diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index f6d1bd69ea..08baa00ef3 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -28,7 +28,7 @@ jobs:
     - run: terraform fmt -check -recursive -diff
     - run: ./lint.sh
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:4a467536971f7766d3319358e75ddeeebce2dcc776583acbd10e58e75d9cf423
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:c62f679ba214ed19732bfd19a905e84fc5ee522fda5d4faf9f9c2c2788eb5c1a
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -116,7 +116,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:cb07f771be251367d407175bd6217001ecf1b1d3ce831d1e1a1f28e3cc39025b
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:c1b42df6bf9ea871f187ee371a93cf096b9277e248d7d7e68aa2ab1873d4f2ef
 
     - name: Configure imagetest provider
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ed173add4d..923c20f716 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -100,7 +100,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:cb07f771be251367d407175bd6217001ecf1b1d3ce831d1e1a1f28e3cc39025b
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:c1b42df6bf9ea871f187ee371a93cf096b9277e248d7d7e68aa2ab1873d4f2ef
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
diff --git a/Makefile b/Makefile
index 05143e5c36..bc4a74ce2a 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ init:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:cb07f771be251367d407175bd6217001ecf1b1d3ce831d1e1a1f28e3cc39025b 
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:c1b42df6bf9ea871f187ee371a93cf096b9277e248d7d7e68aa2ab1873d4f2ef 
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist