diff --git a/docs/modules/demos/pages/nifi-kafka-druid-earthquake-data.adoc b/docs/modules/demos/pages/nifi-kafka-druid-earthquake-data.adoc
index 8f0d495f..dff15bf5 100644
--- a/docs/modules/demos/pages/nifi-kafka-druid-earthquake-data.adoc
+++ b/docs/modules/demos/pages/nifi-kafka-druid-earthquake-data.adoc
@@ -114,7 +114,7 @@ You can execute a command on the Kafka broker to list the available topics as fo
 // However, the kcat-prober container has TLS certificates mounted, which can be used by kcat to connect to Kafka.
 [source,console]
 ----
-$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls_cert_server_mount/tls.key -X ssl.certificate.location=/stackable/tls_cert_server_mount/tls.crt -X ssl.ca.location=/stackable/tls_cert_server_mount/ca.crt -L"
+$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls-kcat/tls.key -X ssl.certificate.location=/stackable/tls-kcat/tls.crt -X ssl.ca.location=/stackable/tls-kcat/ca.crt -L"
 Metadata for all topics (from broker -1: ssl://localhost:9093/bootstrap):
  1 brokers:
   broker 1001 at 172.18.0.2:32175 (controller)
@@ -136,7 +136,7 @@ parameter.
 
 [source,console]
 ----
-$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls_cert_server_mount/tls.key -X ssl.certificate.location=/stackable/tls_cert_server_mount/tls.crt -X ssl.ca.location=/stackable/tls_cert_server_mount/ca.crt -C -t earthquakes -c 1"
+$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls-kcat/tls.key -X ssl.certificate.location=/stackable/tls-kcat/tls.crt -X ssl.ca.location=/stackable/tls-kcat/ca.crt -C -t earthquakes -c 1"
 ----
 
 Below is an example of the output of one record:
@@ -175,7 +175,7 @@ The given pattern will print some metadata of the record.
 
 [source,console]
 ----
-$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls_cert_server_mount/tls.key -X ssl.certificate.location=/stackable/tls_cert_server_mount/tls.crt -X ssl.ca.location=/stackable/tls_cert_server_mount/ca.crt -C -t earthquakes -o -8 -c 8 -f 'Topic %t / Partition %p / Offset: %o / Timestamp: %T\n'"
+$ kubectl exec -it kafka-broker-default-0 -c kcat-prober -- /bin/bash -c "/stackable/kcat -b localhost:9093 -X security.protocol=SSL -X ssl.key.location=/stackable/tls-kcat/tls.key -X ssl.certificate.location=/stackable/tls-kcat/tls.crt -X ssl.ca.location=/stackable/tls-kcat/ca.crt -C -t earthquakes -o -8 -c 8 -f 'Topic %t / Partition %p / Offset: %o / Timestamp: %T\n'"
 Topic earthquakes / Partition 0 / Offset: 385011 / Timestamp: 1680607795568
 Topic earthquakes / Partition 0 / Offset: 385012 / Timestamp: 1680607795568
 Topic earthquakes / Partition 0 / Offset: 385013 / Timestamp: 1680607795570
diff --git a/stacks/airflow/airflow.yaml b/stacks/airflow/airflow.yaml
index d382de3c..550d038b 100644
--- a/stacks/airflow/airflow.yaml
+++ b/stacks/airflow/airflow.yaml
@@ -142,7 +142,9 @@ data:
 
     class SparkKubernetesSensor(BaseSensorOperator):
         template_fields = ("application_name", "namespace")
-        FAILURE_STATES = ("Failed", "Unknown")
+        # See https://github.com/stackabletech/spark-k8s-operator/pull/460/files#diff-d737837121132af6b60f50279a78464b05dcfd06c05d1d090f4198a5e962b5f6R371
+        # Unknown is set immediately so it must be excluded from the failed states.
+        FAILURE_STATES = ("Failed")
         SUCCESS_STATES = ("Succeeded")
 
         def __init__(
diff --git a/stacks/end-to-end-security/superset.yaml b/stacks/end-to-end-security/superset.yaml
index 9226aa10..4b213faa 100644
--- a/stacks/end-to-end-security/superset.yaml
+++ b/stacks/end-to-end-security/superset.yaml
@@ -5,7 +5,7 @@ metadata:
   name: superset
 spec:
   image:
-    productVersion: 3.1.3
+    productVersion: 4.0.2
   clusterConfig:
     listenerClass: external-unstable
     credentialsSecret: superset-credentials
@@ -24,38 +24,38 @@ spec:
         # We need to restore the postgres state before the superset container itself starts some database migrations
         initContainers:
         # The postgres image does not contain curl or wget...
-        - name: download-dump
-          image: docker.stackable.tech/stackable/testing-tools:0.1.0-stackable0.1.0
-          command:
-            - bash
-            - -c
-            - |
-              cd /tmp
-              curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/postgres_superset_dump.sql.gz
-              gunzip postgres_superset_dump.sql.gz
+          - name: download-dump
+            image: docker.stackable.tech/stackable/testing-tools:0.2.0-stackable24.7.0
+            command:
+              - bash
+              - -c
+              - |
+                cd /tmp
+                curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/postgres_superset_dump.sql.gz
+                gunzip postgres_superset_dump.sql.gz
 
-              # We need to omit changing the users password, as otherwise the content in the Secrets does not match
-              # the actual password in Postgres.
-              grep -vwE '(CREATE ROLE postgres;|CREATE ROLE superset;|ALTER ROLE postgres|ALTER ROLE superset)' postgres_superset_dump.sql > /dump/postgres_superset_dump.sql
-          volumeMounts:
-            - name: dump
-              mountPath: /dump/
-        - name: restore-postgres
-          image: docker.io/bitnami/postgresql:16.1.0-debian-11-r11 # Same image as the bitnami postgres helm-chart is using
-          command:
-            - bash
-            - -c
-            - |
-              psql --host postgresql-superset --user postgres < /dump/postgres_superset_dump.sql
-          env:
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgresql-superset
-                  key: postgres-password
-          volumeMounts:
-            - name: dump
-              mountPath: /dump/
+                # We need to omit changing the users password, as otherwise the content in the Secrets does not match
+                # the actual password in Postgres.
+                grep -vwE '(CREATE ROLE postgres;|CREATE ROLE superset;|ALTER ROLE postgres|ALTER ROLE superset)' postgres_superset_dump.sql > /dump/postgres_superset_dump.sql
+            volumeMounts:
+              - name: dump
+                mountPath: /dump/
+          - name: restore-postgres
+            image: docker.io/bitnami/postgresql:16.1.0-debian-11-r11 # Same image as the bitnami postgres helm-chart is using
+            command:
+              - bash
+              - -c
+              - |
+                psql --host postgresql-superset --user postgres < /dump/postgres_superset_dump.sql
+            env:
+              - name: PGPASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: postgresql-superset
+                    key: postgres-password
+            volumeMounts:
+              - name: dump
+                mountPath: /dump/
         volumes:
           - name: dump
             emptyDir: {}
diff --git a/stacks/keycloak-opa-poc/superset.yaml b/stacks/keycloak-opa-poc/superset.yaml
index a9ac38d0..fb94a18c 100644
--- a/stacks/keycloak-opa-poc/superset.yaml
+++ b/stacks/keycloak-opa-poc/superset.yaml
@@ -19,7 +19,7 @@ metadata:
   name: superset
 spec:
   image:
-    productVersion: 3.0.1
+    productVersion: 4.0.2
   clusterConfig:
     credentialsSecret: superset-credentials
     listenerClass: external-unstable