diff --git a/.ci/version-lock b/.ci/version-lock
index 7e984de99..4d9bf81be 100644
--- a/.ci/version-lock
+++ b/.ci/version-lock
@@ -1,22 +1,22 @@
 # Core Version
-argocd_version=5.51.1
-sealed_secrets_version=2.13.2
-kubevirt_version=v1.1.0
-coredns_version=1.11.1
+argocd_version=7.7.3
+sealed_secrets_version=2.16.2
+kubevirt_version=v1.4.0
+coredns_version=1.11.4
 
 # Utils Version
 cfctl_version=v0.16.0+9001
-kubeseal_version=0.24.3
-helm_version=v3.13.2
-etcdctl_version=v3.5.10
+kubeseal_version=0.27.2
+helm_version=v3.16.3
+etcdctl_version=v3.5.17
 
 # Apps
-local_path_provisioner_version=v0.0.24
-kube_prometheus_stack_version=52.1.0
+local_path_provisioner_version=v0.0.30
+kube_prometheus_stack_version=66.2.1
 
 # cfctl.yaml
-k0s_version=1.28.3+k0s.0
-metallb_version=4.7.14
-traefik_version=25.0.0
-cert_manager_version=v1.13.2
-csi_driver_nfs_version=v4.5.0
+k0s_version=1.31.2+k0s.0
+metallb_version=6.3.15
+traefik_version=33.0.0
+cert_manager_version=v1.16.1
+csi_driver_nfs_version=v4.9.0
diff --git a/argo.example/local-path-storage/apps/local-path-storage-app.yaml b/argo.example/local-path-storage/apps/local-path-storage-app.yaml
index 85417ce47..4956aeeb2 100644
--- a/argo.example/local-path-storage/apps/local-path-storage-app.yaml
+++ b/argo.example/local-path-storage/apps/local-path-storage-app.yaml
@@ -9,7 +9,7 @@ spec:
   project: local-path-storage
   source:
     repoURL: https://github.com/rancher/local-path-provisioner.git
-    targetRevision: v0.0.24
+    targetRevision: v0.0.30
     path: deploy
     kustomize: {}
 
diff --git a/argo.example/monitoring/apps/prometheus-crd-app.yaml b/argo.example/monitoring/apps/prometheus-crd-app.yaml
index 8fc4ea384..0287c228e 100644
--- a/argo.example/monitoring/apps/prometheus-crd-app.yaml
+++ b/argo.example/monitoring/apps/prometheus-crd-app.yaml
@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: https://github.com/prometheus-community/helm-charts.git
     path: charts/kube-prometheus-stack/crds/
-    targetRevision: kube-prometheus-stack-52.1.0
+    targetRevision: kube-prometheus-stack-66.2.1
 
     directory:
       recurse: true
diff --git a/cfctl.yaml.example b/cfctl.yaml.example
index 5cdda4ffb..d709e026a 100644
--- a/cfctl.yaml.example
+++ b/cfctl.yaml.example
@@ -25,7 +25,7 @@ spec:
             - sh -c 'if [ "$(getenforce)" != "Permissive" ] && [ "$(getenforce)" != "Disabled" ]; then setenforce 0; fi'
 
   k0s:
-    version: '1.28.3+k0s.0'
+    version: '1.31.2+k0s.0'
     dynamicConfig: false
     config:
       apiVersion: k0s.k0sproject.io/v1beta1
diff --git a/core.example/argo-cd/install.sh b/core.example/argo-cd/install.sh
index fb96065bb..48736aecc 100755
--- a/core.example/argo-cd/install.sh
+++ b/core.example/argo-cd/install.sh
@@ -8,7 +8,7 @@ helm repo update
 helm upgrade --install \
   -n argocd \
   -f "${BASEDIR}/values.yaml" \
-  --version 5.51.1 \
+  --version 7.7.3 \
   argocd \
   argo/argo-cd \
   --create-namespace
diff --git a/core.example/cert-manager/install.sh b/core.example/cert-manager/install.sh
index abf0706b7..cdc981cb3 100755
--- a/core.example/cert-manager/install.sh
+++ b/core.example/cert-manager/install.sh
@@ -5,7 +5,7 @@ helm repo update
 
 helm upgrade --install \
   -n cert-manager \
-  --version v1.13.2 \
+  --version v1.16.1 \
   cert-manager \
   jetstack/cert-manager \
   --create-namespace \
diff --git a/core.example/coredns/base/daemonset.yaml b/core.example/coredns/base/daemonset.yaml
index 980e0a3b4..13260b24d 100644
--- a/core.example/coredns/base/daemonset.yaml
+++ b/core.example/coredns/base/daemonset.yaml
@@ -37,7 +37,7 @@ spec:
           effect: NoSchedule
       containers:
         - name: coredns
-          image: docker.io/coredns/coredns:1.11.1
+          image: docker.io/coredns/coredns:1.11.4
           imagePullPolicy: IfNotPresent
           resources:
             limits:
diff --git a/core.example/csi-driver-nfs/install.sh b/core.example/csi-driver-nfs/install.sh
index 4eb65f8d1..3d6e2cbb6 100755
--- a/core.example/csi-driver-nfs/install.sh
+++ b/core.example/csi-driver-nfs/install.sh
@@ -7,7 +7,7 @@ helm repo update
 
 helm upgrade --install \
   -n csi-driver-nfs \
-  --version v4.5.0 \
+  --version v4.9.0 \
   csi-driver-nfs \
   -f "${BASEDIR}/values.yaml" \
   csi-driver-nfs/csi-driver-nfs \
diff --git a/core.example/kubevirt/base/kustomization.yaml b/core.example/kubevirt/base/kustomization.yaml
index eecc04e27..85020a11d 100644
--- a/core.example/kubevirt/base/kustomization.yaml
+++ b/core.example/kubevirt/base/kustomization.yaml
@@ -1,3 +1,3 @@
 resources:
-  - https://github.com/kubevirt/kubevirt/releases/download/v1.1.0/kubevirt-operator.yaml
-  - https://github.com/kubevirt/kubevirt/releases/download/v1.1.0/kubevirt-cr.yaml
+  - https://github.com/kubevirt/kubevirt/releases/download/v1.4.0/kubevirt-operator.yaml
+  - https://github.com/kubevirt/kubevirt/releases/download/v1.4.0/kubevirt-cr.yaml
diff --git a/core.example/metallb/install.sh b/core.example/metallb/install.sh
index 6829310b8..8ca123b3e 100755
--- a/core.example/metallb/install.sh
+++ b/core.example/metallb/install.sh
@@ -9,6 +9,6 @@ helm upgrade --install \
   -n metallb \
   metallb \
   -f "${BASEDIR}/values.yaml" \
-  --version 4.7.14 \
+  --version 6.3.15 \
   bitnami/metallb \
   --create-namespace
diff --git a/core.example/sealed-secrets/install.sh b/core.example/sealed-secrets/install.sh
index a3599a528..c840b5614 100755
--- a/core.example/sealed-secrets/install.sh
+++ b/core.example/sealed-secrets/install.sh
@@ -5,7 +5,7 @@ helm repo update
 
