diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index fd5751a543..5dc542f407 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -40,7 +40,7 @@ jobs:
     - run: make init-upgrade # Initialize modules.
     - run: terraform fmt -check -recursive -diff
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/sdk:latest@sha256:294f01e5b23ddee9a6dd0d3569aee41e0f3ec8b2ce3ad726e6b05b1e0b493cc2
+      uses: docker://ghcr.io/wolfi-dev/sdk:latest@sha256:634eedd4e6cd139f4dcbebf46458db4e2558d0e01096cbabd6402e0a017d5ff3
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -137,7 +137,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@ba1a9c9ffe799736883d58f31caff18d85b2800e # main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:1dd18987ffa4b383cf969c20c534d4fcb667e6a0801d41917c99a2c34c192557
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:c34a5c9930d92e6aa815b213432fbc12bdc2e5f1edfb8edb1aa7b2dc919a7fe1
 
     - name: Configure imagetest provider
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d83e04e1db..b649e85bc1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -101,7 +101,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@ba1a9c9ffe799736883d58f31caff18d85b2800e # main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:1dd18987ffa4b383cf969c20c534d4fcb667e6a0801d41917c99a2c34c192557
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:c34a5c9930d92e6aa815b213432fbc12bdc2e5f1edfb8edb1aa7b2dc919a7fe1
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
diff --git a/Makefile b/Makefile
index d1ef8bf94f..baeff27cc6 100644
--- a/Makefile
+++ b/Makefile
@@ -51,7 +51,7 @@ init-upgrade:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:1dd18987ffa4b383cf969c20c534d4fcb667e6a0801d41917c99a2c34c192557
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:c34a5c9930d92e6aa815b213432fbc12bdc2e5f1edfb8edb1aa7b2dc919a7fe1
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist
diff --git a/tflib/publisher/check-reproducibility.sh b/tflib/publisher/check-reproducibility.sh
index 563f009a11..14f0e71261 100755
--- a/tflib/publisher/check-reproducibility.sh
+++ b/tflib/publisher/check-reproducibility.sh
@@ -40,7 +40,7 @@ REBUILT_IMAGE_NAME=$(docker run --rm \
    -v ${XDG_CACHE_HOME:-$HOME/.cache}:/cache \
    -e XDG_CACHE_HOME=/cache \
    --entrypoint apko \
-   ghcr.io/wolfi-dev/sdk:latest@sha256:294f01e5b23ddee9a6dd0d3569aee41e0f3ec8b2ce3ad726e6b05b1e0b493cc2 \
+   ghcr.io/wolfi-dev/sdk:latest@sha256:634eedd4e6cd139f4dcbebf46458db4e2558d0e01096cbabd6402e0a017d5ff3 \
    publish /tmp/latest.apko.json ${container_name}:5000/reproduction
 )