diff --git a/Pkgfile b/Pkgfile
index 567ed239..8811977a 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -6,7 +6,7 @@ vars:
   TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.10.0-alpha.0-3-g0393558
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
-  cni_version: v1.6.1
+  cni_version: v1.6.2
   cni_sha256: 5e2ea69bca08bfb92921f22fa2cc1e69392ee139a5878068dfbc1c7568e37b01
   cni_sha512: 62b4e2c5c4bf6a9b21880e7b145547bec153f591926419d9960345cc7fb7d499ae44b0236928bbfeb46e383f38018d7504e58da1dd8a6ad39ef4ae3122b3be56
 
@@ -32,12 +32,12 @@ vars:
   drbd_sha512: b3d5700141d0791dd5cfa8496e3888124670029ec39800f915dcc5f292b57723cc8aecbbdad83f33a61f38e9be6dbac0b75bf9696536bcd3cb1017f48703dce6
 
   # renovate: datasource=git-tags depName=git://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git
-  e2fsprogs_version: v1.47.1
+  e2fsprogs_version: v1.47.2
   e2fsprogs_sha256: db95ff1cb6ef741c9aa8875d9f3f52a34168360febba765b6377b80bada09a8c
   e2fsprogs_sha512: 7e59746e14df9e29034693f415dc4bcbd405217712e2d9e594dcc755bbc1c9f3c4f66ba37e4289b022c337c5aae3d96561c0cd88fa21082ed1017d2a000d3b82
 
   # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=systemd/systemd
-  systemd_version: 256.8
+  systemd_version: 257.2
   systemd_sha256: b3d003b4f6d1ab0bfae0cf7a37c4aa559923c49bc8e9d1331b7459e12ebc357a
   systemd_sha512: 0cdd41274b79177705f6999194ea2698e8bccd123d983733972e0fba4ece5467eddefec419a992d1646e93adda7b811810deec163a15f2c9347473caefe2ce09
 
@@ -68,12 +68,12 @@ vars:
   iptables_sha512: 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
 
   # renovate: datasource=git-refs versioning=git depName=https://github.com/ipxe/ipxe.git
-  ipxe_ref: 83ba34076ad4ca79be81a71f25303b340c60e7b8
+  ipxe_ref: d88eb0a1935942cdeccd3efee38f9765d2f1c235
   ipxe_sha256: f2e8660d65feb099294fa80446cf2fdff509daa714a7235af9d032d6afa1f0d7
   ipxe_sha512: 6eed2537d002983ecdadcadaa976d0fad45963a8d526139ac0611be15edb04097975445b91700a2798fe19e2ed4f8d4b489973bd61955cbe757c392af034789b
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
-  linux_version: 6.12.8
+  linux_version: 6.12.9
   linux_sha256: 2291da065ca04b715c89ee50362aec3f021a7414bc963f1b56736682c8122979
   linux_sha512: 193b07ce4984d0bf3a808fc0b527650686a06432cfe3bb222c80e7a851adfe4e151335514bed44b5fb4cf18cb24f2251c5895b98e6fec84a097e2b130ff234fa
 
@@ -146,7 +146,7 @@ vars:
   liburcu_sha512: a0b543dcc6d1ace34c4f159074a439926bcec6708fde66db14022cfa6e8082d5d0430ad02dc036cc3902304357439bbacd89b3fc5f4ed9911716f2f0480af3e4
 
   # renovate: datasource=git-tags depName=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
-  linux_firmware_version: 20241210
+  linux_firmware_version: 20250109
   linux_firmware_sha256: c7b83ae05d9943ab7f09e18e3c673ea8a55402f96e3b059a7d05b88c81670b78
   linux_firmware_sha512: 75e2d7383e209c2f787a4369e171e2d9bd16dc9cc1cd74920874d1dc56a950df95981be942fd7aa95620ef18da3e50d0fd95886c1497c91c4e54f564fe381fc3
 
@@ -202,12 +202,12 @@ vars:
   socat_sha512: c0a04e697f03da35d8c630de038e837c544e4dc77dd5bfbe73198d88b2d21727d9062114c1c50925daa264178f3317bc11c5504d1358ab7b3e8bce15e3e2dff9
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
-  util_linux_version: 2.40.2
+  util_linux_version: 2.40.3
   util_linux_sha256: d78b37a66f5922d70edf3bdfb01a6b33d34ed3c3cafd6628203b2a2b67c8e8b3
   util_linux_sha512: ffe20b915a518a150401d429b0338bc7022190e4ca0ef91a6d9eea345db8c1e11ad01784163b8fcf978506f3f5cad473f29d5d4ef93a4c66a5ae0ebd9fb0c8f2
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git
-  xfsprogs_version: 6.11.0
+  xfsprogs_version: 6.12.0
   xfsprogs_sha256: dae3bb432196f7b183b2e6bd5dc44bf33edbd7d0e85bd37d25c235df81b8100a
   xfsprogs_sha512: 209b479e510e5d5c558430b523bebd90f34b2effeac46f783aad4ec45a9f39998ca1efc67155c54c22e778859968f4b275b0ca6f225603f17ae4cc5c7596a4ca
 
@@ -217,7 +217,7 @@ vars:
   zfs_sha512: 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271
 
   # renovate: datasource=git-tags depName=https://gitlab.com/apparmor/apparmor.git
-  apparmor_version: v3.1.7
+  apparmor_version: v4.0.3
   apparmor_sha256: 64494bd99fa6547a9cbdb4fc6bc732451a02dd19e6eb70eab977b239632151eb
   apparmor_sha512: cfd6b0afb98d4559c16a6a2e23ca16ee9d86325fc6059313df5d3e8feba3d398f96a5754d3880dd2cafb2e7b1a06bd789d62cd36aaf993e46290f6311bb49dac
 labels: