diff --git a/.github/workflows/presubmit-build.yaml b/.github/workflows/presubmit-build.yaml
index 1d0af6a8af..68e4adaf52 100644
--- a/.github/workflows/presubmit-build.yaml
+++ b/.github/workflows/presubmit-build.yaml
@@ -28,7 +28,7 @@ jobs:
     - run: terraform fmt -check -recursive -diff
     - run: ./lint.sh
     - name: Enforce YAML formatting
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:4c9087d2c2fccf2c0f3470cfa695c605bc0dcd7bcbb1ee9c64f80f62d8e1cfdc
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:408f57b1a42f587c6ad2a6c7a0829101de5c7b9e7fe370e5ffaa7f298219e2a2
       with:
         entrypoint: wolfictl
         args: lint yam images/
@@ -116,7 +116,7 @@ jobs:
 
     - uses: chainguard-dev/actions/setup-k3d@main
       with:
-        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:0ef62d22d89f611f9df50b9cc86d1f23d3d92d39062d4d13e500736f4e29d0d9
+        k3s-image: cgr.dev/chainguard/k3s:latest@sha256:ffee4248d76475fa318059e61c054d773ae1745e0be80dbb8f55c6b650662013
 
     - name: Build
       timeout-minutes: 60
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7d917827cf..61d51d3143 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -100,7 +100,7 @@ jobs:
 
       - uses: chainguard-dev/actions/setup-k3d@main
         with:
-          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:0ef62d22d89f611f9df50b9cc86d1f23d3d92d39062d4d13e500736f4e29d0d9
+          k3s-image: cgr.dev/chainguard/k3s:latest@sha256:ffee4248d76475fa318059e61c054d773ae1745e0be80dbb8f55c6b650662013
 
       # Make cosign/crane CLI available to the tests
       - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
diff --git a/Makefile b/Makefile
index 04535a0897..b7ab9cb63b 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ init:
 
 LOCAL_REGISTRY_NAME := k3d.localhost
 LOCAL_REGISTRY_PORT := 5005
-K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:0ef62d22d89f611f9df50b9cc86d1f23d3d92d39062d4d13e500736f4e29d0d9 
+K3S_IMAGE := cgr.dev/chainguard/k3s:latest@sha256:ffee4248d76475fa318059e61c054d773ae1745e0be80dbb8f55c6b650662013 
 
 k3d-registry:
 	@# Create a local registry managed by k3d only if it doesn't exist