diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 29c1c6bca..cb8e42a2d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-08-29T12:20:48Z by kres b5ca957.
+# Generated on 2024-10-17T14:48:14Z by kres 34e72ac.
 
 name: default
 concurrency:
@@ -33,7 +33,7 @@ jobs:
       labels: ${{ steps.retrieve-pr-labels.outputs.result }}
     services:
       buildkitd:
-        image: moby/buildkit:v0.15.2
+        image: moby/buildkit:v0.16.0
         options: --privileged
         ports:
           - 1234:1234
@@ -137,7 +137,7 @@ jobs:
       - default
     services:
       buildkitd:
-        image: moby/buildkit:v0.15.2
+        image: moby/buildkit:v0.16.0
         options: --privileged
         ports:
           - 1234:1234
diff --git a/.github/workflows/weekly.yaml b/.github/workflows/weekly.yaml
index aea08c049..41a92589d 100644
--- a/.github/workflows/weekly.yaml
+++ b/.github/workflows/weekly.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-08-29T12:20:48Z by kres b5ca957.
+# Generated on 2024-10-17T14:48:14Z by kres 34e72ac.
 
 name: weekly
 concurrency:
@@ -16,7 +16,7 @@ jobs:
       - pkgs
     services:
       buildkitd:
-        image: moby/buildkit:v0.15.2
+        image: moby/buildkit:v0.16.0
         options: --privileged
         ports:
           - 1234:1234
diff --git a/.kres.yaml b/.kres.yaml
index 80e56a0fe..8690bd014 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -18,6 +18,7 @@ spec:
     - ipxe
     - kmod
     - libaio
+    - libattr
     - libcap
     - libinih
     - libjson-c
diff --git a/Makefile b/Makefile
index 8e4adeea9..a2239628a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-09-29T13:39:30Z by kres 8be5fa7.
+# Generated on 2024-10-17T14:53:25Z by kres 34e72ac.
 
 # common variables
 
@@ -208,3 +208,4 @@ release-notes: $(ARTIFACTS)
 conformance:
 	@docker pull $(CONFORMANCE_IMAGE)
 	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
+
diff --git a/Pkgfile b/Pkgfile
index f0dbcd8df..b40208f7c 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -3,12 +3,12 @@
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.9.0-alpha.0-3-g1151610
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.9.0-alpha.0-4-g2058296
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
-  cni_version: v1.5.1
-  cni_sha256: a2eff5f064f809ee41f8f49ef8aed1f0a4093c0c772f2ce2caaee4e6f395050a
-  cni_sha512: d2e01958dd8328407164cb6be9d962321742dae7011ce7cd7b2342f5e4b4bbcd992d8249c53d3d81250a60c27f049969bbf329a75440524f52c1f1466b6e7132
+  cni_version: v1.6.0
+  cni_sha256: c7e994a755960ab8922c65d7bdbb26d1781a3afe90b9b688010c5e8636b95980
+  cni_sha512: a967dcaedb595bad25e0643aba50b35fb850b5893518829951ba5622d195ab309a3a489c9eb9ff8ad1df9ad0244c05434143f564ea27c4d04f27e1c5be240554
 
   # renovate: datasource=github-tags depName=containerd/containerd
   containerd_version: v2.0.0-rc.5
@@ -37,10 +37,10 @@ vars:
   systemd_sha512: 99d0fad02cab3559e081dabc2797d1d66bbc21daf9aaec847aeb6bce289456ff9c8599a34563c9bfa3826db36ae9ab30836b09bae00bf1a410b54d0bad9bd4dc
 
   # renovate: datasource=github-releases depName=flannel-io/cni-plugin
-  flannel_cni_version: v1.5.1-flannel2
-  flannel_cni_ref: 1257a5a4e2a59a4083627223355ae28178293cb2
-  flannel_cni_sha256: 24a7cd4e27cc947cb1b936fe578a933de91f387881b5b01f9c018b8b1a59c51a
-  flannel_cni_sha512: 816483813ae014bb00b75b434c7765b02be3a5ac76fb45ef1f2cc558d7c4a41ab045d5e724e90da5b6f244be6a0604bd01af85392acec85df020eacda4ff0509
+  flannel_cni_version: v1.5.1-flannel3
+  flannel_cni_ref: a3f52e86452cdcdd2d970bb0f89eef248aed0e7c
+  flannel_cni_sha256: d66de816e48240b66d8d521f24bddc534c4e05bd83bf9c08aec6cd5e7f2890db
+  flannel_cni_sha512: 52e614d867060489e792769219345f6f5ee03e04e30d8a08ae96e9c0881e9c9fa5f6f424888ac1ce610afe13cf29e54da017483a09b6e844e3422b99d00bcdf3
 
   # renovate: datasource=git-refs versioning=git depName=https://github.com/google/gasket-driver.git
   gasket_driver_ref: 5815ee3908a46a415aac616ac7b9aedcb98a504c
@@ -93,9 +93,9 @@ vars:
   libinih_sha512: d69f488299c1896e87ddd3dd20cd9db5848da7afa4c6159b8a99ba9a5d33f35cadfdb9f65d6f2fe31decdbadb8b43bf610ff2699df475e1f9ff045e343ac26ae
 
   # renovate: datasource=github-tags extractVersion=^json-c-(?<version>.*)-.*$ depName=json-c/json-c
-  libjson_c_version: 0.17
-  libjson_c_sha256: 7550914d58fb63b2c3546f3ccfbe11f1c094147bd31a69dcd23714d7956159e6
-  libjson_c_sha512: 4cbedd559502bf9014cfcd1d0bb8bb80d2abac4e969d95d4170123cd9cbafb0756b913fdbb83f666d14f674d6539a60ed1c5d0eb03c36b8037a2e00dc1636e19
+  libjson_c_version: 0.18
+  libjson_c_sha256: 876ab046479166b869afc6896d288183bbc0e5843f141200c677b3e8dfb11724
+  libjson_c_sha512: 4763f2352414dac3599bc2183b4fa57dbfaac0ca24de890097bd7d0bdda93c91efa280f6566e949e6d94212ef39a63fc76c5f9d0c54ff3d04b13c859717dba5a
 
   # renovate: datasource=github-releases depName=tukaani-project/xz
   # NOTE: using 5.4.5 the version debian downgraded to. Ref: https://www.openwall.com/lists/oss-security/2024/03/29/4