diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0a2b09bc..41713a60 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,7 +34,7 @@ jobs:
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
@@ -54,7 +54,7 @@ jobs:
           make nonfree
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
@@ -87,7 +87,7 @@ jobs:
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
diff --git a/Makefile b/Makefile
index ae033515..27717171 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ REGISTRY_AND_USERNAME := $(REGISTRY)/$(USERNAME)
 SOURCE_DATE_EPOCH ?= "1559424892"
 
 # Sync bldr image with Pkgfile
-BLDR_IMAGE := ghcr.io/siderolabs/bldr:v0.2.2
+BLDR_IMAGE := ghcr.io/siderolabs/bldr:v0.2.3
 BLDR ?= docker run --rm --volume $(PWD):/tools --entrypoint=/bldr \
 	$(BLDR_IMAGE) graph --root=/tools
 
diff --git a/Pkgfile b/Pkgfile
index cf675e3b..d194ba7e 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -1,9 +1,9 @@
-# syntax = ghcr.io/siderolabs/bldr:v0.2.2
+# syntax = ghcr.io/siderolabs/bldr:v0.2.3
 
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.6.0-alpha.0-5-g9c09b00
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.6.0-alpha.0-9-g024ef25
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
   cni_version: v1.3.0
@@ -11,10 +11,10 @@ vars:
   cni_sha512: 87e186b3cd64f66280f5b2293dcdd1fc22cb8f51a248124fb622adc48a893348419ba4c29c4769dede4d9e60f2e9fea5d4198f10badb4ecd20a1551e0b344e10
 
   # renovate: datasource=github-tags depName=containerd/containerd
-  containerd_version: v1.7.7
-  containerd_ref: 8c087663b0233f6e6e2f4515cee61d49f14746a8
-  containerd_sha256: 4c6042b13746a803766d76b07f756d03678a33a944b52c0b832c238609db1b2e
-  containerd_sha512: a44e901b017522639963bb415f666599af04335d8ccbd28899712606a4692c1601e95eaa2f1db32a3c077ad2c3f332f37393154ad6c2660646b7e8365a6ab720
+  containerd_version: v1.7.8
+  containerd_ref: 8e4b0bde866788eec76735cc77c4720144248fb7
+  containerd_sha256: 891b84e614b491ab1d3bd5c8f4fb119e4929c24762e149e83e181e72d687f706
+  containerd_sha512: 29c317b53f1e0eb48f45da47161aad9e97a9e7c5ff6ca2fc0d1233b9e6dcf7c8cd7f866502df80119447e6b889c8ce26257282c7d1948e05e22e1a5afeed1d03
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git
   cryptsetup_version: 2.6.1
@@ -63,14 +63,14 @@ vars:
   iptables_sha512: 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153
 
   # renovate: datasource=git-refs versioning=git depName=https://github.com/ipxe/ipxe.git
-  ipxe_ref: ff0f860483e344f1af633f94696ff7bc1854611f
-  ipxe_sha256: e84f0b137773aff4e8899c5e8bd91b1f845b3132625924434402334d399c8a95
-  ipxe_sha512: f89069346021f81e49155cd8e4485be641562b121f8e2827381391abeca6ebf517eb2d22223a316ac7024cdcd0fe1b763349f3407adb19fd8649f6a025b825b3
+  ipxe_ref: 115707c0edebad65f87525fed583fef73880016d
+  ipxe_sha256: 300f810b19aaa223c90be24c5eb3a755e0de658c65424c251d3ea468762f20d8
+  ipxe_sha512: 865d4ab5b7eb3435dcf291e8da046dda5a63ffe9ec35e4ea9cc83c469434c1cd0cf9818e2bb532856494637bfefcd1b017180d17edf7316866d6cd11232f9707
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
-  linux_version: 6.1.58
-  linux_sha256: ce987ed3d2f640b3a2a62a0a8573d538a36dfd3cc31e2d7a239ce5a16c1c21ad
-  linux_sha512: bbf1e0a41d10ec23485bf99d239dd08f2914660fc8ae6858ca01cea8689d9a3ccbb5e9dfae6d5b8283485055f9b1aaf35f98ff3ef80599a654885b317527121a
+  linux_version: 6.1.60
+  linux_sha256: 58520e7ae5a6af254ddf7ddbfc42e4373b0d36c67d467f6e35a3bd1672f5fb0a
+  linux_sha512: cef40235428a09e5f7807a8be83af9a5ab90e841049a04f9f851e69e602aeab5a50f523cae5d5928d345c11b728608eba7754b173be0c023c7ee564cfaf4b20a
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git
   kmod_version: 31
@@ -113,9 +113,9 @@ vars:
   liburcu_sha512: 7297e51012f4c44ee27c0e18ed9d87bf24be34db68a5398394c1e683a045bb561cf74aa913398404c0ed5cb8011af728ea12947717fa5f27627e5ca78e63a40f
 
