diff --git a/k8s/apps/media/jellyfin/deployment.yaml b/k8s/apps/media/jellyfin/deployment.yaml
index 1e715bed..ffca41bb 100644
--- a/k8s/apps/media/jellyfin/deployment.yaml
+++ b/k8s/apps/media/jellyfin/deployment.yaml
@@ -25,7 +25,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jellyfin
-          image: ghcr.io/jellyfin/jellyfin:10.10.1 # renovate: docker=ghcr.io/jellyfin/jellyfin
+          image: ghcr.io/jellyfin/jellyfin:10.10.2 # renovate: docker=ghcr.io/jellyfin/jellyfin
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/apps/media/plex/deployment.yaml b/k8s/apps/media/plex/deployment.yaml
index 6a955003..f79b0a99 100644
--- a/k8s/apps/media/plex/deployment.yaml
+++ b/k8s/apps/media/plex/deployment.yaml
@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: plex
-          image: ghcr.io/onedr0p/plex:1.41.1.9057-af5eaea7a # renovate: docker=ghcr.io/onedr0p/plex versioning=loose
+          image: ghcr.io/onedr0p/plex:1.41.2.9200-c6bbc1b53 # renovate: docker=ghcr.io/onedr0p/plex versioning=loose
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/auth/keycloak/kustomization.yaml b/k8s/infra/auth/keycloak/kustomization.yaml
index 5c11e12e..3a0c1c5e 100644
--- a/k8s/infra/auth/keycloak/kustomization.yaml
+++ b/k8s/infra/auth/keycloak/kustomization.yaml
@@ -13,5 +13,5 @@ helmCharts:
     repo: oci://registry-1.docker.io/bitnamicharts
     releaseName: keycloak
     namespace: keycloak
-    version: 22.2.3
+    version: 24.2.0
     valuesFile: values.yaml
diff --git a/k8s/infra/auth/lldap/bootstrap.yaml b/k8s/infra/auth/lldap/bootstrap.yaml
index 13c1e480..8690178e 100644
--- a/k8s/infra/auth/lldap/bootstrap.yaml
+++ b/k8s/infra/auth/lldap/bootstrap.yaml
@@ -12,7 +12,7 @@ spec:
       restartPolicy: OnFailure
       containers:
         - name: lldap-bootstrap
-          image: ghcr.io/lldap/lldap:2024-11-04-debian-rootless # renovate: docker=ghcr.io/lldap/lldap versioning=loose
+          image: ghcr.io/lldap/lldap:2024-11-17-debian-rootless # renovate: docker=ghcr.io/lldap/lldap versioning=loose
           command: [ /app/bootstrap.sh ]
           envFrom:
             - configMapRef:
diff --git a/k8s/infra/auth/lldap/deployment.yaml b/k8s/infra/auth/lldap/deployment.yaml
index 02b5beb6..64b639a1 100644
--- a/k8s/infra/auth/lldap/deployment.yaml
+++ b/k8s/infra/auth/lldap/deployment.yaml
@@ -28,7 +28,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lldap
-          image: ghcr.io/lldap/lldap:2024-11-04-debian-rootless # renovate: docker=ghcr.io/lldap/lldap versioning=loose
+          image: ghcr.io/lldap/lldap:2024-11-17-debian-rootless # renovate: docker=ghcr.io/lldap/lldap versioning=loose
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml
index 237e79d0..5fe82a9a 100644
--- a/k8s/infra/controllers/argocd/kustomization.yaml
+++ b/k8s/infra/controllers/argocd/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 7.7.0
+    version: 7.7.3
     releaseName: "argocd"
     namespace: argocd
     valuesFile: values.yaml
diff --git a/k8s/infra/controllers/sealed-secrets/kustomization.yaml b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
index 12eba68b..c42d67cd 100644
--- a/k8s/infra/controllers/sealed-secrets/kustomization.yaml
+++ b/k8s/infra/controllers/sealed-secrets/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: sealed-secrets
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 2.4.9
+    version: 2.4.11
     releaseName: sealed-secrets-controller
     namespace: sealed-secrets
     includeCRDs: true
diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
index 0f1b1490..d12b0a55 100644
--- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml
+++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
@@ -17,7 +17,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: netbird
-          image: docker.io/netbirdio/netbird:0.31.0 # renovate: docker=docker.io/netbirdio/netbird
+          image: docker.io/netbirdio/netbird:0.32.0 # renovate: docker=docker.io/netbirdio/netbird
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/k8s/infra/vpn/netbird/backend/values.yaml b/k8s/infra/vpn/netbird/backend/values.yaml
index e05e83a7..16441f41 100644
--- a/k8s/infra/vpn/netbird/backend/values.yaml
+++ b/k8s/infra/vpn/netbird/backend/values.yaml
@@ -23,7 +23,7 @@ idp:
 
 management:
   image:
-    tag: 0.31.0 # renovate: docker=docker.io/netbirdio/management
+    tag: 0.32.0 # renovate: docker=docker.io/netbirdio/management
   nodeSelector:
     topology.kubernetes.io/zone: abel
   ingress:
@@ -31,7 +31,7 @@ management:
 
 signal:
   image:
-    tag: 0.31.0 # renovate: docker=docker.io/netbirdio/signal
+    tag: 0.32.0 # renovate: docker=docker.io/netbirdio/signal
   nodeSelector:
     topology.kubernetes.io/zone: abel
   uri: netbird.stonegarden.dev:443
diff --git a/tofu/kubernetes/main.tf b/tofu/kubernetes/main.tf
index be92b8c3..ea88cc84 100644
--- a/tofu/kubernetes/main.tf
+++ b/tofu/kubernetes/main.tf
@@ -7,7 +7,7 @@ module "talos" {
 
   image = {
     version = "v1.8.1"
-    update_version = "v1.8.2" # renovate: github-releases=siderolabs/talos
+    update_version = "v1.8.3" # renovate: github-releases=siderolabs/talos
     schematic = file("${path.module}/talos/image/schematic.yaml")
   }