diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8b8513096..14c6233e1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-06-25T05:52:46Z by kres 4c9f215.
+# Generated on 2024-07-03T10:20:21Z by kres 2c4ff8a.
 
 name: default
 concurrency:
@@ -81,6 +81,7 @@ jobs:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
       - name: Build
+        if: github.event_name == 'pull_request'
         run: |
           make
       - name: Build nonfree
diff --git a/Pkgfile b/Pkgfile
index 3e76577cb..901d25cd0 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -3,12 +3,12 @@
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.8.0-alpha.0-5-gd2746e5
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.8.0-alpha.0-6-g31ad71b
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
-  cni_version: v1.5.0
-  cni_sha256: 16754edd9d795aef56962b13db991addbb7669dab0a85adc5c7cbbf9c174e2e4
-  cni_sha512: cbe5ed422c9992261299d9b012d42402f0e824e39a867a88cf02df5b24de4339325b4c9ae152ae047712a71e08e1ae6b85491e3d4594a647fd8f46c1816ec9e7
+  cni_version: v1.5.1
+  cni_sha256: a2eff5f064f809ee41f8f49ef8aed1f0a4093c0c772f2ce2caaee4e6f395050a
+  cni_sha512: d2e01958dd8328407164cb6be9d962321742dae7011ce7cd7b2342f5e4b4bbcd992d8249c53d3d81250a60c27f049969bbf329a75440524f52c1f1466b6e7132
 
   # renovate: datasource=github-tags depName=containerd/containerd
   containerd_version: v2.0.0-rc.3
@@ -17,9 +17,9 @@ vars:
   containerd_sha512: d641e488b7348f7d24545ecd765681ef8131179bfdfb335205ca12a38966077eb1b107b6f9cde4f6787614be35d18740472f67557180c1ec0b957809e202d18d
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git
-  cryptsetup_version: 2.7.2
-  cryptsetup_sha256: 7a06c99fd902e857f96aa8313c4d347bd6c194db9cf229264ffe7793c0c5bfd7
-  cryptsetup_sha512: ba8f4aeda997242372e3e2eb4527babfd0ebf31fd28a2e894d7648d37b9a7a1845fb286f2769b3b3741340d68cdd7877d2f9be743bb3e4db9c053accf4640093
+  cryptsetup_version: 2.7.3
+  cryptsetup_sha256: 5dceb2fd06b7e675061dd958669a9324c4785c3f7a86a00779ba1e907ff43239
+  cryptsetup_sha512: 3b0fef4051c8c580f7def20144f37f1f7c917dbf8a90370ce027745c35d33780012a96b94a6928a3688c77ab72e74b9eba6396bb2f30a222f8125b7a83f99bf3
 
   # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=dosfstools/dosfstools
   dosfstools_version: 4.2
@@ -27,9 +27,9 @@ vars:
   dosfstools_sha512: 3cc0808edb4432428df8a67da4bb314fd1f27adc4a05754c1a492091741a7b6875ebd9f6a509cc4c5ad85643fc40395b6e0cadee548b25cc439cc9b725980156
 
   # renovate: datasource=github-tags extractVersion=^drbd-(?<version>.*)$ depName=LINBIT/drbd
-  drbd_version: 9.2.9
-  drbd_sha256: 30b1b4846bc08e390dc61b336e99dbf1f933594402d733e191e39a534579c778
-  drbd_sha512: 8c395fd4795112e4307115ebd5a158dc43709b78687858a07b7a5402223dbc537b923fce0abdf7fd16440ae12e2d4d6d449ebf45acc361d470ae130fbd073942
+  drbd_version: 9.2.10
+  drbd_sha256: 9d70b9930763a67800a894d25a9cc1d442fe7a2a9a3984831a7ddca341ecb988
+  drbd_sha512: 04fce63d995dff563750b6d8185e71b2c2ea8437c880ec523755307e7c51599b357c0f453ed4d7979612c0174a144d5e4ed8d9cfa801e40ba25c56ed0d027aa8
 
   # renovate: datasource=github-releases depName=eudev-project/eudev
   eudev_version: v3.2.14
@@ -63,9 +63,9 @@ vars:
   iptables_sha512: 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153
 
   # renovate: datasource=git-refs versioning=git depName=https://github.com/ipxe/ipxe.git
-  ipxe_ref: e965f179e1654103eca33feed7a9cc4c51d91be6
-  ipxe_sha256: 9f27554b8e177ec5789721c280b8074fdac7edaa5d6e6fc905980943c84c86b6
-  ipxe_sha512: 563f99dc8af0181875aa69a64eba99458186ae4c0f2216827d19830670f9a08a243aeda0a3a03df87613d33f764157d9a7a8f0f4e0e6808f895a3b1e5381c221
+  ipxe_ref: b66e27d9b29a172a097c737ab4d378d60fe01b05
+  ipxe_sha256: 46a6efa1d874aeb9d09278f71abbe784d338dedfbd81b5f644afea8c51c64af3
+  ipxe_sha512: ad18f513e3ffbda4865dc0b7b12d5d06249355ceb495bddb806e8315c1a92d11582d09fc5c301015bd3957507cceb116735bf9bd73fc219995e77dc9b70241cf
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
   linux_version: 6.6.36
@@ -114,9 +114,9 @@ vars:
   liburcu_sha512: 7297e51012f4c44ee27c0e18ed9d87bf24be34db68a5398394c1e683a045bb561cf74aa913398404c0ed5cb8011af728ea12947717fa5f27627e5ca78e63a40f
 
   # renovate: datasource=git-tags depName=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
-  linux_firmware_version: 20240513
-  linux_firmware_sha256: b7224364e1fd7ee6b803f861747f9ccde7c2030af939fdc1eeea083ea85ce51c
-  linux_firmware_sha512: 6c857897f466fafe5750a22f72d10958505f682eeba1e525bf102aaa067fa27f543e692e1ba52591ed9024688743a2936505e3ce66e1dd947b6de80111d8ee25
+  linux_firmware_version: 20240610
+  linux_firmware_sha256: fe7687f7264ef1193704824c884be515cd385c15303962cb85c929d40c6cd5b9
+  linux_firmware_sha512: fde9a5acb3407335227e7a2184335b21fc2c740503c6ff287f60ad10ae49ee86efaa07da1483a7075668820d16a040af4f87918ff5ff21b816fc42a98a1bfc0c
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://sourceware.org/git/lvm2.git
   lvm2_version: 2_03_22
diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64
index ac86d6e34..74920c238 100644
--- a/kernel/build/config-amd64
+++ b/kernel/build/config-amd64
@@ -2,9 +2,9 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.6.36 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.3.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=130200
+CONFIG_GCC_VERSION=130300
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
 CONFIG_AS_VERSION=24200
@@ -15,11 +15,10 @@ CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_TOOLS_SUPPORT_RELR=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
-CONFIG_PAHOLE_VERSION=126
+CONFIG_PAHOLE_VERSION=127
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_TABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
index b84c304b5..3a935b90c 100644
--- a/kernel/build/config-arm64
+++ b/kernel/build/config-arm64
@@ -2,9 +2,9 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/arm64 6.6.36 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.3.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=130200
+CONFIG_GCC_VERSION=130300
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
 CONFIG_AS_VERSION=24200
@@ -15,10 +15,9 @@ CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
-CONFIG_PAHOLE_VERSION=126
+CONFIG_PAHOLE_VERSION=127
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_TABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y