   # renovate: datasource=git-tags depName=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
-  linux_firmware_version: 20230919
-  linux_firmware_sha256: 1dac602218f83f2c81dd72e599ae6c926901b3d36babccce46cd84293a37e473
-  linux_firmware_sha512: ad43c233006560f226ecf8d5693506a55573fb00b062103538245cac276168dc130ca4b96ed0372796813c3c48c2be9cd6ba614381f72e79b062cd3ae51da285
+  linux_firmware_version: 20231030
+  linux_firmware_sha256: 833483257dd3388de2018617c779faaa17139c0a17286b1c513cb569d2122fc4
+  linux_firmware_sha512: 843a69b93b1e12a50964c7ca5d6fbca21697e40e93f5969f865768b51d11bd0f63763a0b166b73c1a0eda2b16ea2842a3e3b08470000ac65d66cf21a1a8f6ec1
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://sourceware.org/git/lvm2.git
   lvm2_version: 2_03_22
@@ -137,9 +137,9 @@ vars:
   nvidia_driver_sha512: 23fbaaa671f6f4bd92147c1ec0099cd006efc73297211ffba74d78310c14364de726f84e388c397716c42c854a302948f5bcf9e9bac65ae41f54d34e814cfb60
 
   # renovate: datasource=git-tags extractVersion=^openssl-(?<version>.*)$ depName=git://git.openssl.org/openssl.git
-  openssl_version: 3.1.3
-  openssl_sha256: f0316a2ebd89e7f2352976445458689f80302093788c466692fb2a188b2eacf6
-  openssl_sha512: 2388eaa8e99acf1e8af4691a645b9b9af456900c74959e82d4cb02808301e11dcfecc86954a922262b16fa4b664b459894d133ab7d35ec82e1633a33194b7b20
+  openssl_version: 3.1.4
+  openssl_sha256: 840af5366ab9b522bde525826be3ef0fb0af81c6a9ebd84caa600fea1731eee3
+  openssl_sha512: a69df4a018f57dee7d8a57c8003a6869eba11f1eaa394518976642a993780d0de3326019e92dea4c679c6c581fef568ea616ec541afc0792800359c606dffcd2
 
   # renovate: datasource=github-tags depName=raspberrypi/firmware
   raspberrypi_firmware_version: 1.20230405
diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64
index e4822427..5f96ec35 100644
--- a/kernel/build/config-amd64
+++ b/kernel/build/config-amd64
@@ -1,15 +1,15 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 6.1.58 Kernel Configuration
+# Linux/x86 6.1.60 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.3.0"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=120300
+CONFIG_GCC_VERSION=130200
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=24000
+CONFIG_AS_VERSION=24100
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=24000
+CONFIG_LD_VERSION=24100
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
index ddda21c8..a1d9c80f 100644
--- a/kernel/build/config-arm64
+++ b/kernel/build/config-arm64
@@ -1,15 +1,15 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 6.1.58 Kernel Configuration
+# Linux/arm64 6.1.60 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.3.0"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=120300
+CONFIG_GCC_VERSION=130200
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=24000
+CONFIG_AS_VERSION=24100
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=24000
+CONFIG_LD_VERSION=24100
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
@@ -290,6 +290,7 @@ CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_PGTABLE_LEVELS=4
 CONFIG_ARCH_SUPPORTS_UPROBES=y
 CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_BROKEN_GAS_INST=y
 
 #
 # Platform selection
@@ -355,7 +356,6 @@ CONFIG_ARM64_ERRATUM_834220=y
 CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_ERRATUM_845719=y
 CONFIG_ARM64_ERRATUM_843419=y
-CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
 CONFIG_ARM64_ERRATUM_1024718=y
 CONFIG_ARM64_ERRATUM_1418040=y
 CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
@@ -418,7 +418,6 @@ CONFIG_HZ=250
 CONFIG_SCHED_HRTICK=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_HW_PERF_EVENTS=y
-CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_PARAVIRT=y
 # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
 # CONFIG_KEXEC is not set
@@ -448,17 +447,12 @@ CONFIG_SETEND_EMULATION=y
 #
 CONFIG_ARM64_HW_AFDBM=y
 CONFIG_ARM64_PAN=y
-CONFIG_AS_HAS_LDAPR=y
-CONFIG_AS_HAS_LSE_ATOMICS=y
-CONFIG_ARM64_LSE_ATOMICS=y
 CONFIG_ARM64_USE_LSE_ATOMICS=y
 # end of ARMv8.1 architectural features
 
 #
 # ARMv8.2 architectural features
 #
-CONFIG_AS_HAS_ARMV8_2=y
-CONFIG_AS_HAS_SHA3=y
 CONFIG_ARM64_PMEM=y
 CONFIG_ARM64_RAS_EXTN=y
 CONFIG_ARM64_CNP=y
@@ -468,10 +462,6 @@ CONFIG_ARM64_CNP=y
 # ARMv8.3 architectural features
 #
 CONFIG_ARM64_PTR_AUTH=y
-CONFIG_ARM64_PTR_AUTH_KERNEL=y
-CONFIG_CC_HAS_BRANCH_PROT_PAC_RET=y
-CONFIG_CC_HAS_SIGN_RETURN_ADDRESS=y
-CONFIG_AS_HAS_PAC=y
 CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y
 # end of ARMv8.3 architectural features
 
@@ -479,19 +469,13 @@ CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y
 # ARMv8.4 architectural features
 #
 CONFIG_ARM64_AMU_EXTN=y
-CONFIG_AS_HAS_ARMV8_4=y
-CONFIG_ARM64_TLB_RANGE=y
 # end of ARMv8.4 architectural features
 
 #
 # ARMv8.5 architectural features
 #
-CONFIG_AS_HAS_ARMV8_5=y
 CONFIG_ARM64_BTI=y
-CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI=y
 CONFIG_ARM64_E0PD=y
-CONFIG_ARM64_AS_HAS_MTE=y
-CONFIG_ARM64_MTE=y
 # end of ARMv8.5 architectural features
 
 #
@@ -508,8 +492,6 @@ CONFIG_ARM64_PSEUDO_NMI=y
 CONFIG_RELOCATABLE=y
 CONFIG_RANDOMIZE_BASE=y
 CONFIG_RANDOMIZE_MODULE_REGION_FULL=y
-CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_STACKPROTECTOR_PER_TASK=y
 CONFIG_ARCH_NR_GPIO=0
 # end of Kernel Features
 
@@ -700,7 +682,6 @@ CONFIG_KVM=y
 CONFIG_CRASH_CORE=y
 CONFIG_KEXEC_CORE=y
 CONFIG_HAVE_IMA_KEXEC=y
-CONFIG_ARCH_HAS_SUBPAGE_FAULTS=y
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
 # CONFIG_STATIC_KEYS_SELFTEST is not set
@@ -750,8 +731,6 @@ CONFIG_HAVE_ARCH_STACKLEAK=y
 CONFIG_HAVE_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR_STRONG=y
-CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y
-# CONFIG_SHADOW_CALL_STACK is not set
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
 CONFIG_LTO_NONE=y
@@ -1050,7 +1029,6 @@ CONFIG_ARCH_HAS_ZONE_DMA_SET=y
 CONFIG_ZONE_DMA=y
 CONFIG_ZONE_DMA32=y
 CONFIG_VMAP_PFN=y
-CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
 CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_PERCPU_STATS is not set
 # CONFIG_GUP_TEST is not set
@@ -8402,10 +8380,8 @@ CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_PER_CPU_MAPS is not set
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y
-CONFIG_HAVE_ARCH_KASAN_HW_TAGS=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
-CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y