diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index 4f5e6f6fc6..e57d519d18 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -40,7 +40,7 @@ jobs:
     - run: make init # Initialize modules.
     - run: terraform fmt -check -recursive -diff
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:afad17b9d533bba348407f9022d5a6c27ebcd3af7e516039191d3c901b0b899c
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:9a03c0223af7bf51ee8d9162d65f43532c1fde7a5a80e87836bbc8a2a6c8867d
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -137,7 +137,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:4374b77c33e5ade7253d1874395726fd92b7d1025b78a5e775212b99f31d17b0
 
     - name: Configure imagetest provider
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4cf096b2b5..dec14f43af 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -107,7 +107,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@538d1927b846546b620784754c33e2a1db86e217 # main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:4374b77c33e5ade7253d1874395726fd92b7d1025b78a5e775212b99f31d17b0
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
diff --git a/Makefile b/Makefile
index 480966ba59..0de09effa4 100644
--- a/Makefile
+++ b/Makefile
@@ -51,7 +51,7 @@ init-upgrade:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:2cce22ae3d776f2b924de7735bb10647320b1563dbca4ab1082a1eedae3b81c5
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:4374b77c33e5ade7253d1874395726fd92b7d1025b78a5e775212b99f31d17b0
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist