diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index aeddb2a..d721d3a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,11 +1,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
-"on":
+'on':
   push:
     branches:
       - main
@@ -27,7 +27,8 @@ jobs:
       pull-requests: read
     runs-on:
       group: pkgs
-    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
+    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref,
+      'dependabot/'))
     outputs:
       labels: ${{ steps.retrieve-pr-labels.outputs.result }}
     steps:
@@ -57,13 +58,13 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # version: v7.0.0
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # version: v4.2.0
         with:
           append: |
             - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234
@@ -76,7 +77,7 @@ jobs:
           make
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # version: v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # version: v4.4.0
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
@@ -106,7 +107,7 @@ jobs:
           make release-notes
       - name: Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # version: v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # version: v3.0.1
         with:
           body_path: _out/RELEASE_NOTES.md
           draft: "true"
@@ -143,13 +144,13 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # version: v7.0.0
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # version: v4.2.0
         with:
           append: |
             - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index a1ce8ab..ee1a957 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -1,8 +1,8 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
-"on":
+'on':
   schedule:
     - cron: 0 2 * * *
 name: Lock old issues
diff --git a/.github/workflows/slack-notify-ci-failure.yaml b/.github/workflows/slack-notify-ci-failure.yaml
index 8e8f822..a49f240 100644
--- a/.github/workflows/slack-notify-ci-failure.yaml
+++ b/.github/workflows/slack-notify-ci-failure.yaml
@@ -1,8 +1,8 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
-"on":
+'on':
   workflow_run:
     workflows:
       - default
@@ -16,7 +16,8 @@ jobs:
   slack-notify:
     runs-on:
       group: generic
-    if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'pull_request'
+    if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event
+      != 'pull_request'
     steps:
       - name: Slack Notify
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # version: v3.0.3
diff --git a/.github/workflows/slack-notify.yaml b/.github/workflows/slack-notify.yaml
index 2f5faae..03ace59 100644
--- a/.github/workflows/slack-notify.yaml
+++ b/.github/workflows/slack-notify.yaml
@@ -1,8 +1,8 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
-"on":
+'on':
   workflow_run:
     workflows:
       - default
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 78cb0e3..93898c3 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,8 +1,8 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
-"on":
+'on':
   schedule:
     - cron: 30 1 * * *
 name: Close stale issues and PRs
@@ -17,11 +17,15 @@ jobs:
       - name: Close stale issues and PRs
         uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # version: v10.3.0
         with:
-          close-issue-message: This issue was closed because it has been stalled for 7 days with no activity.
+          close-issue-message: This issue was closed because it has been stalled for
+            7 days with no activity.
           days-before-issue-close: "5"
           days-before-issue-stale: "180"
           days-before-pr-close: "-1"
           days-before-pr-stale: "45"
           operations-per-run: "2000"
-          stale-issue-message: This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 7 days.
-          stale-pr-message: This PR is stale because it has been open 45 days with no activity.
+          stale-issue-message: This issue is stale because it has been open 180 days
+            with no activity. Remove stale label or comment or this will be closed
+            in 7 days.
+          stale-pr-message: This PR is stale because it has been open 45 days with
+            no activity.
diff --git a/.github/workflows/weekly.yaml b/.github/workflows/weekly.yaml
index 1ebffaf..f17ca79 100644
--- a/.github/workflows/weekly.yaml
+++ b/.github/workflows/weekly.yaml
@@ -1,11 +1,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
-"on":
+'on':
   schedule:
     - cron: 30 1 * * 1
 name: weekly
@@ -40,13 +40,13 @@ jobs:
           done
         continue-on-error: true
       - name: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # version: v7.0.0
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # version: v4.2.0
         with:
           append: |
             - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234
diff --git a/Makefile b/Makefile
index 4a6e9f1..041a916 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
 # common variables
 
@@ -27,7 +27,7 @@ SOURCE_DATE_EPOCH := $(shell git log $(INITIAL_COMMIT_SHA) --pretty=%ct)
 
 # sync bldr image with pkgfile
 
-BLDR_RELEASE := v0.6.0
+BLDR_RELEASE := v0.6.1
 BLDR_IMAGE := ghcr.io/siderolabs/bldr:$(BLDR_RELEASE)
 BLDR := docker run --rm --user $(shell id -u):$(shell id -g) --volume $(PWD):/src --entrypoint=/bldr $(BLDR_IMAGE) --root=/src
 
diff --git a/Pkgfile b/Pkgfile
index 74d795a..07587e6 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -5,7 +5,7 @@
 format: v1alpha2
 
 vars:
-  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v1.13.0-2-g108ceba
+  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v1.13.0-3-gc4993d7
 
   # renovate: datasource=github-tags depName=argp-standalone/argp-standalone
   argp_standalone_version: 1.5.0
diff --git a/lefthook.yml b/lefthook.yml
index c9e3a6b..89db0a0 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -1,9 +1,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-06-19T12:04:52Z by kres a07fce6.
+# Generated on 2026-07-08T07:52:27Z by kres 14a38a3.
 
-commit-msg:
+post-commit:
   parallel: false
   commands:
     conformance:
       run: make conformance
+      env:
+        USERNAME: siderolabs