infra/vpn/netbird/relay/deployment.yaml
+++ b/k8s/infra/vpn/netbird/relay/deployment.yaml
@@ -16,7 +16,7 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       containers:
-        - image: docker.io/netbirdio/relay:0.41.3 # renovate: docker=docker.io/netbirdio/relay
+        - image: docker.io/netbirdio/relay:0.46.0 # renovate: docker=docker.io/netbirdio/relay
           imagePullPolicy: IfNotPresent
           name: relay
           securityContext:
diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml
index c1ad757..4dbca6b 100644
--- a/k8s/infra/vpn/netbird/signal/deployment.yaml
+++ b/k8s/infra/vpn/netbird/signal/deployment.yaml
@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: signal
-          image: docker.io/netbirdio/signal:0.41.3 # renovate: docker=docker.io/netbirdio/signal
+          image: docker.io/netbirdio/signal:0.46.0 # renovate: docker=docker.io/netbirdio/signal
           args: [ --port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console ]
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/tofu/home-assistant/main.tofu b/tofu/home-assistant/main.tofu
index f3671c4..06bbf9c 100644
--- a/tofu/home-assistant/main.tofu
+++ b/tofu/home-assistant/main.tofu
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.76.0"
+      version = "0.78.1"
     }
   }
 }
diff --git a/tofu/kubernetes/providers.tofu b/tofu/kubernetes/providers.tofu
index cfba061..d848696 100644
--- a/tofu/kubernetes/providers.tofu
+++ b/tofu/kubernetes/providers.tofu
@@ -2,15 +2,15 @@ terraform {
   required_providers {
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "2.36.0"
+      version = "2.37.1"
     }
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.76.0"
+      version = "0.78.1"
     }
     talos = {
       source  = "siderolabs/talos"
-      version = "0.7.1"
+      version = "0.8.1"
     }
     restapi = {
       source  = "Mastercard/restapi"
diff --git a/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml b/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
index a61b599..4f97036 100644
--- a/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
+++ b/tofu/kubernetes/talos/inline-manifests/cilium-install.yaml
@@ -75,7 +75,7 @@ spec:
           command:
             - cilium
             - install
-            - --version=v1.17.3 # renovate: github-releases=cilium/cilium
+            - --version=v1.17.4 # renovate: github-releases=cilium/cilium
             - --set
             - kubeProxyReplacement=true
             - --values