diff --git a/.bazelversion b/.bazelversion
index b13d146a..3b740421 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-9.3.0
+9.3.1
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index a44bffbf..4b56b8cd 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -1065,162 +1065,162 @@
           "6f1b08de9e2dd94f69c52e524ab6834737275253291e8fd7f1c12ed4eceeda89"
         ]
       },
-      "1.27.2": {
+      "1.27.3": {
         "aix_ppc64": [
-          "go1.27.2.aix-ppc64.tar.gz",
-          "8b3032f55f4deee212dd5c4b8fcb605c47d60f57d4d2218670dd1372c2a66edc"
+          "go1.27.3.aix-ppc64.tar.gz",
+          "4c8a6bf25678e2b5706185951c3b39782c490ee4f56f19be03c447a0fde551fc"
         ],
         "darwin_amd64": [
-          "go1.27.2.darwin-amd64.tar.gz",
-          "587b59182488b23aa6e5fc25110405a3e0e5b38ed2f5b2f46ed13c32aee356fe"
+          "go1.27.3.darwin-amd64.tar.gz",
+          "b6f8e931e4ab497fcde6da8ae4499a58f9d258e55c8a80824a516eae5950a750"
         ],
         "darwin_arm64": [
-          "go1.27.2.darwin-arm64.tar.gz",
-          "76812b213b1b2302c978d28fa52fa92d541704b9e7d9d5db8002c50e4018c4c5"
+          "go1.27.3.darwin-arm64.tar.gz",
+          "dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2"
         ],
         "dragonfly_amd64": [
-          "go1.27.2.dragonfly-amd64.tar.gz",
-          "c9827ed9d91477541c18de54bc0ad3776d4a506aac629d3878113316da5bca4e"
+          "go1.27.3.dragonfly-amd64.tar.gz",
+          "d95229fa3c8237c08378d794cc8a1597e10b3ae23a5eded0abb824997693249f"
         ],
         "freebsd_386": [
-          "go1.27.2.freebsd-386.tar.gz",
-          "ebbee6bf21224ca07bcb0309e81fe24bb4464a1a12b944bbe2c7b6daf0f2bd13"
+          "go1.27.3.freebsd-386.tar.gz",
+          "5d68e67f5b763b920e830584211694b2ffe662ccb82299415953c25aecfb0d0d"
         ],
         "freebsd_amd64": [
-          "go1.27.2.freebsd-amd64.tar.gz",
-          "3baf61eec549b0c3f638d82636388e36abf94aa14814a011f011d2648ad1eded"
+          "go1.27.3.freebsd-amd64.tar.gz",
+          "c15c88d07d6b2d2db5df7b65d9b9c73d631ac4e787da04e2bef2a5b6952c2cbb"
         ],
         "freebsd_arm": [
-          "go1.27.2.freebsd-arm.tar.gz",
-          "278367bc98bfb6278f712d0a6a83f940ca1f78b5bf6d053054600023c2e1711c"
+          "go1.27.3.freebsd-arm.tar.gz",
+          "e41994e6583a1200181d8d354ae17d570b12adc985ac2149fbaa4f93e99f3292"
         ],
         "freebsd_arm64": [
-          "go1.27.2.freebsd-arm64.tar.gz",
-          "b77d9b8aa9cde90e1045a13f6166e46e370ef7225556e9c2043d351c59557ecb"
+          "go1.27.3.freebsd-arm64.tar.gz",
+          "cca2dd0aa1cf6df18df55762ee9fe6ee31c77ebcfc51e8c635d333e14aa9e2c1"
         ],
         "illumos_amd64": [
-          "go1.27.2.illumos-amd64.tar.gz",
-          "8d6494436a062af7cdf18812e7534bdbe8391b626ad327bf9bbff5f393b14dbd"
+          "go1.27.3.illumos-amd64.tar.gz",
+          "bf0e5d0dd8d74a4b0aa1d62e382107aaad8b62e6939c9b7527a9c219bfffed46"
         ],
         "linux_386": [
-          "go1.27.2.linux-386.tar.gz",
-          "93dae4b7f463ed1e9c65e05561ce9fc5f7cd5c4ffca5e336248d48f3a2eab5fc"
+          "go1.27.3.linux-386.tar.gz",
+          "cfc243057c03dd131413b91269d16b5061f87f312059c1ed78681cbb95d6afbf"
         ],
         "linux_amd64": [
-          "go1.27.2.linux-amd64.tar.gz",
-          "ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5"
+          "go1.27.3.linux-amd64.tar.gz",
+          "65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40"
         ],
         "linux_arm64": [
-          "go1.27.2.linux-arm64.tar.gz",
-          "94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8"
+          "go1.27.3.linux-arm64.tar.gz",
+          "a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49"
         ],
         "linux_armv6l": [
-          "go1.27.2.linux-armv6l.tar.gz",
-          "e25a174051d8675f87ac720aedcd25bf89ac652c4b82f26aa47919524725ed95"
+          "go1.27.3.linux-armv6l.tar.gz",
+          "d6f4e11dd7157030d7ac11c51c8f73201a2db932d593c3106b1da11cc32bfdf8"
         ],
         "linux_loong64": [
-          "go1.27.2.linux-loong64.tar.gz",
-          "b49a3b2f090934ca588c7a897d64bc12f844348a2cd35e301d8f4f50eaf3bfdb"
+          "go1.27.3.linux-loong64.tar.gz",
+          "90f4013bad9f641147dbaf847d57560a4f8df67b752d0bcda6309cb9f4d80282"
         ],
         "linux_mips": [
-          "go1.27.2.linux-mips.tar.gz",
-          "c3efcee917835d706a60dff89a1f18a3edd9b29b1c7bfb8386ecfb9cacdd38af"
+          "go1.27.3.linux-mips.tar.gz",
+          "8bee079147bc2e83ee07dce0d02a0466cb2a7c2a4883f3c5eacb212dac91fcc7"
         ],
         "linux_mips64": [
-          "go1.27.2.linux-mips64.tar.gz",
-          "bafd19c6c20b63029e6840b3d42aa4cb0f9265ed676bb506728d59dbd3a662bf"
+          "go1.27.3.linux-mips64.tar.gz",
+          "4e3ba81c7dac07296a7f47e887809518e835e14aad4bb00176ba3ba4e8339d1c"
         ],
         "linux_mips64le": [
-          "go1.27.2.linux-mips64le.tar.gz",
-          "f1702dad3fb818510eb499e338dae52a2951af2096af3bc41f9e126bb1fa2dbd"
+          "go1.27.3.linux-mips64le.tar.gz",
+          "fc8df513958948d0635846a0b90932b0fb130b9a3b9a79592a913f9c488abe45"
         ],
         "linux_mipsle": [
-          "go1.27.2.linux-mipsle.tar.gz",
-          "c324d5a82a24e01f0215ee2bf15ebb75f01d6b51d550487ecec508f5a006926a"
+          "go1.27.3.linux-mipsle.tar.gz",
+          "1a716e60998aff61d3d2c45665ba2127c6714fc09449c4e6cc57fd2d7ef5593e"
         ],
         "linux_ppc64": [
-          "go1.27.2.linux-ppc64.tar.gz",
-          "56e5bb33414b28338bb4ba980621428cf25485acc430f52ce7fc77be41d1e50a"
+          "go1.27.3.linux-ppc64.tar.gz",
+          "0bc0e5288b343d9580115592512ed1677c58fcf86ffb37e88ff80a466ddcab19"
         ],
         "linux_ppc64le": [
-          "go1.27.2.linux-ppc64le.tar.gz",
-          "059d5f01b1607a724ea5ae87c5589041a51c577a6f3f20099e49d00f31c803fa"
+          "go1.27.3.linux-ppc64le.tar.gz",
+          "f180f01943865b7942ab3b4acbab6da6f0f669b61da999d004d16c537a49f7b5"
         ],
         "linux_riscv64": [
-          "go1.27.2.linux-riscv64.tar.gz",
-          "420f3b8dac8b5a9d11f51e12b496ac27f02ab31cbe495067e355ed43b9fe3aa1"
+          "go1.27.3.linux-riscv64.tar.gz",
+          "41fe171fb7fcf5574cba7d874c2732dca9161ce2dba631d754371951df9ea310"
         ],
         "linux_s390x": [
-          "go1.27.2.linux-s390x.tar.gz",
-          "dfd01d1e08e4dbece2cd91e259953f87b858752037fd151da2f674c4fa09aeef"
+          "go1.27.3.linux-s390x.tar.gz",
+          "62e109a6280a073c9025e1b51ea298ec1d3575d3ce62238721311f5ff2c854e6"
         ],
         "netbsd_386": [
-          "go1.27.2.netbsd-386.tar.gz",
-          "a93ea6e895479b57a188bd77ea02106c668fb0c961554566b89c4b0cb1d0f2c9"
+          "go1.27.3.netbsd-386.tar.gz",
+          "a9747a1c1923069784558b6972687d3986b08ab1fc043a7f1fa1721016c580b9"
         ],
         "netbsd_amd64": [
-          "go1.27.2.netbsd-amd64.tar.gz",
-          "a096f13c8fa9f44783e2361dcd9f472bb045187f67749e03e4e8d8ed83fd702b"
+          "go1.27.3.netbsd-amd64.tar.gz",
+          "7d302f3871dda5749c1d9ea39428c7e962be9b2affd70c7dde1868d2bfcc5ce7"
         ],
         "netbsd_arm": [
-          "go1.27.2.netbsd-arm.tar.gz",
-          "9ff205b9bfd1d04c8e92df1d987ad8e52ae15e7482a484bff65aadce86e0f118"
+          "go1.27.3.netbsd-arm.tar.gz",
+          "d17200942b4a3de4ecbe7a9dbaba1ae17f0f45c8c298fd644ea3ca8cb42663c8"
         ],
         "netbsd_arm64": [
-          "go1.27.2.netbsd-arm64.tar.gz",
-          "d0e4ec38cd5f82ec872bc40d5780f5e604a32186490d3d67a684031557e6b4ff"
+          "go1.27.3.netbsd-arm64.tar.gz",
+          "801f07170ede2564a79ed41fcafb33d3a9d7f8fea789e9826edb3b2ddebea92b"
         ],
         "openbsd_386": [
-          "go1.27.2.openbsd-386.tar.gz",
-          "67d95a9e13ea442fda463de7808cfd64720adc9e7d9f026c59438b6e23ace90b"
+          "go1.27.3.openbsd-386.tar.gz",
+          "c50e9233121b63a4f4b386153e39e41aa3601e6cd413105006a673df635519f9"
         ],
         "openbsd_amd64": [
-          "go1.27.2.openbsd-amd64.tar.gz",
-          "ab74a2b31761a8c34e9a1059b0f9c82a7db42780fde4e35bac270758d45816a1"
+          "go1.27.3.openbsd-amd64.tar.gz",
+          "8b16704326759ee5bc8aded3852bbcbf6ea96daa93033e696d6e4dc63f041644"
         ],
         "openbsd_arm": [
-          "go1.27.2.openbsd-arm.tar.gz",
-          "98f772157d04c620a64bc1f1d5dd56b19cfd17b3558d70184c4199c337f2b571"
+          "go1.27.3.openbsd-arm.tar.gz",
+          "9dd37f0bf4d9eb960dae072439e298b7048c10871627e3e23d35325aab0d7bce"
         ],
         "openbsd_arm64": [
-          "go1.27.2.openbsd-arm64.tar.gz",
-          "befd66f13c7bd83fa3fa794a3deec5a1d6b5bf64817afbedaf258b10257f875c"
+          "go1.27.3.openbsd-arm64.tar.gz",
+          "9efb4b26089e23f39ecaf8763c6b35ab306924e8c93d56bd8f8289f92a4471a9"
         ],
         "openbsd_ppc64": [
-          "go1.27.2.openbsd-ppc64.tar.gz",
-          "275bd022cfaf4ae75503e63dd62d011eb25603ecc8e70a3ae894aa9b4a009889"
+          "go1.27.3.openbsd-ppc64.tar.gz",
+          "7e8205cfceeb1ea8b50702a22a6e4bab21d7ad9eb8c2acd14cec3861bb4375b7"
         ],
         "openbsd_riscv64": [
-          "go1.27.2.openbsd-riscv64.tar.gz",
-          "cfd833a4bdb3df1bf3b8c643d1b73688914b7ca4dfbab55f321be91cd9793890"
+          "go1.27.3.openbsd-riscv64.tar.gz",
+          "2d07277920e79bef1b019785e49b138520d84b0bf248829d91d53b93dccb056f"
         ],
         "plan9_386": [
-          "go1.27.2.plan9-386.tar.gz",
-          "84700a14ea5191a367a0c25a559c43e00c18c3b4ad06f23785c4ea37f8d7ae65"
+          "go1.27.3.plan9-386.tar.gz",
+          "52a968ce13b9a6890c7d67467e5894a14dc4d7c96c50b6574c17bdc6a7f96f05"
         ],
         "plan9_amd64": [
-          "go1.27.2.plan9-amd64.tar.gz",
-          "92538ce012a70b178da919058b26a176fb544385c02697554df66020e7034938"
+          "go1.27.3.plan9-amd64.tar.gz",
+          "0afac02dcc0215b57b15511f9abb1b40ff355d2d3a393189b85a678309204228"
         ],
         "plan9_arm": [
-          "go1.27.2.plan9-arm.tar.gz",
-          "ea646470026be77de143628f296207e0493d3792b03fea8ba386dd033fedeea1"
+          "go1.27.3.plan9-arm.tar.gz",
+          "f0d4df3d219cc1dff9f84128e9863d86a251088948c2df10052050ca678bdae9"
         ],
         "solaris_amd64": [
-          "go1.27.2.solaris-amd64.tar.gz",
-          "2dd0520f3c547ef32a81165335df330392930916bbfdd28a6a398aae41f0d17d"
+          "go1.27.3.solaris-amd64.tar.gz",
+          "6b58ac7cdcd5e9d4776db223324d6f07666e9fe6e0b9d99be26d699cb5f8740f"
         ],
         "windows_386": [
-          "go1.27.2.windows-386.zip",
-          "b41f5abfa012399752aea010839c8fd1f66283cd0ea83c864a7a9693ceff8fae"
+          "go1.27.3.windows-386.zip",
+          "fa6fa87202fdd0421bf1f0daab5192d244840f0728398ee35a56f231d54363be"
         ],
         "windows_amd64": [
-          "go1.27.2.windows-amd64.zip",
-          "1314008898bd40df77af4b014f777f08873dbdfbcd3d92308728ee03304fe04f"
+          "go1.27.3.windows-amd64.zip",
+          "f26081f438319757f8a1b46d7d0b2c5ec7583d4038e485e0aa725cfde7885fff"
         ],
         "windows_arm64": [
-          "go1.27.2.windows-arm64.zip",
-          "5c4b294f23b558619ae8a4aa94d023e3bca03f52c8398bb41b9026002b0013de"
+          "go1.27.3.windows-arm64.zip",
+          "c507872ff21f8a7cd3c1c217b059c6f7271a4a9d8e692810ef9dd3e1f601197c"
         ]
       }
     }
diff --git a/go.MODULE.bazel b/go.MODULE.bazel
index 441f461b..a8238502 100644
--- a/go.MODULE.bazel
+++ b/go.MODULE.bazel
@@ -1,8 +1,8 @@
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 
-go_sdk.download(version = "1.27.2")
+go_sdk.download(version = "1.27.3")
 go_sdk.download(
-    version = "1.27.2",
+    version = "1.27.3",
     goarch = "amd64",
     goos = "linux",
 )
diff --git a/infra/.terraform-version b/infra/.terraform-version
index de646d2f..092afa15 100644
--- a/infra/.terraform-version
+++ b/infra/.terraform-version
@@ -1 +1 @@
-1.16.6
+1.17.0
diff --git a/infra/.terraform.lock.hcl b/infra/.terraform.lock.hcl
index 37f58fb4..4973f590 100644
--- a/infra/.terraform.lock.hcl
+++ b/infra/.terraform.lock.hcl
@@ -57,40 +57,40 @@ provider "registry.terraform.io/cloudflare/cloudflare" {
 }
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version     = "6.69.1"
-  constraints = "6.69.1"
+  version     = "6.70.0"
+  constraints = "6.70.0"
   hashes = [
-    "h1:JwemSDdwpiD/nw7exJlatpTTckHvwOoo9L53L+AdoZw=",
-    "h1:P8yFqjGg6/8HbZOY0qtFSKm9v67asCwQEbqQzxYVzoI=",
-    "h1:POg97WB0GrcktmcyE76PQZLeLAVIphDK4olaCf67HAE=",
-    "h1:R7Y9dzrvqE7tD89u6ngwnJshFk8jUoOY3tMJYYF5zcI=",
-    "h1:VCLG26frd0ZRApDQ0l4pqjMCBUi1VPm0/M6c3pnUDgg=",
-    "h1:X1KsDgAPtUfTB4TRkwLcxfkTxgAuvX+HlOFce4Mc1Ds=",
-    "h1:abf9Jox0bkBqO4MjUFdeWyB6l5DPvpvfo+qdk+9WbCU=",
-    "h1:fAaHsk0hQvy8ComS16dV8MjGNDNX42LEyHbuYu/Bsa8=",
-    "h1:fdynuf4Y8WZ95RtQXa4tJpzcRwTnOio8XJiA/F8x7ms=",
-    "h1:id4hVsYQIPuf7/RKmJdiP0/90uwbEbsjg3ZOo8nprBQ=",
-    "h1:j8OcftKysEw0hTrFA5FczfGrXOFGMyorSTEiQihUw4o=",
-    "h1:l4CfdB3t4sniZcsOOhGxrg6sStCpHTseJbOqZLRg4kA=",
-    "h1:ohekeOL8kUQHLLYSlBwX+grRPu9uSDhsHkM6Xz7jgVE=",
-    "h1:s4cK4H0JCMgWlxXSZH/0w8nkg3mcXWy5EkBNN2GMnRE=",
-    "h1:xewHdW9nOeptxXzv2FhYLIsK+wLtMOKGdAksoOWhfpc=",
-    "zh:0ad1319a9fea21dacf084152e236cfd6c150ccc91854ad547c5ab9bc1cddad9a",
-    "zh:113d7ceaca21f0e4b84f45e69369263311512f858a402955f9e9a8a5bb7f3151",
-    "zh:1828581462a8a985361c2f4e9af90b2bd5b7d4603b00146bb23a88c5b7d50888",
-    "zh:28d454d8ac98a88903540bf17bf63d6935dd2e08e572e41152d06db926a5333a",
-    "zh:2a3b594a98fedc396a4eb5f0fd324e641f83db0906d0129c2ddeffd8002fbe86",
-    "zh:32c3103af70480b5c3be86ab00af2f46d3a2a6f269ddadf8c1e53a7a3ea0031b",
-    "zh:3df1dd01ec3a65291f51f26b4d28dcd1bf7b4c73ed0bd3ab1e94e1153ce9b13d",
-    "zh:42699fbd59bf14adb1cf2836c80c209b3ce815d252f4e983afc8defa754b1dfe",
-    "zh:5522afd762a1ee95e6ef0d7ad1f165185303a3039e45e1632a3cd13314b7a1a4",
-    "zh:69f3537ccb012cf24cc11af3cfc3b4be5602b4a3bfbaae2dcab78e41b40f280b",
+    "h1:DraWG6jn1uz5yFvF3RQSEYCdiFd28ZyBvzw66nRXXJU=",
+    "h1:FTJvoIDVz+x6B26k+fxXHn0NOKMvVOP9qLz6VdycFkE=",
+    "h1:HCr4MYgxlkFBOAeWKOoktNNzZaQX8ZZY4YTxmL/1V/Y=",
+    "h1:I3ce1+zkg8UFeWZAfGF2oX9jK/qtLnNsAKz4JnHrucc=",
+    "h1:IHe8WRCW7IE43SmIgucpu5fcZPJQ3YEXE9VIqV/7ncs=",
+    "h1:L+05gOXA+kdYTtayIw0WxdaTp3JryZCMZpfrJVhoJA0=",
+    "h1:dH8TsyCOBIBefx6OxxxN2NKU1CphXJchLHzVMnxl/Y4=",
+    "h1:hUjpWN+EZt8pPDyWkIXVn6S9kLdCwd0qWnuP0WXY7hI=",
+    "h1:qyaviwNzelpKOn0sf1G+LYSdLf0BvGjhvBANYLe9UCw=",
+    "h1:r2Smh7Mn5lcjX4jHpleyyZry66l0Au5z81U0Nm3IrOE=",
+    "h1:tqfB0xM6N0bABhoagpltPcPrq5TcwrdRszh+BKtWxXM=",
+    "h1:uvWKWguDVM0X08vuxe/8gwJevoLwZrIWMaa6271P+gs=",
+    "h1:vAK6E8cboMI/DFTiIIMckdqGQ2XuH2SoY1+nviEsOxE=",
+    "h1:vrT+xvAewqs/gZOatWgD3r6r079X+Nsiz9U6TTBnnL8=",
+    "h1:w9LXgzTO2tfv9DHh7uEwwe/9SmN1E/Hv2A/heQoXJvs=",
+    "zh:068ca7ed4fc77e3d63d7fac54515a426a32f3dc143b55a6ad00963fe68289955",
+    "zh:2d8c016b3809ab32f536b01bf2c98fcbdeb066b7b7e50f756ff6ff1e0b0539c7",
+    "zh:450d960b60ea81268bd355600340787254f750d76e0075208a6fb903d7336b09",
+    "zh:50447833cce21288ffc331342f9d83854e80515e2d86e8f5776a07ce18866b20",
+    "zh:58acc041b080778ded75320e241ebcf6cf2ed145bede644b86a4784ce46086c6",
+    "zh:7e899a44a1da95fefb1b04b231cf7cdb5871f482f60a710ede78bf25ac265724",
+    "zh:8b141d13f4b84d7a47bc5a4855d0fc985191317b3249603532d4de03db5741c5",
+    "zh:9035357f7d065ce8d35a9b05337977910683219c0f13fa09155d28f9b32e23a7",
     "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a0c5bf13ba5e17a993aab381603a32d6c9dc2ae8d9f982b6a8c6407b5d7c4a50",
-    "zh:b9f8a73e11e0b82ba51474b6a6eb4ac3080d7f268087162cb10884655878670a",
-    "zh:be1f9728404d67dee586d16b69a445931e5e4dafbf7b996df3a7eed519a557b0",
-    "zh:dc15fb3443312a42deb8b13f92c8d10a701e46eca0155f0709ad763057a85a1d",
-    "zh:e9f6567a13f21123838aaf78d94f76da8c8f7783eff7f7aa781fd1c21d18d86c",
+    "zh:9ba0990a876d2641a185ca88263719afc4d5ac43533bdb147437f0073d2cd74d",
+    "zh:a8773c7a02e1b3290df89351ee493fd8b74f807f92a7f69534e05901d4515761",
+    "zh:ab0ebb298578eeeffe0fbf0a8b27ce99acd4419b7049272f1ab87e8c47229407",
+    "zh:b88a3f22127bfb17604adc53e9bdb8ed0eddf4b9b77bf19871cba2e7fcd5b4a3",
+    "zh:c7b1fb41e7f086b670f78932ede2b539903a8d71bac06f55f14a1a33d09a1ccf",
+    "zh:df482bd93f51125f78feab7742aae1d7f22c7108ee2dc47787c4a1d611e6ccfd",
+    "zh:fca401ffaa42d5f350d667123569de51a23de8c30b87ce0bd9d86fc80835fd4d",
   ]
 }
 
diff --git a/infra/containers/distroless/distroless.MODULE.bazel b/infra/containers/distroless/distroless.MODULE.bazel
index 2d573993..07d610b7 100644
--- a/infra/containers/distroless/distroless.MODULE.bazel
+++ b/infra/containers/distroless/distroless.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=gcr.io/distroless/static
 oci.pull(
     name = "distroless",
-    digest = "sha256:58133991db06659feaabe0f4e97a35cebf15ef4ea08f8a4c6d2ee5f75e4aa6a0",
+    digest = "sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d",
     image = "gcr.io/distroless/static",
     platforms = [
         "linux/amd64",
diff --git a/infra/containers/nginx/nginx.MODULE.bazel b/infra/containers/nginx/nginx.MODULE.bazel
index fd8032b2..735ac983 100644
--- a/infra/containers/nginx/nginx.MODULE.bazel
+++ b/infra/containers/nginx/nginx.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=docker.io/library/nginx
 oci.pull(
     name = "nginx",
-    digest = "sha256:bc4cad49969aaf95eb4eecec5572846f86e59f1e8332aba36ed64b91aff8b724",
+    digest = "sha256:4c41e2d0a3a55b325ed572cd0200bdb72af1433c3daa2bca6ef8eea68ce504a2",
     image = "docker.io/library/nginx",
     platforms = [
         "linux/386",
diff --git a/infra/containers/prowlarr/prowlarr.MODULE.bazel b/infra/containers/prowlarr/prowlarr.MODULE.bazel
index bf4f581f..63b258a4 100644
--- a/infra/containers/prowlarr/prowlarr.MODULE.bazel
+++ b/infra/containers/prowlarr/prowlarr.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=docker.io/linuxserver/prowlarr
 oci.pull(
     name = "prowlarr",
-    digest = "sha256:4e992f9b9229bc8c97c666b10b042a7360bce1d99b196e8aa29fd9805849cbf1",
+    digest = "sha256:b3b00047ed20f6ce2b16780145cb6a0acb51c9e28ea6aa6f5dcd33c7034f1797",
     image = "docker.io/linuxserver/prowlarr",
     platforms = [
         "linux/amd64",
diff --git a/infra/containers/qbittorrent/qbittorrent.MODULE.bazel b/infra/containers/qbittorrent/qbittorrent.MODULE.bazel
index c54d517e..f2711046 100644
--- a/infra/containers/qbittorrent/qbittorrent.MODULE.bazel
+++ b/infra/containers/qbittorrent/qbittorrent.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=docker.io/linuxserver/qbittorrent
 oci.pull(
     name = "qbittorrent",
-    digest = "sha256:1ea873647c43d566f251a7122aee330b184509c57ee3257ed19f62dac0f8f24b",
+    digest = "sha256:e887804fa9de4c60f5f0fb1f3a7e4febe40a8f69fe736f70c4e8589b1f868dab",
     image = "docker.io/linuxserver/qbittorrent",
     platforms = [
         "linux/amd64",
diff --git a/infra/containers/radarr/radarr.MODULE.bazel b/infra/containers/radarr/radarr.MODULE.bazel
index a1c8a735..12fcc249 100644
--- a/infra/containers/radarr/radarr.MODULE.bazel
+++ b/infra/containers/radarr/radarr.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=docker.io/linuxserver/radarr
 oci.pull(
     name = "radarr",
-    digest = "sha256:ff4430fe2d6159b4dbaac9903acfecee5aa68dec8c929259e2f3114c63f7a09e",
+    digest = "sha256:fc0ae3c50f8128b97e84381903ec8d6845c3a569641cb7117c124376cccb57c1",
     image = "docker.io/linuxserver/radarr",
     platforms = [
         "linux/amd64",
diff --git a/infra/containers/registry/registry.MODULE.bazel b/infra/containers/registry/registry.MODULE.bazel
index 4268503c..fd617a5f 100644
--- a/infra/containers/registry/registry.MODULE.bazel
+++ b/infra/containers/registry/registry.MODULE.bazel
@@ -1,7 +1,7 @@
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 oci.pull(
     name = "registry",
-    digest = "sha256:ddf754342cfc8acc51a56d5d0ab6af06826461864460636d8bd5c546dab2a7b8",
+    digest = "sha256:01cd312e67026f06f5d89c3e133a4a9adc7cb9eeb9b1194e0b2954dfd770efd2",
     image = "docker.io/library/registry",
     platforms = [
         "linux/amd64",
diff --git a/infra/containers/sonarr/sonarr.MODULE.bazel b/infra/containers/sonarr/sonarr.MODULE.bazel
index 4374466b..04241364 100644
--- a/infra/containers/sonarr/sonarr.MODULE.bazel
+++ b/infra/containers/sonarr/sonarr.MODULE.bazel
@@ -3,7 +3,7 @@ oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 # renovate: datasource=docker depName=docker.io/linuxserver/sonarr
 oci.pull(
     name = "sonarr",
-    digest = "sha256:44b06045a98bc1f237b9ffefc4b28dab64cb29305e4a2a94875ae93b5224e4cc",
+    digest = "sha256:889dcc58c6aea859033985894b519b2e6b1e55d92527ed123f9f52e42ae7c97b",
     image = "docker.io/linuxserver/sonarr",
     platforms = [
         "linux/amd64",
diff --git a/infra/main.tf b/infra/main.tf
index b048e900..00761767 100644
--- a/infra/main.tf
+++ b/infra/main.tf
@@ -5,7 +5,7 @@ terraform {
     region       = "eu-west-2"
     use_lockfile = true
   }
-  required_version = "~> 1.16.0"
+  required_version = "~> 1.17.0"
   # Provider versions are pinned here, next to .terraform.lock.hcl, so
   # Renovate updates the lock file in the same commit as the bump (it
   # only refreshes lock files in the directory of the changed pin).
@@ -16,7 +16,7 @@ terraform {
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.69.1"
+      version = "6.70.0"
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
diff --git a/java.MODULE.bazel b/java.MODULE.bazel
index 5a8ffb84..6a6976c0 100644
--- a/java.MODULE.bazel
+++ b/java.MODULE.bazel
@@ -14,7 +14,7 @@ JETTY_VERSION = "12.1.14"
 JERSEY_VERSION = "5.0.0-M1"
 
 # renovate: datasource=maven depName=org.flywaydb:flyway-core
-FLYWAY_VERSION = "13.10.3"
+FLYWAY_VERSION = "13.11.1"
 
 # renovate: datasource=maven depName=com.fasterxml.jackson:jackson-bom
 JACKSON_VERSION = "2.22.4"
@@ -65,8 +65,8 @@ maven.install(
 
         "com.typesafe:config:1.4.9",
 
-        "org.flywaydb:flyway-core:13.10.3",
-        "org.flywaydb:flyway-database-postgresql:13.10.3",
+        "org.flywaydb:flyway-core:13.11.1",
+        "org.flywaydb:flyway-database-postgresql:13.11.1",
 
         "org.postgresql:postgresql:42.7.14",
         "com.zaxxer:HikariCP:7.1.0",