diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index bafd5d4856..c3c6765b58 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -32,7 +32,7 @@ jobs:
     - run: terraform fmt -check -recursive -diff
     - run: ./lint.sh
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:afad17b9d533bba348407f9022d5a6c27ebcd3af7e516039191d3c901b0b899c
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:1a737d9eb2b1888f598de998605b6c040ff03aa44657c071511887dd94a657b5
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -129,7 +129,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2254eb602afdae52ee83218658b847464c3c95a48948d4921e2d746ce8e00d87
 
     - name: Configure imagetest provider
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 096a9214f0..c8c3ff1696 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -107,7 +107,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2254eb602afdae52ee83218658b847464c3c95a48948d4921e2d746ce8e00d87
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
diff --git a/Makefile b/Makefile
index 5013e29350..365d4d4dcb 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ init:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5 
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:2254eb602afdae52ee83218658b847464c3c95a48948d4921e2d746ce8e00d87 
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist