diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
index 46d8885..5a581d1 100644
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
       - id: go-version
         run: |
diff --git a/.github/workflows/make-self-upgrade.yaml b/.github/workflows/make-self-upgrade.yaml
index ed1a203..c2971c4 100644
--- a/.github/workflows/make-self-upgrade.yaml
+++ b/.github/workflows/make-self-upgrade.yaml
@@ -32,7 +32,7 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
       - id: go-version
         run: |
diff --git a/klone.yaml b/klone.yaml
index e196e3a..512fe6f 100644
--- a/klone.yaml
+++ b/klone.yaml
@@ -10,65 +10,65 @@ targets:
     - folder_name: boilerplate
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/boilerplate
     - folder_name: cert-manager
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/cert-manager
     - folder_name: controller-gen
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/controller-gen
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/generate-verify
     - folder_name: go
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/go
     - folder_name: helm
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/helm
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/help
     - folder_name: kind
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/kind
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/klone
     - folder_name: oci-build
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/oci-build
     - folder_name: oci-publish
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/oci-publish
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 90946d6b57c870ff3d100fc2d7546ee9f453c348
+      repo_hash: f3e160d4854e9b522f0d4150d41ddac049b0b85a
       repo_path: modules/tools
diff --git a/make/_shared/go/base/.github/workflows/govulncheck.yaml b/make/_shared/go/base/.github/workflows/govulncheck.yaml
index 46d8885..5a581d1 100644
--- a/make/_shared/go/base/.github/workflows/govulncheck.yaml
+++ b/make/_shared/go/base/.github/workflows/govulncheck.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
       - id: go-version
         run: |
diff --git a/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml b/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml
index ed1a203..c2971c4 100644
--- a/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml
+++ b/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml
@@ -32,7 +32,7 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
       - id: go-version
         run: |