diff --git a/Pkgfile b/Pkgfile
index 6da65a71..cd481cc3 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -4,7 +4,7 @@ format: v1alpha2
 
 vars:
   PKGS_PREFIX: ghcr.io/siderolabs
-  PKGS_VERSION: v1.4.0-alpha.0-7-g8965bee
+  PKGS_VERSION: v1.4.0-alpha.0-12-gcb83e16
   LINUX_FIRMWARE_VERSION: "20221214" # update this when updating PKGS_VERSION above
   DRBD_DRIVER_VERSION: 9.2.0 # update this when updating PKGS_VERSION above
 
diff --git a/container-runtime/gvisor/pkg.yaml b/container-runtime/gvisor/pkg.yaml
index a971da0d..06462bdc 100644
--- a/container-runtime/gvisor/pkg.yaml
+++ b/container-runtime/gvisor/pkg.yaml
@@ -6,10 +6,11 @@ dependencies:
 steps:
   - sources:
       # gvisor repo 'master' branch is Bazel-bazed, so we need to find matching commit in the "go" branch
-      - url: https://github.com/google/gvisor/archive/6ec92611f02490966e8a2d482e33f7ba38546b90.tar.gz
+      # find the go-branch specific merge commit ("Merge release-... (automated)") which has the release-tagged commit as a parent
+      - url: https://github.com/google/gvisor/archive/1c71d4a68953641fcc40be305f74794321dbde68.tar.gz
         destination: gvisor.tar.gz
-        sha256: 529885afba906aa277fdba90254c5ec42d4f8757904b1ee1a134f9f48cf1909c
-        sha512: d3e6be510c76d4747daabfe447117526072ab7eb6e7ad9a793246b32459a64639380eb023e6111c5810c6e6d67a33418f48109619ba865e6cd61994259040415
+        sha256: b7ed99f6c86a691e73127f5a7f8e2c99e4cabf5a6148995920622915ebde78a5
+        sha512: d9085824d41b0145139fb13493753682a73ab5c00e5242ca479a94f19a3f449718b48a833b4b6cd80ddff637d22bcdaf27ba35dc11ebe92afa1f0ac13da8060e
     env:
       GOPATH: /go
     prepare:
diff --git a/container-runtime/vars.yaml b/container-runtime/vars.yaml
index 3c8898a1..45b6c0cc 100644
--- a/container-runtime/vars.yaml
+++ b/container-runtime/vars.yaml
@@ -1,2 +1,2 @@
 # renovate: datasource=github-tags extractVersion=^release-(?<version>.*)$ versioning=loose depName=google/gvisor
-GVISOR_VERSION: 20221212.0
+GVISOR_VERSION: 20230109.0
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod
index 69aba832..3c0f2f16 100644
--- a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod
+++ b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod
@@ -2,4 +2,4 @@ module nvidia-persistenced-wrapper
 
 go 1.19
 
-require golang.org/x/sys v0.3.0
+require golang.org/x/sys v0.4.0
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum
index 2738fca8..c2a6782e 100644
--- a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum
+++ b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/nvidia-gpu/vars.yaml b/nvidia-gpu/vars.yaml
index 41dc69f0..28e440b5 100644
--- a/nvidia-gpu/vars.yaml
+++ b/nvidia-gpu/vars.yaml
@@ -12,6 +12,6 @@ GOLANG_VERSION: 1.17.13
 # renovate: datasource=git-tags extractVersion=^glibc-(?<version>.*)$ versioning=loose depName=https://sourceware.org/git/glibc.git
 GLIBC_VERSION: 2.36
 # renovate: datasource=docker versioning=docker depName=ubuntu
-UBUNTU_IMAGE_VERSION: 22.10
+UBUNTU_IMAGE_VERSION: 23.04
 # renovate: datasource=docker versioning=docker depName=debian
 DEBIAN_IMAGE_VERSION: 10
diff --git a/storage/iscsi-tools/iscsid-wrapper/go.mod b/storage/iscsi-tools/iscsid-wrapper/go.mod
index e6eb6090..8350ac91 100644
--- a/storage/iscsi-tools/iscsid-wrapper/go.mod
+++ b/storage/iscsi-tools/iscsid-wrapper/go.mod
@@ -2,4 +2,4 @@ module iscsid-wrapper
 
 go 1.19
 
-require golang.org/x/sys v0.3.0
+require golang.org/x/sys v0.4.0
diff --git a/storage/iscsi-tools/iscsid-wrapper/go.sum b/storage/iscsi-tools/iscsid-wrapper/go.sum
index 2738fca8..c2a6782e 100644
--- a/storage/iscsi-tools/iscsid-wrapper/go.sum
+++ b/storage/iscsi-tools/iscsid-wrapper/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=