diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index b99eb9c219..60bc24ece7 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -32,7 +32,7 @@ jobs:
     - run: terraform fmt -check -recursive -diff
     - run: ./lint.sh
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:afad17b9d533bba348407f9022d5a6c27ebcd3af7e516039191d3c901b0b899c
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:01efb387bf8ffea70ba031e409fbe3ec625484605f87e36b91e8e40f62791ef5
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -129,7 +129,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:53ebb99f6ccc688ae69e1557bf31f451e1543f54f91534058af9da419c9b3395
 
     - name: Configure imagetest provider
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0537031bdc..6adb32ed17 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -107,7 +107,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:53ebb99f6ccc688ae69e1557bf31f451e1543f54f91534058af9da419c9b3395
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
diff --git a/Makefile b/Makefile
index 5013e29350..a7c4369abe 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ init:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5 
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:53ebb99f6ccc688ae69e1557bf31f451e1543f54f91534058af9da419c9b3395 
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist