diff --git a/cmd/catalogd/main.go b/cmd/catalogd/main.go
index 64efd83edc..e6e4758b2e 100644
--- a/cmd/catalogd/main.go
+++ b/cmd/catalogd/main.go
@@ -37,8 +37,6 @@ import (
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/metadata"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -97,7 +95,6 @@ type config struct {
 	webhookPort          int
 	pullCasDir           string
 	globalPullSecret     string
-	kubeconfig           string
 	// Generated config
 	globalPullSecretKey *k8stypes.NamespacedName
 }
@@ -139,7 +136,6 @@ func init() {
 	flags.IntVar(&cfg.webhookPort, "webhook-server-port", 9443, "Webhook server port")
 	flags.StringVar(&cfg.pullCasDir, "pull-cas-dir", "", "The directory of TLS certificate authorities to use for verifying HTTPS connections to image registries.")
 	flags.StringVar(&cfg.globalPullSecret, "global-pull-secret", "", "Global pull secret (<namespace>/<name>)")
-	flags.StringVar(&cfg.kubeconfig, "kubeconfig", "", "Path to kubeconfig file for API server access. Uses in-cluster config if empty.")
 
 	// adds version subcommand
 	catalogdCmd.AddCommand(versionCommand)
@@ -277,20 +273,8 @@ func run(ctx context.Context) error {
 		return err
 	}
 
-	// Create manager with kubeconfig support for non-default kubeconfig
-	var restConfig *rest.Config
-	if cfg.kubeconfig != "" {
-		setupLog.Info("loading kubeconfig from file", "path", cfg.kubeconfig)
-		restConfig, err = clientcmd.BuildConfigFromFlags("", cfg.kubeconfig)
-		if err != nil {
-			setupLog.Error(err, "unable to load kubeconfig")
-			return err
-		}
-	} else {
-		restConfig = ctrl.GetConfigOrDie()
-	}
-
-	mgr, err := ctrl.NewManager(restConfig, ctrl.Options{
+	// Create manager
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                        scheme,
 		Metrics:                       metricsServerOptions,
 		PprofBindAddress:              cfg.pprofAddr,
diff --git a/cmd/operator-controller/main.go b/cmd/operator-controller/main.go
index 48104537e9..aeca882f01 100644
--- a/cmd/operator-controller/main.go
+++ b/cmd/operator-controller/main.go
@@ -30,6 +30,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"go.podman.io/image/v5/types"
+	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	apiextensionsv1client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
@@ -40,8 +41,6 @@ import (
 	"k8s.io/client-go/discovery/cached/memory"
 	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
 	"pkg.package-operator.run/boxcutter/managedcache"
@@ -106,7 +105,6 @@ type config struct {
 	catalogdCasDir       string
 	pullCasDir           string
 	globalPullSecret     string
-	kubeconfig           string
 }
 
 type reconcilerConfigurator interface {
@@ -186,7 +184,6 @@ func init() {
 	flags.StringVar(&cfg.cachePath, "cache-path", "/var/cache", "The local directory path used for filesystem based caching")
 	flags.StringVar(&cfg.systemNamespace, "system-namespace", "", "Configures the namespace that gets used to deploy system resources.")
 	flags.StringVar(&cfg.globalPullSecret, "global-pull-secret", "", "The <namespace>/<name> of the global pull secret that is going to be used to pull bundle images.")
-	flags.StringVar(&cfg.kubeconfig, "kubeconfig", "", "Path to kubeconfig file for API server access. Uses in-cluster config if empty.")
 
 	//adds version sub command
 	operatorControllerCmd.AddCommand(versionCommand)
@@ -328,18 +325,7 @@ func run() error {
 			"Metrics will not be served since the TLS certificate and key file are not provided.")
 	}
 
-	// Load REST config with kubeconfig support for non-default kubeconfig
-	var restConfig *rest.Config
-	if cfg.kubeconfig != "" {
-		setupLog.Info("loading kubeconfig from file", "path", cfg.kubeconfig)
-		restConfig, err = clientcmd.BuildConfigFromFlags("", cfg.kubeconfig)
-		if err != nil {
-			setupLog.Error(err, "unable to load kubeconfig")
-			return err
-		}
-	} else {
-		restConfig = ctrl.GetConfigOrDie()
-	}
+	restConfig := ctrl.GetConfigOrDie()
 	mgr, err := ctrl.NewManager(restConfig, ctrl.Options{
 		Scheme:                        scheme.Scheme,
 		Metrics:                       metricsServerOptions,
@@ -697,8 +683,13 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 		return fmt.Errorf("unable to create revision engine factory: %w", err)
 	}
 
+	cosClient := &secretFallbackClient{
+		Client:          c.mgr.GetClient(),
+		apiReader:       c.mgr.GetAPIReader(),
+		systemNamespace: cfg.systemNamespace,
+	}
 	if err = (&controllers.ClusterObjectSetReconciler{
-		Client:                c.mgr.GetClient(),
+		Client:                cosClient,
 		RevisionEngineFactory: revisionEngineFactory,
 		TrackingCache:         trackingCache,
 	}).SetupWithManager(c.mgr); err != nil {
@@ -791,3 +782,18 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+// secretFallbackClient wraps a cached client.Client and falls back to direct
+// API reads for Secrets outside the system namespace, where the cache does not watch.
+type secretFallbackClient struct {
+	client.Client
+	apiReader       client.Reader
+	systemNamespace string
+}
+
+func (c *secretFallbackClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+	if _, isSecret := obj.(*corev1.Secret); isSecret && key.Namespace != c.systemNamespace {
+		return c.apiReader.Get(ctx, key, obj, opts...)
+	}
+	return c.Client.Get(ctx, key, obj, opts...)
+}
diff --git a/go.mod b/go.mod
index 4791c92170..fbdb616f60 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/google/go-containerregistry v0.21.3
 	github.com/google/renameio/v2 v2.0.2
 	github.com/gorilla/handlers v1.5.2
-	github.com/klauspost/compress v1.18.4
+	github.com/klauspost/compress v1.18.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/operator-framework/api v0.41.0
@@ -113,7 +113,7 @@ require (
 	github.com/go-git/go-billy/v5 v5.8.0 // indirect
 	github.com/go-git/go-git/v5 v5.17.1 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.22.5 // indirect
 	github.com/go-openapi/jsonreference v0.21.5 // indirect
diff --git a/go.sum b/go.sum
index 73dc32859b..d1f115207d 100644
--- a/go.sum
+++ b/go.sum
@@ -163,8 +163,8 @@ github.com/go-git/go-git/v5 v5.17.1 h1:WnljyxIzSj9BRRUlnmAU35ohDsjRK0EKmL0evDqi5
 github.com/go-git/go-git/v5 v5.17.1/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -324,8 +324,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
diff --git a/hack/tools/update-tls-profiles.sh b/hack/tools/update-tls-profiles.sh
index 8fa61c43ee..01618a3182 100755
--- a/hack/tools/update-tls-profiles.sh
+++ b/hack/tools/update-tls-profiles.sh
@@ -13,16 +13,38 @@ INPUT=https://ssl-config.mozilla.org/guidelines/latest.json
 TMPFILE="$(mktemp)"
 trap 'rm -rf "$TMPFILE"' EXIT
 
-curl -L -s ${INPUT} > ${TMPFILE}
+if ! curl -L -s -f "${INPUT}" > "${TMPFILE}"; then
+    echo "ERROR: Failed to download ${INPUT} (HTTP error or connection failure)" >&2
+    exit 1
+fi
+
+if ! ${JQ} empty "${TMPFILE}" 2>/dev/null; then
+    echo "ERROR: Downloaded data from ${INPUT} is not valid JSON" >&2
+    exit 1
+fi
+
+# Extract stored version from current output file (may be empty on first run)
+STORED_VERSION=$(grep '^// DATA VERSION:' "${OUTPUT}" 2>/dev/null | awk '{print $4}' || true)
 
-version=$(${JQ} -r '.version' ${TMPFILE})
+# Extract version from downloaded JSON and fail early if missing
+NEW_VERSION=$(${JQ} -r '.version' "${TMPFILE}")
+if [ -z "${NEW_VERSION}" ] || [ "${NEW_VERSION}" = "null" ]; then
+    echo "ERROR: Could not read .version from ${INPUT}" >&2
+    exit 1
+fi
+
+if [ "${NEW_VERSION}" = "${STORED_VERSION}" ]; then
+    echo "Mozilla TLS data is already at version ${NEW_VERSION}, skipping regeneration."
+    exit 0
+fi
+echo "Updating Mozilla TLS data from version ${STORED_VERSION:-unknown} to ${NEW_VERSION}"
 
-cat > ${OUTPUT} <<EOF
+cat > "${OUTPUT}" <<EOF
 package tlsprofiles
 
 // DO NOT EDIT, GENERATED BY ${0}
 // DATA SOURCE: ${INPUT}
-// DATA VERSION: ${version}
+// DATA VERSION: ${NEW_VERSION}
 
 import (
 "crypto/tls"
@@ -30,30 +52,68 @@ import (
 EOF
 
 function generate_profile {
-    cat >> ${OUTPUT} <<EOF
-
-var ${1}TLSProfile = tlsProfile{
+    local profile="${1}"
+
+    # Validate the profile key exists before writing any output
+    local exists
+    exists=$(${JQ} -r ".configurations | has(\"${profile}\")" "${TMPFILE}")
+    if [ "${exists}" != "true" ]; then
+        echo "ERROR: Profile '${profile}' not found in ${INPUT} (version ${NEW_VERSION})" >&2
+        echo "Available profiles: $(${JQ} -r '.configurations | keys | join(", ")' "${TMPFILE}")" >&2
+        exit 1
+    fi
+
+    # Validate tls_versions is a non-empty array with a non-null first entry
+    if ! ${JQ} -e ".configurations.${profile}.tls_versions | type == \"array\" and length > 0 and .[0] != null" "${TMPFILE}" >/dev/null; then
+        echo "ERROR: Missing or empty .configurations.${profile}.tls_versions[0] in ${INPUT}" >&2
+        exit 1
+    fi
+
+    # Validate that at least one cipher is present across ciphersuites and ciphers.iana
+    # (modern has only ciphersuites; intermediate has both; either alone is valid)
+    local cipher_count
+    cipher_count=$(${JQ} -r "
+        [
+            (.configurations.${profile}.ciphersuites // []),
+            (.configurations.${profile}.ciphers.iana // [])
+        ] | add | length" "${TMPFILE}")
+    if [ "${cipher_count}" -eq 0 ] 2>/dev/null; then
+        echo "ERROR: Profile '${profile}' has no ciphers in ciphersuites or ciphers.iana" >&2
+        exit 1
+    fi
+
+    # Validate tls_curves is non-empty
+    local curve_count
+    curve_count=$(${JQ} -r ".configurations.${profile}.tls_curves | length" "${TMPFILE}")
+    if [ "${curve_count}" -eq 0 ] 2>/dev/null; then
+        echo "ERROR: Profile '${profile}' has no entries in tls_curves" >&2
+        exit 1
+    fi
+
+    cat >> "${OUTPUT}" <<EOF
+
+var ${profile}TLSProfile = tlsProfile{
 ciphers: cipherSlice{
 cipherNums: []uint16{
 EOF
 
-    ${JQ} -r ".configurations.$1.ciphersuites.[] | . |= \"tls.\" + . + \",\"" ${TMPFILE} >> ${OUTPUT}
-    ${JQ} -r ".configurations.$1.ciphers.go[] | . |= \"tls.\" + . + \",\"" ${TMPFILE} >> ${OUTPUT}
+    ${JQ} -r "(.configurations.${profile}.ciphersuites // [])[] | . |= \"tls.\" + . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
+    ${JQ} -r "(.configurations.${profile}.ciphers.iana // [])[] | . |= \"tls.\" + . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
 
-    cat >> ${OUTPUT} <<EOF
+    cat >> "${OUTPUT}" <<EOF
 },
 },
 curves: curveSlice{
 curveNums: []tls.CurveID{
 EOF
 
-    ${JQ} -r ".configurations.$1.tls_curves[] | . |= . + \",\"" ${TMPFILE} >> ${OUTPUT}
+    ${JQ} -r ".configurations.${profile}.tls_curves[] | . |= . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
 
-    version=$(${JQ} -r ".configurations.$1.tls_versions[0]" ${TMPFILE})
+    version=$(${JQ} -r ".configurations.${profile}.tls_versions[0]" "${TMPFILE}")
     version=${version/TLSv1./tls.VersionTLS1}
     version=${version/TLSv1/tls.VersionTLS10}
 
-    cat >> ${OUTPUT} <<EOF
+    cat >> "${OUTPUT}" <<EOF
 },
 },
 minTLSVersion: ${version},
@@ -63,7 +123,10 @@ EOF
 
 generate_profile "modern"
 generate_profile "intermediate"
-generate_profile "old"
+
+# Remove unsupported ciphers from Go's crypto/tls package
+sed -i.bak '/TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384/d; /TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/d; /TLS_RSA_WITH_AES_256_CBC_SHA256/d' "${OUTPUT}"
+rm -f "${OUTPUT}.bak"
 
 # Make go happy
-go fmt ${OUTPUT}
+go fmt "${OUTPUT}"
diff --git a/helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml b/helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml
index 092cb7a24e..ac69bce6a4 100644
--- a/helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml
+++ b/helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml
@@ -12,11 +12,11 @@ metadata:
   namespace: {{ .Values.namespaces.olmv1.name }}
 spec:
   minReadySeconds: 5
-  replicas: 1
+  replicas: {{ .Values.options.catalogd.deployment.replicas }}
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml b/helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml
index 249610244d..bea8f0404f 100644
--- a/helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml
+++ b/helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml
@@ -11,11 +11,11 @@ metadata:
   name: operator-controller-controller-manager
   namespace: {{ .Values.namespaces.olmv1.name }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.options.operatorController.deployment.replicas }}
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml b/helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml
index d6f9e87909..1d096c82b5 100644
--- a/helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml
+++ b/helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml
@@ -86,6 +86,12 @@ rules:
     verbs:
       - list
       - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
   - apiGroups:
       - olm.operatorframework.io
     resources:
diff --git a/helm/olmv1/values.yaml b/helm/olmv1/values.yaml
index cb454f6250..c5845b9a1b 100644
--- a/helm/olmv1/values.yaml
+++ b/helm/olmv1/values.yaml
@@ -8,6 +8,7 @@ options:
     enabled: true
     deployment:
       image: quay.io/operator-framework/operator-controller:devel
+      replicas: 1
       extraArguments: []
     features:
       enabled: []
@@ -19,6 +20,7 @@ options:
     enabled: true
     deployment:
       image: quay.io/operator-framework/catalogd:devel
+      replicas: 1
       extraArguments: []
     features:
       enabled: []
diff --git a/internal/shared/util/tlsprofiles/mozilla_data.go b/internal/shared/util/tlsprofiles/mozilla_data.go
index 6b74ade2d8..43789b7e8e 100644
--- a/internal/shared/util/tlsprofiles/mozilla_data.go
+++ b/internal/shared/util/tlsprofiles/mozilla_data.go
@@ -2,7 +2,7 @@ package tlsprofiles
 
 // DO NOT EDIT, GENERATED BY hack/tools/update-tls-profiles.sh
 // DATA SOURCE: https://ssl-config.mozilla.org/guidelines/latest.json
-// DATA VERSION: 5.7
+// DATA VERSION: 6
 
 import (
 	"crypto/tls"
@@ -18,6 +18,7 @@ var modernTLSProfile = tlsProfile{
 	},
 	curves: curveSlice{
 		curveNums: []tls.CurveID{
+			X25519MLKEM768,
 			X25519,
 			prime256v1,
 			secp384r1,
@@ -36,12 +37,13 @@ var intermediateTLSProfile = tlsProfile{
 			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
 			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
 		},
 	},
 	curves: curveSlice{
 		curveNums: []tls.CurveID{
+			X25519MLKEM768,
 			X25519,
 			prime256v1,
 			secp384r1,
@@ -49,39 +51,3 @@ var intermediateTLSProfile = tlsProfile{
 	},
 	minTLSVersion: tls.VersionTLS12,
 }
-
-var oldTLSProfile = tlsProfile{
-	ciphers: cipherSlice{
-		cipherNums: []uint16{
-			tls.TLS_AES_128_GCM_SHA256,
-			tls.TLS_AES_256_GCM_SHA384,
-			tls.TLS_CHACHA20_POLY1305_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
-			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-		},
-	},
-	curves: curveSlice{
-		curveNums: []tls.CurveID{
-			X25519,
-			prime256v1,
-			secp384r1,
-		},
-	},
-	minTLSVersion: tls.VersionTLS10,
-}
diff --git a/internal/shared/util/tlsprofiles/old_profile.go b/internal/shared/util/tlsprofiles/old_profile.go
new file mode 100644
index 0000000000..5fdec27a4d
--- /dev/null
+++ b/internal/shared/util/tlsprofiles/old_profile.go
@@ -0,0 +1,47 @@
+package tlsprofiles
+
+// This file contains a static copy of the Mozilla "old" TLS compatibility profile
+// from version 5.8 of the SSL Configuration Generator. The "old" profile was
+// removed from the Mozilla specification in later versions but is preserved here
+// for backward compatibility with older clients.
+//
+// Source: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+import "crypto/tls"
+
+var oldTLSProfile = tlsProfile{
+	ciphers: cipherSlice{
+		cipherNums: []uint16{
+			tls.TLS_AES_128_GCM_SHA256,
+			tls.TLS_AES_256_GCM_SHA384,
+			tls.TLS_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
+			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+		},
+	},
+	curves: curveSlice{
+		curveNums: []tls.CurveID{
+			X25519MLKEM768,
+			X25519,
+			prime256v1,
+			secp384r1,
+		},
+	},
+	minTLSVersion: tls.VersionTLS10,
+}
diff --git a/internal/shared/util/tlsprofiles/tlsprofiles.go b/internal/shared/util/tlsprofiles/tlsprofiles.go
index bac6586101..b09fd4d125 100644
--- a/internal/shared/util/tlsprofiles/tlsprofiles.go
+++ b/internal/shared/util/tlsprofiles/tlsprofiles.go
@@ -69,17 +69,19 @@ func cipherSuiteId(name string) uint16 {
 
 // This is primarily so that we don't have to rewrite curve values in mozilla_data.go
 const (
-	X25519     tls.CurveID = tls.X25519
-	prime256v1 tls.CurveID = tls.CurveP256
-	secp384r1  tls.CurveID = tls.CurveP384
-	secp521r1  tls.CurveID = tls.CurveP521
+	X25519MLKEM768 tls.CurveID = tls.X25519MLKEM768
+	X25519         tls.CurveID = tls.X25519
+	prime256v1     tls.CurveID = tls.CurveP256
+	secp384r1      tls.CurveID = tls.CurveP384
+	secp521r1      tls.CurveID = tls.CurveP521
 )
 
 var curves = map[string]tls.CurveID{
-	"X25519":     tls.X25519,
-	"prime256v1": tls.CurveP256,
-	"secp384r1":  tls.CurveP384,
-	"secp521r1":  tls.CurveP521,
+	"X25519MLKEM768": tls.X25519MLKEM768,
+	"X25519":         tls.X25519,
+	"prime256v1":     tls.CurveP256,
+	"secp384r1":      tls.CurveP384,
+	"secp521r1":      tls.CurveP521,
 }
 
 // Returns 0 for an invalid curve name
diff --git a/internal/shared/util/tlsprofiles/tlsprofiles_test.go b/internal/shared/util/tlsprofiles/tlsprofiles_test.go
index 7be0903f79..e779842834 100644
--- a/internal/shared/util/tlsprofiles/tlsprofiles_test.go
+++ b/internal/shared/util/tlsprofiles/tlsprofiles_test.go
@@ -1,40 +1,20 @@
 package tlsprofiles
 
 import (
+	"crypto/tls"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
-func TestGetProfiles(t *testing.T) {
-	tests := []struct {
-		name   tlsProfileName
-		result bool
-	}{
-		{"modern", true},
-		{"intermediate", true},
-		{"old", true},
-		{"custom", true},
-		{"does-not-exist", false},
-	}
-
-	for _, test := range tests {
-		p, err := findTLSProfile(test.name)
-		if !test.result {
-			require.Error(t, err)
-		} else {
-			require.NoError(t, err)
-			require.NotNil(t, p)
-		}
-	}
-}
-
 func TestGetTLSConfigFunc(t *testing.T) {
 	f, err := GetTLSConfigFunc()
 	require.NoError(t, err)
 	require.NotNil(t, f)
 
-	// Set an invalid profile
+	// Set an invalid profile and restore afterwards
+	orig := configuredProfile
+	t.Cleanup(func() { configuredProfile = orig })
 	configuredProfile = "does-not-exist"
 	f, err = GetTLSConfigFunc()
 	require.Error(t, err)
@@ -114,6 +94,7 @@ func TestSetCustomCurves(t *testing.T) {
 		name   string
 		result bool
 	}{
+		{"X25519MLKEM768", true}, // Post-quantum hybrid curve (Go 1.24+)
 		{"X25519", true},
 		{"prime256v1", true},
 		{"secp384r1", true},
@@ -158,3 +139,30 @@ func TestSetCustomVersion(t *testing.T) {
 		}
 	}
 }
+
+func TestOldProfileMinVersion(t *testing.T) {
+	require.EqualValues(t, tls.VersionTLS10, oldTLSProfile.minTLSVersion)
+}
+
+func TestOldProfileCiphers(t *testing.T) {
+	ciphers := oldTLSProfile.ciphers.cipherNums
+	// v5.8 old profile has exactly 21 ciphers
+	require.Len(t, ciphers, 21, "old profile cipher count changed unexpectedly")
+	// Legacy CBC cipher present in old but not modern/intermediate
+	require.Contains(t, ciphers, tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA)
+	// Most legacy cipher (3DES insecure)
+	require.Contains(t, ciphers, tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA)
+	// TLS 1.3 cipher shared with all profiles
+	require.Contains(t, ciphers, tls.TLS_AES_128_GCM_SHA256)
+}
+
+func TestProfilesMapCompleteness(t *testing.T) {
+	for _, name := range []string{"modern", "intermediate", "old", "custom"} {
+		p, err := findTLSProfile(tlsProfileName(name))
+		require.NoErrorf(t, err, "profile %q must be in profiles map", name)
+		require.NotNilf(t, p, "profile %q must not be nil", name)
+	}
+	require.GreaterOrEqual(t, len(profiles), 4, "profiles map must contain at least the required built-in profiles")
+	_, err := findTLSProfile(tlsProfileName("does-not-exist"))
+	require.Error(t, err, "looking up a non-existent profile must return an error")
+}
diff --git a/manifests/experimental-e2e.yaml b/manifests/experimental-e2e.yaml
index dcb4fac364..4a27cf2056 100644
--- a/manifests/experimental-e2e.yaml
+++ b/manifests/experimental-e2e.yaml
@@ -2167,6 +2167,12 @@ rules:
     verbs:
       - list
       - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
   - apiGroups:
       - olm.operatorframework.io
     resources:
@@ -2576,7 +2582,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
@@ -2727,7 +2733,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/manifests/experimental.yaml b/manifests/experimental.yaml
index dc9a02a4f9..9a8fa0b406 100644
--- a/manifests/experimental.yaml
+++ b/manifests/experimental.yaml
@@ -2128,6 +2128,12 @@ rules:
     verbs:
       - list
       - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
   - apiGroups:
       - olm.operatorframework.io
     resources:
@@ -2496,7 +2502,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
@@ -2634,7 +2640,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/manifests/standard-e2e.yaml b/manifests/standard-e2e.yaml
index f68e17f746..a3a72e89f9 100644
--- a/manifests/standard-e2e.yaml
+++ b/manifests/standard-e2e.yaml
@@ -1782,7 +1782,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
@@ -1932,7 +1932,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/manifests/standard.yaml b/manifests/standard.yaml
index 6db6b21ad9..ad02f96e2e 100644
--- a/manifests/standard.yaml
+++ b/manifests/standard.yaml
@@ -1702,7 +1702,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
@@ -1839,7 +1839,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1          # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0    # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/openshift/catalogd/manifests-experimental.yaml b/openshift/catalogd/manifests-experimental.yaml
index 27dae4b68c..50ec4aba9c 100644
--- a/openshift/catalogd/manifests-experimental.yaml
+++ b/openshift/catalogd/manifests-experimental.yaml
@@ -829,7 +829,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1 # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1 # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0 # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/openshift/catalogd/manifests.yaml b/openshift/catalogd/manifests.yaml
index 2a2d09e039..5b8f16cc73 100644
--- a/openshift/catalogd/manifests.yaml
+++ b/openshift/catalogd/manifests.yaml
@@ -829,7 +829,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1 # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1 # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0 # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/openshift/operator-controller/manifests-experimental.yaml b/openshift/operator-controller/manifests-experimental.yaml
index f48e1e5b83..47fe2af589 100644
--- a/openshift/operator-controller/manifests-experimental.yaml
+++ b/openshift/operator-controller/manifests-experimental.yaml
@@ -1188,7 +1188,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1 # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1 # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0 # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/openshift/operator-controller/manifests.yaml b/openshift/operator-controller/manifests.yaml
index a92a899bfb..f8d8b1fed4 100644
--- a/openshift/operator-controller/manifests.yaml
+++ b/openshift/operator-controller/manifests.yaml
@@ -1060,7 +1060,7 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1 # Allow temporary 2 pods (1 + 1) for zero-downtime updates
+      maxSurge: 1 # Allow temporary extra pod for zero-downtime updates
       maxUnavailable: 0 # Never allow pods to be unavailable during updates
   selector:
     matchLabels:
diff --git a/openshift/tests-extension/go.sum b/openshift/tests-extension/go.sum
index ee8641d5b0..2a93000c4d 100644
--- a/openshift/tests-extension/go.sum
+++ b/openshift/tests-extension/go.sum
@@ -98,8 +98,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
diff --git a/requirements.txt b/requirements.txt
index d19a721cd3..e2076a4de0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -14,7 +14,7 @@ markdown2==2.5.5
 MarkupSafe==3.0.3
 mergedeep==1.3.4
 mkdocs==1.6.1
-mkdocs-material==9.7.5
+mkdocs-material==9.7.6
 mkdocs-material-extensions==1.3.1
 packaging==26.0
 paginate==0.5.7
diff --git a/test/e2e/features/install.feature b/test/e2e/features/install.feature
index 9b7025d9a9..96b1cbb92f 100644
--- a/test/e2e/features/install.feature
+++ b/test/e2e/features/install.feature
@@ -524,12 +524,15 @@ Feature: Install ClusterExtension
       """
     Then ClusterExtension is rolled out
     And ClusterExtension is available
-    And ClusterObjectSet "${NAME}-1" phase objects use refs
-    And ClusterObjectSet "${NAME}-1" ref Secrets exist in "olmv1-system" namespace
-    And ClusterObjectSet "${NAME}-1" ref Secrets are immutable
-    And ClusterObjectSet "${NAME}-1" ref Secrets are labeled with revision and owner
-    And ClusterObjectSet "${NAME}-1" ref Secrets have ownerReference to the revision
-    And ClusterObjectSet "${NAME}-1" ref Secrets have type "olm.operatorframework.io/object-data"
+    And ClusterObjectSet "${NAME}-1" phase objects are managed in Kubernetes secrets
+    And ClusterObjectSet "${NAME}-1" referred secrets exist in "olmv1-system" namespace
+    And ClusterObjectSet "${NAME}-1" referred secrets are immutable
+    And ClusterObjectSet "${NAME}-1" referred secrets contain labels
+      | key                                          | value     |
+      | olm.operatorframework.io/revision-name       | ${NAME}-1 |
+      | olm.operatorframework.io/owner-name          | ${NAME}   |
+    And ClusterObjectSet "${NAME}-1" referred secrets are owned by the object set
+    And ClusterObjectSet "${NAME}-1" referred secrets have type "olm.operatorframework.io/object-data"
 
   @DeploymentConfig
   Scenario: deploymentConfig nodeSelector is applied to the operator deployment
diff --git a/test/e2e/features/revision.feature b/test/e2e/features/revision.feature
index d07e3fb198..dd6d9e9407 100644
--- a/test/e2e/features/revision.feature
+++ b/test/e2e/features/revision.feature
@@ -338,4 +338,108 @@ Feature: Install ClusterObjectSet
     And resource "pod/test-pod" is installed
     And resource "configmap/test-configmap-3" is installed
     And ClusterObjectSet "${COS_NAME}" reports Progressing as True with Reason Succeeded
-    And ClusterObjectSet "${COS_NAME}" reports Available as True with Reason ProbesSucceeded
\ No newline at end of file
+    And ClusterObjectSet "${COS_NAME}" reports Available as True with Reason ProbesSucceeded
+
+  Scenario: User can install a ClusterObjectSet with objects stored in Secrets
+    Given ServiceAccount "olm-sa" with needed permissions is available in test namespace
+    When resource is applied
+      """
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: ${COS_NAME}-ref-secret
+        namespace: ${TEST_NAMESPACE}
+      immutable: true
+      type: olm.operatorframework.io/object-data
+      stringData:
+        configmap: |
+          {
+            "apiVersion": "v1",
+            "kind": "ConfigMap",
+            "metadata": {
+              "name": "test-configmap-ref",
+              "namespace": "${TEST_NAMESPACE}"
+            },
+            "data": {
+              "key": "value"
+            }
+          }
+        deployment: |
+          {
+            "apiVersion": "apps/v1",
+            "kind": "Deployment",
+            "metadata": {
+              "name": "test-httpd",
+              "namespace": "${TEST_NAMESPACE}",
+              "labels": {
+                "app": "test-httpd"
+              }
+            },
+            "spec": {
+              "replicas": 1,
+              "selector": {
+                "matchLabels": {
+                  "app": "test-httpd"
+                }
+              },
+              "template": {
+                "metadata": {
+                  "labels": {
+                    "app": "test-httpd"
+                  }
+                },
+                "spec": {
+                  "containers": [
+                    {
+                      "name": "httpd",
+                      "image": "busybox:1.36",
+                      "imagePullPolicy": "IfNotPresent",
+                      "command": ["httpd"],
+                      "args": ["-f", "-p", "8080"],
+                      "securityContext": {
+                        "runAsNonRoot": true,
+                        "runAsUser": 1000,
+                        "allowPrivilegeEscalation": false,
+                        "capabilities": {
+                          "drop": ["ALL"]
+                        },
+                        "seccompProfile": {
+                          "type": "RuntimeDefault"
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+      """
+    And ClusterObjectSet is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterObjectSet
+      metadata:
+        annotations:
+          olm.operatorframework.io/service-account-name: olm-sa
+          olm.operatorframework.io/service-account-namespace: ${TEST_NAMESPACE}
+        name: ${COS_NAME}
+      spec:
+        lifecycleState: Active
+        collisionProtection: Prevent
+        phases:
+        - name: resources
+          objects:
+          - ref:
+              name: ${COS_NAME}-ref-secret
+              namespace: ${TEST_NAMESPACE}
+              key: configmap
+          - ref:
+              name: ${COS_NAME}-ref-secret
+              namespace: ${TEST_NAMESPACE}
+              key: deployment
+        revision: 1
+      """
+    Then ClusterObjectSet "${COS_NAME}" reports Progressing as True with Reason Succeeded
+    And ClusterObjectSet "${COS_NAME}" reports Available as True with Reason ProbesSucceeded
+    And resource "configmap/test-configmap-ref" is installed
+    And resource "deployment/test-httpd" is installed
\ No newline at end of file
diff --git a/test/e2e/steps/hooks.go b/test/e2e/steps/hooks.go
index ccce95efc5..5d73bcbed2 100644
--- a/test/e2e/steps/hooks.go
+++ b/test/e2e/steps/hooks.go
@@ -22,8 +22,9 @@ import (
 )
 
 type resource struct {
-	name string
-	kind string
+	name      string
+	kind      string
+	namespace string
 }
 
 type scenarioContext struct {
@@ -195,8 +196,12 @@ func ScenarioCleanup(ctx context.Context, _ *godog.Scenario, err error) (context
 	forDeletion = append(forDeletion, resource{name: sc.namespace, kind: "namespace"})
 	for _, r := range forDeletion {
 		go func(res resource) {
-			if _, err := k8sClient("delete", res.kind, res.name, "--ignore-not-found=true"); err != nil {
-				logger.Info("Error deleting resource", "name", res.name, "namespace", sc.namespace, "stderr", stderrOutput(err))
+			args := []string{"delete", res.kind, res.name, "--ignore-not-found=true"}
+			if res.namespace != "" {
+				args = append(args, "-n", res.namespace)
+			}
+			if _, err := k8sClient(args...); err != nil {
+				logger.Info("Error deleting resource", "name", res.name, "namespace", res.namespace, "stderr", stderrOutput(err))
 			}
 		}(r)
 	}
diff --git a/test/e2e/steps/steps.go b/test/e2e/steps/steps.go
index 1f0bbb3ec5..2b5603ab79 100644
--- a/test/e2e/steps/steps.go
+++ b/test/e2e/steps/steps.go
@@ -96,12 +96,12 @@ func RegisterSteps(sc *godog.ScenarioContext) {
 	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" contains annotation "([^"]+)" with value$`, ClusterObjectSetHasAnnotationWithValue)
 	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" has label "([^"]+)" with value "([^"]+)"$`, ClusterObjectSetHasLabelWithValue)
 	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" phase objects are not found or not owned by the revision$`, ClusterObjectSetObjectsNotFoundOrNotOwned)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" phase objects use refs$`, ClusterObjectSetPhaseObjectsUseRefs)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" ref Secrets exist in "([^"]+)" namespace$`, ClusterObjectSetRefSecretsExist)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" ref Secrets are immutable$`, ClusterObjectSetRefSecretsAreImmutable)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" ref Secrets are labeled with revision and owner$`, ClusterObjectSetRefSecretsLabeled)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" ref Secrets have ownerReference to the revision$`, ClusterObjectSetRefSecretsHaveOwnerRef)
-	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" ref Secrets have type "([^"]+)"$`, ClusterObjectSetReferredSecretsHaveType)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" phase objects are managed in Kubernetes secrets$`, ClusterObjectSetPhaseObjectsManagedInSecrets)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" referred secrets exist in "([^"]+)" namespace$`, ClusterObjectSetReferredSecretsExist)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" referred secrets are immutable$`, ClusterObjectSetReferredSecretsAreImmutable)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" referred secrets contain labels$`, ClusterObjectSetReferredSecretsContainLabels)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" referred secrets are owned by the object set$`, ClusterObjectSetReferredSecretsOwnedByObjectSet)
+	sc.Step(`^(?i)ClusterObjectSet "([^"]+)" referred secrets have type "([^"]+)"$`, ClusterObjectSetReferredSecretsHaveType)
 
 	sc.Step(`^(?i)resource "([^"]+)" is installed$`, ResourceAvailable)
 	sc.Step(`^(?i)resource "([^"]+)" is available$`, ResourceAvailable)
@@ -310,6 +310,16 @@ func ResourceIsApplied(ctx context.Context, yamlTemplate *godog.DocString) error
 		sc.clusterExtensionName = res.GetName()
 	} else if res.GetKind() == "ClusterObjectSet" {
 		sc.clusterObjectSetName = res.GetName()
+	} else {
+		namespace := res.GetNamespace()
+		if namespace == "" {
+			namespace = sc.namespace
+		}
+		sc.addedResources = append(sc.addedResources, resource{
+			name:      res.GetName(),
+			kind:      strings.ToLower(res.GetKind()),
+			namespace: namespace,
+		})
 	}
 	return nil
 }
@@ -715,9 +725,9 @@ func ClusterObjectSetObjectsNotFoundOrNotOwned(ctx context.Context, revisionName
 	return nil
 }
 
-// ClusterObjectSetPhaseObjectsUseRefs verifies that every object in every phase of the named
+// ClusterObjectSetPhaseObjectsManagedInSecrets verifies that every object in every phase of the named
 // ClusterObjectSet uses a ref (not an inline object). Polls with timeout.
-func ClusterObjectSetPhaseObjectsUseRefs(ctx context.Context, revisionName string) error {
+func ClusterObjectSetPhaseObjectsManagedInSecrets(ctx context.Context, revisionName string) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 
@@ -761,14 +771,14 @@ func ClusterObjectSetPhaseObjectsUseRefs(ctx context.Context, revisionName strin
 	return nil
 }
 
-// ClusterObjectSetRefSecretsExist verifies that all Secrets referenced by the named
+// ClusterObjectSetReferredSecretsExist verifies that all Secrets referenced by the named
 // ClusterObjectSet's phase objects exist in the given namespace. Polls with timeout.
-func ClusterObjectSetRefSecretsExist(ctx context.Context, revisionName, namespace string) error {
+func ClusterObjectSetReferredSecretsExist(ctx context.Context, revisionName, namespace string) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 	namespace = substituteScenarioVars(strings.TrimSpace(namespace), sc)
 
-	secretNames, err := collectRefSecretNames(ctx, revisionName)
+	secretNames, err := collectReferredSecretNames(ctx, revisionName)
 	if err != nil {
 		return err
 	}
@@ -782,64 +792,59 @@ func ClusterObjectSetRefSecretsExist(ctx context.Context, revisionName, namespac
 	return nil
 }
 
-// ClusterObjectSetRefSecretsAreImmutable verifies that all ref Secrets for the named
+// ClusterObjectSetReferredSecretsAreImmutable verifies that all referred Secrets for the named
 // ClusterObjectSet are immutable. Polls with timeout.
-func ClusterObjectSetRefSecretsAreImmutable(ctx context.Context, revisionName string) error {
+func ClusterObjectSetReferredSecretsAreImmutable(ctx context.Context, revisionName string) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 
-	secrets, err := listRefSecrets(ctx, revisionName)
+	secrets, err := listReferredSecrets(ctx, revisionName)
 	if err != nil {
 		return err
 	}
 	if len(secrets) == 0 {
-		return fmt.Errorf("no ref Secrets found for revision %q", revisionName)
+		return fmt.Errorf("no referred secrets found for revision %q", revisionName)
 	}
 	for _, s := range secrets {
 		if s.Immutable == nil || !*s.Immutable {
-			return fmt.Errorf("ref Secret %s/%s is not immutable", s.Namespace, s.Name)
+			return fmt.Errorf("referred secret %s/%s is not immutable", s.Namespace, s.Name)
 		}
 	}
 	return nil
 }
 
-// ClusterObjectSetRefSecretsLabeled verifies that all ref Secrets for the named
-// ClusterObjectSet have the expected revision-name and owner-name labels.
-func ClusterObjectSetRefSecretsLabeled(ctx context.Context, revisionName string) error {
+// ClusterObjectSetReferredSecretsContainLabels verifies that all referred Secrets for the named
+// ClusterObjectSet have the expected labels specified in the data table. Polls with timeout.
+func ClusterObjectSetReferredSecretsContainLabels(ctx context.Context, revisionName string, table *godog.Table) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 
-	secrets, err := listRefSecrets(ctx, revisionName)
+	expected, err := parseKeyValueTable(table)
 	if err != nil {
-		return err
-	}
-	if len(secrets) == 0 {
-		return fmt.Errorf("no ref Secrets found for revision %q", revisionName)
+		return fmt.Errorf("invalid labels table: %w", err)
 	}
-
-	// Get the owner name from the ClusterObjectSet's own labels.
-	cosObj, err := getResource("clusterobjectset", revisionName, "")
-	if err != nil {
-		return fmt.Errorf("getting ClusterObjectSet %q: %w", revisionName, err)
+	for k, v := range expected {
+		expected[k] = substituteScenarioVars(v, sc)
 	}
-	expectedOwner := cosObj.GetLabels()["olm.operatorframework.io/owner-name"]
 
-	for _, s := range secrets {
-		revLabel := s.Labels["olm.operatorframework.io/revision-name"]
-		if revLabel != revisionName {
-			return fmt.Errorf("secret %s/%s has revision-name label %q, expected %q", s.Namespace, s.Name, revLabel, revisionName)
+	waitFor(ctx, func() bool {
+		secrets, err := listReferredSecrets(ctx, revisionName)
+		if err != nil || len(secrets) == 0 {
+			return false
 		}
-		ownerLabel := s.Labels["olm.operatorframework.io/owner-name"]
-		if expectedOwner != "" && ownerLabel != expectedOwner {
-			return fmt.Errorf("secret %s/%s has owner-name label %q, expected %q", s.Namespace, s.Name, ownerLabel, expectedOwner)
+		for _, s := range secrets {
+			if _, _, ok := matchLabels(s.Labels, expected); !ok {
+				return false
+			}
 		}
-	}
+		return true
+	})
 	return nil
 }
 
-// ClusterObjectSetRefSecretsHaveOwnerRef verifies that all ref Secrets for the named
+// ClusterObjectSetReferredSecretsOwnedByObjectSet verifies that all referred Secrets for the named
 // ClusterObjectSet have an ownerReference pointing to the ClusterObjectSet with controller=true.
-func ClusterObjectSetRefSecretsHaveOwnerRef(ctx context.Context, revisionName string) error {
+func ClusterObjectSetReferredSecretsOwnedByObjectSet(ctx context.Context, revisionName string) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 
@@ -849,12 +854,12 @@ func ClusterObjectSetRefSecretsHaveOwnerRef(ctx context.Context, revisionName st
 	}
 	cosUID := cosObj.GetUID()
 
-	secrets, err := listRefSecrets(ctx, revisionName)
+	secrets, err := listReferredSecrets(ctx, revisionName)
 	if err != nil {
 		return err
 	}
 	if len(secrets) == 0 {
-		return fmt.Errorf("no ref Secrets found for revision %q", revisionName)
+		return fmt.Errorf("no referred secrets found for revision %q", revisionName)
 	}
 
 	for _, s := range secrets {
@@ -875,18 +880,18 @@ func ClusterObjectSetRefSecretsHaveOwnerRef(ctx context.Context, revisionName st
 	return nil
 }
 
-// ClusterObjectSetReferredSecretsHaveType verifies that all ref Secrets for the named
+// ClusterObjectSetReferredSecretsHaveType verifies that all referred Secrets for the named
 // ClusterObjectSet have the specified Secret type.
 func ClusterObjectSetReferredSecretsHaveType(ctx context.Context, revisionName, expectedType string) error {
 	sc := scenarioCtx(ctx)
 	revisionName = substituteScenarioVars(strings.TrimSpace(revisionName), sc)
 
-	secrets, err := listRefSecrets(ctx, revisionName)
+	secrets, err := listReferredSecrets(ctx, revisionName)
 	if err != nil {
 		return err
 	}
 	if len(secrets) == 0 {
-		return fmt.Errorf("no ref Secrets found for revision %q", revisionName)
+		return fmt.Errorf("no referred secrets found for revision %q", revisionName)
 	}
 
 	for _, s := range secrets {
@@ -897,8 +902,8 @@ func ClusterObjectSetReferredSecretsHaveType(ctx context.Context, revisionName,
 	return nil
 }
 
-// collectRefSecretNames returns the unique set of Secret names referenced by the ClusterObjectSet's phase objects.
-func collectRefSecretNames(ctx context.Context, revisionName string) ([]string, error) {
+// collectReferredSecretNames returns the unique set of Secret names referenced by the ClusterObjectSet's phase objects.
+func collectReferredSecretNames(ctx context.Context, revisionName string) ([]string, error) {
 	var names []string
 	seen := sets.New[string]()
 
@@ -929,18 +934,18 @@ func collectRefSecretNames(ctx context.Context, revisionName string) ([]string,
 		}
 	}
 	if len(names) == 0 {
-		return nil, fmt.Errorf("no ref Secret names found in ClusterObjectSet %q", revisionName)
+		return nil, fmt.Errorf("no referred secret names found in ClusterObjectSet %q", revisionName)
 	}
 	return names, nil
 }
 
-// listRefSecrets lists all Secrets in the OLM namespace that have the revision-name label
+// listReferredSecrets lists all Secrets in the OLM namespace that have the revision-name label
 // matching the given revision name.
-func listRefSecrets(_ context.Context, revisionName string) ([]corev1.Secret, error) {
+func listReferredSecrets(_ context.Context, revisionName string) ([]corev1.Secret, error) {
 	out, err := k8sClient("get", "secrets", "-n", olmNamespace,
 		"-l", "olm.operatorframework.io/revision-name="+revisionName, "-o", "json")
 	if err != nil {
-		return nil, fmt.Errorf("listing ref Secrets for revision %q: %w", revisionName, err)
+		return nil, fmt.Errorf("listing referred secrets for revision %q: %w", revisionName, err)
 	}
 	var secretList corev1.SecretList
 	if err := json.Unmarshal([]byte(out), &secretList); err != nil {
@@ -1797,6 +1802,17 @@ func ResourceHasAnnotations(ctx context.Context, resourceName string, table *god
 	return nil
 }
 
+// matchLabels checks that actual labels contain all expected key-value pairs.
+// Returns the first mismatched key, the actual value, and false if a mismatch is found.
+func matchLabels(actual, expected map[string]string) (string, string, bool) {
+	for k, v := range expected {
+		if a, found := actual[k]; !found || a != v {
+			return k, a, false
+		}
+	}
+	return "", "", true
+}
+
 // ResourceHasLabels waits for a resource to have all labels specified in the data table.
 // The table must have "key" and "value" columns.
 // Only supports namespaced resources (always uses sc.namespace).
@@ -1823,12 +1839,9 @@ func ResourceHasLabels(ctx context.Context, resourceName string, table *godog.Ta
 		if err := json.Unmarshal([]byte(out), &obj); err != nil {
 			return false
 		}
-		labels := obj.GetLabels()
-		for k, v := range expected {
-			if actual, found := labels[k]; !found || actual != v {
-				logger.V(1).Info("Label not yet present or value mismatch", "resource", resourceName, "key", k, "expected", v, "actual", actual)
-				return false
-			}
+		if key, got, ok := matchLabels(obj.GetLabels(), expected); !ok {
+			logger.V(1).Info("Label not yet present or value mismatch", "resource", resourceName, "key", key, "expected", expected[key], "actual", got)
+			return false
 		}
 		return true
 	})
diff --git a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go
index f8d5774ef5..7784cd4584 100644
--- a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go
+++ b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go
@@ -414,6 +414,9 @@ func (ctx ecKeyGenerator) genKey() ([]byte, rawHeader, error) {
 
 // Decrypt the given payload and return the content encryption key.
 func (ctx ecDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
+	if recipient == nil {
+		return nil, errors.New("go-jose/go-jose: missing recipient")
+	}
 	epk, err := headers.getEPK()
 	if err != nil {
 		return nil, errors.New("go-jose/go-jose: invalid epk header")
@@ -461,13 +464,18 @@ func (ctx ecDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientI
 		return nil, ErrUnsupportedAlgorithm
 	}
 
+	encryptedKey := recipient.encryptedKey
+	if len(encryptedKey) == 0 {
+		return nil, errors.New("go-jose/go-jose: missing JWE Encrypted Key")
+	}
+
 	key := deriveKey(string(algorithm), keySize)
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
 	}
 
-	return josecipher.KeyUnwrap(block, recipient.encryptedKey)
+	return josecipher.KeyUnwrap(block, encryptedKey)
 }
 
 func (ctx edDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
diff --git a/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go b/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go
index b9effbca8a..a2f86e3db9 100644
--- a/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go
+++ b/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go
@@ -66,12 +66,20 @@ func KeyWrap(block cipher.Block, cek []byte) ([]byte, error) {
 }
 
 // KeyUnwrap implements NIST key unwrapping; it unwraps a content encryption key (cek) with the given block cipher.
+//
+// https://datatracker.ietf.org/doc/html/rfc7518#section-4.4
+// https://datatracker.ietf.org/doc/html/rfc7518#section-4.6
+// https://datatracker.ietf.org/doc/html/rfc7518#section-4.8
 func KeyUnwrap(block cipher.Block, ciphertext []byte) ([]byte, error) {
+	n := (len(ciphertext) / 8) - 1
+	if n <= 0 {
+		return nil, errors.New("go-jose/go-jose: JWE Encrypted Key too short")
+	}
+
 	if len(ciphertext)%8 != 0 {
 		return nil, errors.New("go-jose/go-jose: key wrap input must be 8 byte blocks")
 	}
 
-	n := (len(ciphertext) / 8) - 1
 	r := make([][]byte, n)
 
 	for i := range r {
diff --git a/vendor/github.com/go-jose/go-jose/v4/symmetric.go b/vendor/github.com/go-jose/go-jose/v4/symmetric.go
index 09efefb265..f2ff29e179 100644
--- a/vendor/github.com/go-jose/go-jose/v4/symmetric.go
+++ b/vendor/github.com/go-jose/go-jose/v4/symmetric.go
@@ -366,11 +366,21 @@ func (ctx *symmetricKeyCipher) encryptKey(cek []byte, alg KeyAlgorithm) (recipie
 
 // Decrypt the content encryption key.
 func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
-	switch headers.getAlgorithm() {
-	case DIRECT:
-		cek := make([]byte, len(ctx.key))
-		copy(cek, ctx.key)
-		return cek, nil
+	if recipient == nil {
+		return nil, fmt.Errorf("go-jose/go-jose: missing recipient")
+	}
+
+	alg := headers.getAlgorithm()
+	if alg == DIRECT {
+		return bytes.Clone(ctx.key), nil
+	}
+
+	encryptedKey := recipient.encryptedKey
+	if len(encryptedKey) == 0 {
+		return nil, fmt.Errorf("go-jose/go-jose: missing JWE Encrypted Key")
+	}
+
+	switch alg {
 	case A128GCMKW, A192GCMKW, A256GCMKW:
 		aead := newAESGCM(len(ctx.key))
 
@@ -385,7 +395,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien
 
 		parts := &aeadParts{
 			iv:         iv.bytes(),
-			ciphertext: recipient.encryptedKey,
+			ciphertext: encryptedKey,
 			tag:        tag.bytes(),
 		}
 
@@ -401,7 +411,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien
 			return nil, err
 		}
 
-		cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey)
+		cek, err := josecipher.KeyUnwrap(block, encryptedKey)
 		if err != nil {
 			return nil, err
 		}
@@ -445,7 +455,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien
 			return nil, err
 		}
 
-		cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey)
+		cek, err := josecipher.KeyUnwrap(block, encryptedKey)
 		if err != nil {
 			return nil, err
 		}
diff --git a/vendor/github.com/klauspost/compress/.goreleaser.yml b/vendor/github.com/klauspost/compress/.goreleaser.yml
index 4528059ca6..804a201816 100644
--- a/vendor/github.com/klauspost/compress/.goreleaser.yml
+++ b/vendor/github.com/klauspost/compress/.goreleaser.yml
@@ -31,6 +31,9 @@ builds:
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
   -
     id: "s2d"
     binary: s2d
@@ -57,6 +60,9 @@ builds:
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
   -
     id: "s2sx"
     binary: s2sx
@@ -84,6 +90,9 @@ builds:
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
 
 archives:
   -
@@ -91,7 +100,7 @@ archives:
     name_template: "s2-{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
     format_overrides:
       - goos: windows
-        format: zip
+        formats: ['zip']
     files:
       - unpack/*
       - s2/LICENSE
diff --git a/vendor/github.com/klauspost/compress/README.md b/vendor/github.com/klauspost/compress/README.md
index 5125c1f267..e839fe9c60 100644
--- a/vendor/github.com/klauspost/compress/README.md
+++ b/vendor/github.com/klauspost/compress/README.md
@@ -26,6 +26,12 @@ This package will support the current Go version and 2 versions back.
 Use the links above for more information on each.
 
 # changelog
+
+* Feb 9th, 2026 [1.18.4](https://github.com/klauspost/compress/releases/tag/v1.18.4)
+	* gzhttp: Add zstandard to server handler wrapper https://github.com/klauspost/compress/pull/1121
+	* zstd: Add ResetWithOptions to encoder/decoder https://github.com/klauspost/compress/pull/1122
+	* gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @analytically in https://github.com/klauspost/compress/pull/1116
+
 * Jan 16th, 2026 [1.18.3](https://github.com/klauspost/compress/releases/tag/v1.18.3)
 	* Downstream CVE-2025-61728. See [golang/go#77102](https://github.com/golang/go/issues/77102).
 
@@ -691,3 +697,4 @@ This code is licensed under the same conditions as the original Go code. See LIC
 
 
 
+
diff --git a/vendor/github.com/klauspost/compress/flate/huffman_code.go b/vendor/github.com/klauspost/compress/flate/huffman_code.go
index 5f901bd0fe..4b312dea3e 100644
--- a/vendor/github.com/klauspost/compress/flate/huffman_code.go
+++ b/vendor/github.com/klauspost/compress/flate/huffman_code.go
@@ -407,8 +407,8 @@ func histogramSplit(b []byte, h []uint16) {
 	for i, t := range x {
 		v0 := &h[t]
 		v1 := &h[y[i]]
-		v3 := &h[w[i]]
 		v2 := &h[z[i]]
+		v3 := &h[w[i]]
 		*v0++
 		*v1++
 		*v2++
diff --git a/vendor/github.com/klauspost/compress/flate/regmask_other.go b/vendor/github.com/klauspost/compress/flate/regmask_other.go
index 1b7a2cbd79..e62caf711e 100644
--- a/vendor/github.com/klauspost/compress/flate/regmask_other.go
+++ b/vendor/github.com/klauspost/compress/flate/regmask_other.go
@@ -1,5 +1,4 @@
 //go:build !amd64
-// +build !amd64
 
 package flate
 
diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go
index 99ddd4af97..2d6ef64be1 100644
--- a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go
+++ b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 // This file contains the specialisation of Decoder.Decompress4X
 // and Decoder.Decompress1X that use an asm implementation of thir main loops.
diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_generic.go b/vendor/github.com/klauspost/compress/huff0/decompress_generic.go
index 908c17de63..6103923222 100644
--- a/vendor/github.com/klauspost/compress/huff0/decompress_generic.go
+++ b/vendor/github.com/klauspost/compress/huff0/decompress_generic.go
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 // This file contains a generic implementation of Decoder.Decompress4X.
 package huff0
diff --git a/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go b/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go
index e802579c4f..b97f9056f4 100644
--- a/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go
+++ b/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package cpuinfo
 
diff --git a/vendor/github.com/klauspost/compress/zstd/blockenc.go b/vendor/github.com/klauspost/compress/zstd/blockenc.go
index fd35ea1480..0e33aea442 100644
--- a/vendor/github.com/klauspost/compress/zstd/blockenc.go
+++ b/vendor/github.com/klauspost/compress/zstd/blockenc.go
@@ -78,6 +78,7 @@ func (b *blockEnc) initNewEncode() {
 	b.recentOffsets = [3]uint32{1, 4, 8}
 	b.litEnc.Reuse = huff0.ReusePolicyNone
 	b.coders.setPrev(nil, nil, nil)
+	b.dictLitEnc = nil
 }
 
 // reset will reset the block for a new encode, but in the same stream,
diff --git a/vendor/github.com/klauspost/compress/zstd/enc_base.go b/vendor/github.com/klauspost/compress/zstd/enc_base.go
index c1192ec38f..c4de134a7a 100644
--- a/vendor/github.com/klauspost/compress/zstd/enc_base.go
+++ b/vendor/github.com/klauspost/compress/zstd/enc_base.go
@@ -21,7 +21,7 @@ type fastBase struct {
 	crc         *xxhash.Digest
 	tmp         [8]byte
 	blk         *blockEnc
-	lastDictID  uint32
+	lastDict    *dict
 	lowMem      bool
 }
 
diff --git a/vendor/github.com/klauspost/compress/zstd/enc_best.go b/vendor/github.com/klauspost/compress/zstd/enc_best.go
index c1581cfcb8..851799322b 100644
--- a/vendor/github.com/klauspost/compress/zstd/enc_best.go
+++ b/vendor/github.com/klauspost/compress/zstd/enc_best.go
@@ -479,10 +479,13 @@ func (e *bestFastEncoder) Reset(d *dict, singleBlock bool) {
 	if d == nil {
 		return
 	}
+	dictChanged := d != e.lastDict
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || dictChanged {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]prevEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		end := int32(len(d.content)) - 8 + e.maxMatchOff
 		for i := e.maxMatchOff; i < end; i += 4 {
@@ -510,13 +513,14 @@ func (e *bestFastEncoder) Reset(d *dict, singleBlock bool) {
 				offset: i + 3,
 			}
 		}
-		e.lastDictID = d.id
 	}
 
-	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	// Init or copy dict long table
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]prevEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -538,8 +542,8 @@ func (e *bestFastEncoder) Reset(d *dict, singleBlock bool) {
 				off++
 			}
 		}
-		e.lastDictID = d.id
 	}
+	e.lastDict = d
 	// Reset table to initial state
 	copy(e.longTable[:], e.dictLongTable)
 
diff --git a/vendor/github.com/klauspost/compress/zstd/enc_better.go b/vendor/github.com/klauspost/compress/zstd/enc_better.go
index 85dcd28c32..3305f09248 100644
--- a/vendor/github.com/klauspost/compress/zstd/enc_better.go
+++ b/vendor/github.com/klauspost/compress/zstd/enc_better.go
@@ -1102,10 +1102,13 @@ func (e *betterFastEncoderDict) Reset(d *dict, singleBlock bool) {
 	if d == nil {
 		return
 	}
+	dictChanged := d != e.lastDict
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || dictChanged {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]tableEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		end := int32(len(d.content)) - 8 + e.maxMatchOff
 		for i := e.maxMatchOff; i < end; i += 4 {
@@ -1133,14 +1136,15 @@ func (e *betterFastEncoderDict) Reset(d *dict, singleBlock bool) {
 				offset: i + 3,
 			}
 		}
-		e.lastDictID = d.id
 		e.allDirty = true
 	}
 
-	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	// Init or copy dict long table
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]prevEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -1162,9 +1166,9 @@ func (e *betterFastEncoderDict) Reset(d *dict, singleBlock bool) {
 				off++
 			}
 		}
-		e.lastDictID = d.id
 		e.allDirty = true
 	}
+	e.lastDict = d
 
 	// Reset table to initial state
 	{
diff --git a/vendor/github.com/klauspost/compress/zstd/enc_dfast.go b/vendor/github.com/klauspost/compress/zstd/enc_dfast.go
index cf8cad00dc..2fb6da112b 100644
--- a/vendor/github.com/klauspost/compress/zstd/enc_dfast.go
+++ b/vendor/github.com/klauspost/compress/zstd/enc_dfast.go
@@ -1040,15 +1040,18 @@ func (e *doubleFastEncoder) Reset(d *dict, singleBlock bool) {
 // ResetDict will reset and set a dictionary if not nil
 func (e *doubleFastEncoderDict) Reset(d *dict, singleBlock bool) {
 	allDirty := e.allDirty
+	dictChanged := d != e.lastDict
 	e.fastEncoderDict.Reset(d, singleBlock)
 	if d == nil {
 		return
 	}
 
 	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]tableEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -1065,7 +1068,6 @@ func (e *doubleFastEncoderDict) Reset(d *dict, singleBlock bool) {
 				}
 			}
 		}
-		e.lastDictID = d.id
 		allDirty = true
 	}
 	// Reset table to initial state
diff --git a/vendor/github.com/klauspost/compress/zstd/enc_fast.go b/vendor/github.com/klauspost/compress/zstd/enc_fast.go
index 9180a3a582..5e104f1a48 100644
--- a/vendor/github.com/klauspost/compress/zstd/enc_fast.go
+++ b/vendor/github.com/klauspost/compress/zstd/enc_fast.go
@@ -805,9 +805,11 @@ func (e *fastEncoderDict) Reset(d *dict, singleBlock bool) {
 	}
 
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || d != e.lastDict {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]tableEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		if true {
 			end := e.maxMatchOff + int32(len(d.content)) - 8
@@ -827,7 +829,7 @@ func (e *fastEncoderDict) Reset(d *dict, singleBlock bool) {
 				}
 			}
 		}
-		e.lastDictID = d.id
+		e.lastDict = d
 		e.allDirty = true
 	}
 
diff --git a/vendor/github.com/klauspost/compress/zstd/encoder.go b/vendor/github.com/klauspost/compress/zstd/encoder.go
index 19e730acc2..0f2a00a003 100644
--- a/vendor/github.com/klauspost/compress/zstd/encoder.go
+++ b/vendor/github.com/klauspost/compress/zstd/encoder.go
@@ -138,11 +138,18 @@ func (e *Encoder) Reset(w io.Writer) {
 func (e *Encoder) ResetWithOptions(w io.Writer, opts ...EOption) error {
 	e.o.resetOpt = true
 	defer func() { e.o.resetOpt = false }()
+	hadDict := e.o.dict != nil
 	for _, o := range opts {
 		if err := o(&e.o); err != nil {
 			return err
 		}
 	}
+	hasDict := e.o.dict != nil
+	if hadDict != hasDict {
+		// Dict presence changed — encoder type must be recreated.
+		e.state.encoder = nil
+		e.init = sync.Once{}
+	}
 	e.Reset(w)
 	return nil
 }
@@ -448,6 +455,12 @@ func (e *Encoder) Close() error {
 	if s.encoder == nil {
 		return nil
 	}
+	if s.w == nil {
+		if len(s.filling) == 0 && !s.headerWritten && !s.eofWritten && s.nInput == 0 {
+			return nil
+		}
+		return errors.New("zstd: encoder has no writer")
+	}
 	err := e.nextBlock(true)
 	if err != nil {
 		if errors.Is(s.err, ErrEncoderClosed) {
diff --git a/vendor/github.com/klauspost/compress/zstd/encoder_options.go b/vendor/github.com/klauspost/compress/zstd/encoder_options.go
index 8e0f5cac71..e217be0a17 100644
--- a/vendor/github.com/klauspost/compress/zstd/encoder_options.go
+++ b/vendor/github.com/klauspost/compress/zstd/encoder_options.go
@@ -42,6 +42,7 @@ func (o *encoderOptions) setDefault() {
 		level:         SpeedDefault,
 		allLitEntropy: false,
 		lowMem:        false,
+		fullZero:      true,
 	}
 }
 
diff --git a/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go b/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go
index d04a829b0a..b8c8607b5d 100644
--- a/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go
+++ b/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package zstd
 
diff --git a/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go b/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go
index 8adfebb029..2138f8091a 100644
--- a/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go
+++ b/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 package zstd
 
diff --git a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go
index 0be16cefc7..9576426e68 100644
--- a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go
+++ b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go
@@ -1,5 +1,4 @@
 //go:build (!amd64 && !arm64) || appengine || !gc || purego || noasm
-// +build !amd64,!arm64 appengine !gc purego noasm
 
 package xxhash
 
diff --git a/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go b/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go
index f41932b7a4..1ed18927f9 100644
--- a/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go
+++ b/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 // Copyright 2019+ Klaus Post. All rights reserved.
 // License information can be found in the LICENSE file.
diff --git a/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go b/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go
index bea1779e97..379746c96c 100644
--- a/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go
+++ b/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 // Copyright 2019+ Klaus Post. All rights reserved.
 // License information can be found in the LICENSE file.
diff --git a/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go b/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go
index 1f8c3cec28..18c3703ddc 100644
--- a/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go
+++ b/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package zstd
 
diff --git a/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go b/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go
index 7cec2197cd..516cd9b070 100644
--- a/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go
+++ b/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 package zstd
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 280a6de969..f1d4249a63 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -308,7 +308,7 @@ github.com/go-git/go-git/v5/utils/ioutil
 # github.com/go-gorp/gorp/v3 v3.1.0
 ## explicit; go 1.18
 github.com/go-gorp/gorp/v3
-# github.com/go-jose/go-jose/v4 v4.1.3
+# github.com/go-jose/go-jose/v4 v4.1.4
 ## explicit; go 1.24.0
 github.com/go-jose/go-jose/v4
 github.com/go-jose/go-jose/v4/cipher
@@ -539,8 +539,8 @@ github.com/joelanford/ignore
 # github.com/json-iterator/go v1.1.12
 ## explicit; go 1.12
 github.com/json-iterator/go
-# github.com/klauspost/compress v1.18.4
-## explicit; go 1.23
+# github.com/klauspost/compress v1.18.5
+## explicit; go 1.24
 github.com/klauspost/compress
 github.com/klauspost/compress/flate
 github.com/klauspost/compress/fse