 helm upgrade --install \
   -n sealed-secrets \
-  --version 2.13.2 \
+  --version 2.16.2 \
   sealed-secrets \
   sealed-secrets/sealed-secrets \
   --create-namespace
diff --git a/core.example/traefik/install.sh b/core.example/traefik/install.sh
index 4932f6d9d..50b934051 100755
--- a/core.example/traefik/install.sh
+++ b/core.example/traefik/install.sh
@@ -8,7 +8,7 @@ helm repo update
 kubectl apply --server-side --force-conflicts -k https://github.com/traefik/traefik-helm-chart/traefik/crds/
 helm upgrade --install \
   -n traefik \
-  --version 25.0.0 \
+  --version 33.0.0 \
   traefik \
   -f "${BASEDIR}/values.yaml" \
   traefik/traefik \
diff --git a/helm-subcharts/kube-prometheus-stack/Chart.yaml b/helm-subcharts/kube-prometheus-stack/Chart.yaml
index bcffc54e2..ad100b245 100644
--- a/helm-subcharts/kube-prometheus-stack/Chart.yaml
+++ b/helm-subcharts/kube-prometheus-stack/Chart.yaml
@@ -2,10 +2,10 @@ apiVersion: v2
 name: kube-prometheus-stack-subchart
 description: Kube Prometheus Stack subchart
 type: application
-version: 52.1.0
+version: 66.2.1
 appVersion: '36.2.1'
 
 dependencies:
   - name: kube-prometheus-stack
-    version: 52.1.0
+    version: 66.2.1
     repository: https://prometheus-community.github.io/helm-charts
diff --git a/scripts/setup-env b/scripts/setup-env
index 67c998d6e..c56b021fa 100755
--- a/scripts/setup-env
+++ b/scripts/setup-env
@@ -70,7 +70,7 @@ export KUBECTL
 
 KUBESEAL="$(command -v kubeseal)"
 if ! [ -x "$KUBESEAL" ]; then
-  KUBESEAL_VERSION=0.24.3
+  KUBESEAL_VERSION=0.27.2
   echo "kubeseal could not be found. Downloading it locally in ./bin."
   rm -f ./bin/kubeseal
   curl -fsSL "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-${os}-${architecture}.tar.gz" | tar -zxvf - kubeseal
@@ -84,7 +84,7 @@ export KUBESEAL
 
 HELM="$(command -v helm)"
 if ! [ -x "$HELM" ]; then
-  HELM_VERSION=v3.13.2
+  HELM_VERSION=v3.16.3
   echo "helm could not be found. Downloading it locally in ./bin."
   rm -f ./bin/helm
   curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-${os}-${architecture}.tar.gz" | tar -zxvf - "${os}-${architecture}/helm"
@@ -100,7 +100,7 @@ export HELM
 
 ETCDCTL="$(command -v etcdctl)"
 if ! [ -x "$ETCDCTL" ]; then
-  ETCDCTL_VERSION=v3.5.10
+  ETCDCTL_VERSION=v3.5.17
   GOOGLE_URL=https://storage.googleapis.com/etcd
   echo "etcdctl could not be found. Downloading it locally in ./bin."
   rm -f ./bin/etcdctl
diff --git a/web/docs/getting-started/03-k0s-configuration.md b/web/docs/getting-started/03-k0s-configuration.md
index ef03114da..17a7193e6 100644
--- a/web/docs/getting-started/03-k0s-configuration.md
+++ b/web/docs/getting-started/03-k0s-configuration.md
@@ -62,7 +62,7 @@ After you set the `hosts` field, you must configure the k0s architecture by edit
 
 ```yaml title="cfctl.yaml > spec > k0s"
 k0s:
-  version: '1.28.3+k0s.0'
+  version: '1.31.2+k0s.0'
   dynamicConfig: false
   config:
     apiVersion: k0s.k0sproject.io/v1beta1
diff --git a/web/docs/reference/cfctl.yaml.md b/web/docs/reference/cfctl.yaml.md
index f79268b1e..25029135c 100644
--- a/web/docs/reference/cfctl.yaml.md
+++ b/web/docs/reference/cfctl.yaml.md
@@ -33,7 +33,7 @@ spec:
             - sh -c 'if [ "$(getenforce)" != "Permissive" ] && [ "$(getenforce)" != "Disabled" ]; then setenforce 0; fi'
 
   k0s:
-    version: '1.28.3+k0s.0'
+    version: '1.31.2+k0s.0'
     dynamicConfig: false
     config:
       apiVersion: k0s.k0sproject.io/v1beta1