diff --git a/apps/grafana/crds.yaml b/apps/grafana/crds.yaml
index 072c45e5..6899bf9b 100644
--- a/apps/grafana/crds.yaml
+++ b/apps/grafana/crds.yaml
@@ -209,8 +209,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: alertmanagerconfigs.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -1273,6 +1273,22 @@ spec:
                                 This provides a fallback for email clients that don't support HTML.
                               minLength: 1
                               type: string
+                            threading:
+                              description: |-
+                                threading defines the threading configuration for email receiver.
+                                It requires Alertmanager >= v0.30.0.
+                              properties:
+                                threadByDate:
+                                  description: |-
+                                    threadByDate defines what granularity of current date to thread by. Accepted values: Daily, None.
+                                    (None means group by alert group key, no date).
+                                  enum:
+                                    - Daily
+                                    - None
+                                  type: string
+                              required:
+                                - threadByDate
+                              type: object
                             tlsConfig:
                               description: |-
                                 tlsConfig defines the TLS configuration for SMTP connections.
@@ -7624,6 +7640,12 @@ spec:
                                     - key
                                   type: object
                                   x-kubernetes-map-type: atomic
+                                externalId:
+                                  description: |-
+                                    externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+                                    It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+                                  minLength: 1
+                                  type: string
                                 profile:
                                   description: profile defines the named AWS profile used to authenticate.
                                   type: string
@@ -7663,6 +7685,9 @@ spec:
                                     It requires Prometheus >= v2.54.0.
                                   type: boolean
                               type: object
+                              x-kubernetes-validations:
+                                - message: externalId can only be used when roleArn is specified
+                                  rule: '!has(self.externalId) || has(self.roleArn)'
                             subject:
                               description: |-
                                 subject defines the subject line when the message is delivered to email endpoints.
@@ -11449,8 +11474,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: alertmanagers.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -13196,6 +13221,35 @@ spec:
                               pattern: ^(http|https)://.+$
                               type: string
                           type: object
+                        mattermost:
+                          description: mattermost defines the default Mattermost Config
+                          properties:
+                            webhookURL:
+                              description: |-
+                                webhookURL defines the default Mattermost Webhook URL.
+
+                                It requires Alertmanager >= v0.32.0.
+                              properties:
+                                key:
+                                  description: The key of the secret to select from.  Must be a valid secret key.
+                                  type: string
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: Specify whether the Secret or its key must be defined
+                                  type: boolean
+                              required:
+                                - key
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
                         opsGenieApiKey:
                           description: opsGenieApiKey defines the default OpsGenie API Key.
                           properties:
@@ -20898,8 +20952,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: podmonitors.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -22220,8 +22274,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: probes.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -23554,8 +23608,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: prometheusagents.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -29534,6 +29588,12 @@ spec:
                               - key
                             type: object
                             x-kubernetes-map-type: atomic
+                          externalId:
+                            description: |-
+                              externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+                              It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+                            minLength: 1
+                            type: string
                           profile:
                             description: profile defines the named AWS profile used to authenticate.
                             type: string
@@ -29573,6 +29633,9 @@ spec:
                               It requires Prometheus >= v2.54.0.
                             type: boolean
                         type: object
+                        x-kubernetes-validations:
+                          - message: externalId can only be used when roleArn is specified
+                            rule: '!has(self.externalId) || has(self.roleArn)'
                       tlsConfig:
                         description: tlsConfig to use for the URL.
                         properties:
@@ -30408,7 +30471,8 @@ spec:
                     matches all namespaces. A null label selector matches the current
                     namespace only.
 
-                    Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+                    Note that the ScrapeConfig custom resource definition is currently at Alpha level
+                    and will be graduated to Beta in a future release.
                   properties:
                     matchExpressions:
                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -30465,7 +30529,8 @@ spec:
                     of the custom resource definition. It is recommended to use
                     `spec.additionalScrapeConfigs` instead.
 
-                    Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+                    Note that the ScrapeConfig custom resource definition is currently at Alpha level
+                    and will be graduated to Beta in a future release.
                   properties:
                     matchExpressions:
                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -30934,6 +30999,54 @@ spec:
                     See https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-network-id for more details.
                   minLength: 1
                   type: string
+                shardingStrategy:
+                  description: |-
+                    shardingStrategy defines the sharding strategy for distributing scraped targets across Prometheus shards.
+
+                    When not defined, the operator defaults to the 'Address' mode which distributes
+                    targets based on a hash of the target address.
+                  properties:
+                    mode:
+                      description: |-
+                        mode defines the sharding mode. Can be 'Address' or 'Topology'.
+
+                        'Address' is the default mode and distributes targets across shards
+                        based on a hash of the target address.
+
+                        'Topology' enables zone-aware sharding where each shard is assigned to a
+                        specific topology zone and only scrapes targets in that zone.
+                        (Alpha) Using the 'Topology' mode requires the `PrometheusTopologySharding`
+                        feature gate to be enabled.
+                      enum:
+                        - Address
+                        - Topology
+                      type: string
+                    topology:
+                      description: |-
+                        topology defines the configuration for topology-aware sharding.
+                        This field is only valid when mode is set to 'Topology'.
+                      properties:
+                        externalLabelName:
+                          description: |-
+                            externalLabelName defines the name of the Prometheus external label used
+                            to communicate the topology zone assigned to the Prometheus instance.
+                            If not defined, it defaults to "zone".
+                            If set to the empty string, no external label is added to the Prometheus configuration.
+                          type: string
+                        values:
+                          description: |-
+                            values defines the list of topology values (e.g. zone names) to be used
+                            for sharding. The configured number of shards must be greater than or
+                            equal to the number of values.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      type: object
+                  type: object
+                  x-kubernetes-validations:
+                    - message: topology can only be defined when mode is set to 'Topology'
+                      rule: '!has(self.topology) || (has(self.mode) && self.mode == ''Topology'')'
                 shards:
                   description: |-
                     shards defines the number of shards to distribute the scraped targets onto.
@@ -34281,6 +34394,10 @@ spec:
                   rule: '!(has(self.mode) && self.mode == ''DaemonSet'' && has(self.serviceMonitorNamespaceSelector))'
                 - message: additionalScrapeConfigs cannot be set when mode is DaemonSet
                   rule: '!(has(self.mode) && self.mode == ''DaemonSet'' && has(self.additionalScrapeConfigs))'
+                - message: shardingStrategy cannot be set when mode is DaemonSet
+                  rule: '!(has(self.mode) && self.mode == ''DaemonSet'' && has(self.shardingStrategy))'
+                - message: shards must be greater than or equal to the number of topology values when sharding strategy mode is Topology
+                  rule: '!has(self.shardingStrategy) || !has(self.shardingStrategy.mode) || self.shardingStrategy.mode != ''Topology'' || !has(self.shardingStrategy.topology) || !has(self.shardingStrategy.topology.values) || self.shardingStrategy.topology.values.size() == 0 || (has(self.shards) ? self.shards : 1) >= self.shardingStrategy.topology.values.size()'
             status:
               description: |-
                 status defines the most recent observed status of the Prometheus cluster. Read-only.
@@ -34420,8 +34537,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: prometheuses.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -35909,6 +36026,12 @@ spec:
                                   - key
                                 type: object
                                 x-kubernetes-map-type: atomic
+                              externalId:
+                                description: |-
+                                  externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+                                  It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+                                minLength: 1
+                                type: string
                               profile:
                                 description: profile defines the named AWS profile used to authenticate.
                                 type: string
@@ -35948,6 +36071,9 @@ spec:
                                   It requires Prometheus >= v2.54.0.
                                 type: boolean
                             type: object
+                            x-kubernetes-validations:
+                              - message: externalId can only be used when roleArn is specified
+                                rule: '!has(self.externalId) || has(self.roleArn)'
                           timeout:
                             description: timeout defines a per-target Alertmanager timeout when pushing alerts.
                             pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
@@ -41878,6 +42004,12 @@ spec:
                               - key
                             type: object
                             x-kubernetes-map-type: atomic
+                          externalId:
+                            description: |-
+                              externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+                              It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+                            minLength: 1
+                            type: string
                           profile:
                             description: profile defines the named AWS profile used to authenticate.
                             type: string
@@ -41917,6 +42049,9 @@ spec:
                               It requires Prometheus >= v2.54.0.
                             type: boolean
                         type: object
+                        x-kubernetes-validations:
+                          - message: externalId can only be used when roleArn is specified
+                            rule: '!has(self.externalId) || has(self.roleArn)'
                       tlsConfig:
                         description: tlsConfig to use for the URL.
                         properties:
@@ -42891,7 +43026,8 @@ spec:
                     matches all namespaces. A null label selector matches the current
                     namespace only.
 
-                    Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+                    Note that the ScrapeConfig custom resource definition is currently at Alpha level
+                    and will be graduated to Beta in a future release.
                   properties:
                     matchExpressions:
                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -42948,7 +43084,8 @@ spec:
                     of the custom resource definition. It is recommended to use
                     `spec.additionalScrapeConfigs` instead.
 
-                    Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+                    Note that the ScrapeConfig custom resource definition is currently at Alpha level
+                    and will be graduated to Beta in a future release.
                   properties:
                     matchExpressions:
                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -43431,11 +43568,17 @@ spec:
                   properties:
                     retain:
                       description: |-
-                        retain defines the config for retention when the retention policy is set to `Retain`.
-                        This field is ineffective as of now.
+                        retain defines the config for retention when the retention policy is set
+                        to `Retain`.
+
+                        If not defined, the operator will use the retention duration configured
+                        for the Prometheus data. If the resource uses size-based retention, the
+                        shard(s) are kept forever (unless manually deleted).
                       properties:
                         retentionPeriod:
-                          description: retentionPeriod defines the retentionPeriod for shard retention policy.
+                          description: |-
+                            retentionPeriod defines how long the scaled-down shard(s) need to be
+                            kept before being deleted.
                           pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
                           type: string
                       required:
@@ -43453,6 +43596,54 @@ spec:
                         - Delete
                       type: string
                   type: object
+                shardingStrategy:
+                  description: |-
+                    shardingStrategy defines the sharding strategy for distributing scraped targets across Prometheus shards.
+
+                    When not defined, the operator defaults to the 'Address' mode which distributes
+                    targets based on a hash of the target address.
+                  properties:
+                    mode:
+                      description: |-
+                        mode defines the sharding mode. Can be 'Address' or 'Topology'.
+
+                        'Address' is the default mode and distributes targets across shards
+                        based on a hash of the target address.
+
+                        'Topology' enables zone-aware sharding where each shard is assigned to a
+                        specific topology zone and only scrapes targets in that zone.
+                        (Alpha) Using the 'Topology' mode requires the `PrometheusTopologySharding`
+                        feature gate to be enabled.
+                      enum:
+                        - Address
+                        - Topology
+                      type: string
+                    topology:
+                      description: |-
+                        topology defines the configuration for topology-aware sharding.
+                        This field is only valid when mode is set to 'Topology'.
+                      properties:
+                        externalLabelName:
+                          description: |-
+                            externalLabelName defines the name of the Prometheus external label used
+                            to communicate the topology zone assigned to the Prometheus instance.
+                            If not defined, it defaults to "zone".
+                            If set to the empty string, no external label is added to the Prometheus configuration.
+                          type: string
+                        values:
+                          description: |-
+                            values defines the list of topology values (e.g. zone names) to be used
+                            for sharding. The configured number of shards must be greater than or
+                            equal to the number of values.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      type: object
+                  type: object
+                  x-kubernetes-validations:
+                    - message: topology can only be defined when mode is set to 'Topology'
+                      rule: '!has(self.topology) || (has(self.mode) && self.mode == ''Topology'')'
                 shards:
                   description: |-
                     shards defines the number of shards to distribute the scraped targets onto.
@@ -44186,7 +44377,7 @@ spec:
                       description: |-
                         grpcServerTlsConfig defines the TLS parameters for the gRPC server providing the StoreAPI.
 
-                        Note: Currently only the `minVersion`, `caFile`, `certFile`, and `keyFile` fields are supported.
+                        Note: Currently only the `minVersion`, `caFile`, `certFile`, `keyFile`, `cipherSuites` and `curves` fields are supported.
                       properties:
                         ca:
                           description: ca defines the Certificate authority used when verifying server certificates.
@@ -44290,6 +44481,38 @@ spec:
                         certFile:
                           description: certFile defines the path to the client cert file in the Prometheus container for the targets.
                           type: string
+                        cipherSuites:
+                          description: |-
+                            cipherSuites defines the list of supported cipher suites for TLS
+                            versions up to TLS 1.2.
+
+                            If not defined, the Go default cipher suites are used.
+                            Available cipher suites are documented in the Go documentation:
+                            https://golang.org/pkg/crypto/tls/#pkg-constants
+
+                            It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+                            the Thanos version supports the provided values.
+                          items:
+                            type: string
+                          minItems: 1
+                          type: array
+                          x-kubernetes-list-type: set
+                        curves:
+                          description: |-
+                            curves defines the list of preferred elliptic curves for
+                            TLS handshakes.
+
+                            If not defined, the Go default curves are used.
+                            Available curves are documented in the Go documentation:
+                            https://golang.org/pkg/crypto/tls/#CurveID
+
+                            It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+                            the Thanos version supports the provided values.
+                          items:
+                            type: string
+                          minItems: 1
+                          type: array
+                          x-kubernetes-list-type: set
                         insecureSkipVerify:
                           description: insecureSkipVerify defines how to disable target certificate validation.
                           type: boolean
@@ -47267,6 +47490,9 @@ spec:
                       type: object
                   type: object
               type: object
+              x-kubernetes-validations:
+                - message: shards must be greater than or equal to the number of topology values when sharding strategy mode is Topology
+                  rule: '!has(self.shardingStrategy) || !has(self.shardingStrategy.mode) || self.shardingStrategy.mode != ''Topology'' || !has(self.shardingStrategy.topology) || !has(self.shardingStrategy.topology.values) || self.shardingStrategy.topology.values.size() == 0 || (has(self.shards) ? self.shards : 1) >= self.shardingStrategy.topology.values.size()'
             status:
               description: |-
                 status defines the most recent observed status of the Prometheus cluster. Read-only.
@@ -47406,8 +47632,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: prometheusrules.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -47656,8 +47882,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: scrapeconfigs.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -47750,6 +47976,7 @@ spec:
                           - OAuth
                           - ManagedIdentity
                           - SDK
+                          - WorkloadIdentity
                         type: string
                       authorization:
                         description: |-
@@ -48257,7 +48484,7 @@ spec:
                         minLength: 1
                         type: string
                       tlsConfig:
-                        description: tlsConfig defies the TLS configuration applying to the target HTTP endpoint.
+                        description: tlsConfig defines the TLS configuration applying to the target HTTP endpoint.
                         properties:
                           ca:
                             description: ca defines the Certificate authority used when verifying server certificates.
@@ -48584,13 +48811,20 @@ spec:
                       filter:
                         description: |-
                           filter defines the filter expression used to filter the catalog results.
-                          See https://www.consul.io/api-docs/catalog#list-services
+                          See https://developer.hashicorp.com/consul/api-docs/catalog#filtering
                           It requires Prometheus >= 3.0.0.
                         minLength: 1
                         type: string
                       followRedirects:
                         description: followRedirects defines whether HTTP requests follow HTTP 3xx redirects.
                         type: boolean
+                      healthFilter:
+                        description: |-
+                          healthFilter defines the filter expression used to filter the health results.
+                          See https://developer.hashicorp.com/consul/api-docs/health#filtering
+                          It requires Prometheus >= 3.11.2.
+                        minLength: 1
+                        type: string
                       namespace:
                         description: |-
                           namespace are only supported in Consul Enterprise.
@@ -55857,6 +56091,7 @@ spec:
                         type: string
                       roleARN:
                         description: roleARN defines the AWS Role ARN, an alternative to using AWS API keys.
+                        minLength: 1
                         type: string
                       secretKey:
                         description: secretKey defines the AWS API secret.
@@ -56850,6 +57085,7 @@ spec:
                         description: |-
                           namespace defines the Nomad namespace to query for service discovery.
                           When specified, only resources within this namespace will be discovered.
+                        minLength: 1
                         type: string
                       noProxy:
                         description: |-
@@ -57211,6 +57447,7 @@ spec:
                         description: |-
                           region defines the Nomad region to query for service discovery.
                           When specified, only resources within this region will be discovered.
+                        minLength: 1
                         type: string
                       server:
                         description: |-
@@ -57222,6 +57459,7 @@ spec:
                         description: |-
                           tagSeparator defines the separator used to join multiple tags.
                           This determines how Nomad service tags are concatenated into Prometheus labels.
+                        minLength: 1
                         type: string
                       tlsConfig:
                         description: tlsConfig defines the TLS configuration to connect to the Nomad API.
@@ -57691,6 +57929,7 @@ spec:
                         type: boolean
                       applicationCredentialId:
                         description: applicationCredentialId defines the OpenStack applicationCredentialId.
+                        minLength: 1
                         type: string
                       applicationCredentialName:
                         description: |-
@@ -58857,6 +59096,9 @@ spec:
                     description: |-
                       ScalewaySDConfig configurations allow retrieving scrape targets from Scaleway instances and baremetal services.
                       See https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scaleway_sd_config
+
+                      Note: The `_file` variants of credential fields (e.g. `secret_key_file`)
+                      from the Prometheus configuration are not supported. Use Kubernetes secrets via `secretKey` instead.
                     properties:
                       accessKey:
                         description: accessKey defines the access key to use. https://console.scaleway.com/project/credentials
@@ -59388,6 +59630,9 @@ spec:
                     It requires Prometheus >= v2.48.0.
                   type: boolean
               type: object
+              x-kubernetes-validations:
+                - message: at most one of basicAuth, authorization, or oauth2 can be configured
+                  rule: '[has(self.basicAuth), has(self.authorization), has(self.oauth2)].filter(x, x).size() <= 1'
             status:
               description: |-
                 status defines the status subresource. It is under active development and is updated only when the
@@ -59494,8 +59739,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: servicemonitors.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -60828,8 +61073,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
-    operator.prometheus.io/version: 0.90.1
+    controller-gen.kubebuilder.io/version: v0.20.1
+    operator.prometheus.io/version: 0.91.0
   name: thanosrulers.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -63507,7 +63752,7 @@ spec:
                     grpcServerTlsConfig defines the gRPC server from which Thanos Querier reads
                     recorded rule data.
 
-                    Note: Currently only the `minVersion`, `caFile`, `certFile`, and `keyFile` fields are supported.
+                    Note: Currently only the `minVersion`, `caFile`, `certFile`, `keyFile`, `cipherSuites` and `curves` fields are supported.
                   properties:
                     ca:
                       description: ca defines the Certificate authority used when verifying server certificates.
@@ -63611,6 +63856,38 @@ spec:
                     certFile:
                       description: certFile defines the path to the client cert file in the Prometheus container for the targets.
                       type: string
+                    cipherSuites:
+                      description: |-
+                        cipherSuites defines the list of supported cipher suites for TLS
+                        versions up to TLS 1.2.
+
+                        If not defined, the Go default cipher suites are used.
+                        Available cipher suites are documented in the Go documentation:
+                        https://golang.org/pkg/crypto/tls/#pkg-constants
+
+                        It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+                        the Thanos version supports the provided values.
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-type: set
+                    curves:
+                      description: |-
+                        curves defines the list of preferred elliptic curves for
+                        TLS handshakes.
+
+                        If not defined, the Go default curves are used.
+                        Available curves are documented in the Go documentation:
+                        https://golang.org/pkg/crypto/tls/#CurveID
+
+                        It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+                        the Thanos version supports the provided values.
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-type: set
                     insecureSkipVerify:
                       description: insecureSkipVerify defines how to disable target certificate validation.
                       type: boolean
@@ -66166,6 +66443,12 @@ spec:
                               - key
                             type: object
                             x-kubernetes-map-type: atomic
+                          externalId:
+                            description: |-
+                              externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+                              It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+                            minLength: 1
+                            type: string
                           profile:
                             description: profile defines the named AWS profile used to authenticate.
                             type: string
@@ -66205,6 +66488,9 @@ spec:
                               It requires Prometheus >= v2.54.0.
                             type: boolean
                         type: object
+                        x-kubernetes-validations:
+                          - message: externalId can only be used when roleArn is specified
+                            rule: '!has(self.externalId) || has(self.roleArn)'
                       tlsConfig:
                         description: tlsConfig to use for the URL.
                         properties:
diff --git a/apps/grafana/manifests/ConfigMap-grafana-k8s-monitoring-alloy.yml b/apps/grafana/manifests/ConfigMap-grafana-k8s-monitoring-alloy.yml
index b7f6068b..fde34836 100644
--- a/apps/grafana/manifests/ConfigMap-grafana-k8s-monitoring-alloy.yml
+++ b/apps/grafana/manifests/ConfigMap-grafana-k8s-monitoring-alloy.yml
@@ -731,4 +731,4 @@ data:
   k8s-monitoring-build-info-metric.prom: |
     # HELP grafana_kubernetes_monitoring_build_info A metric to report the version of the Kubernetes Monitoring Helm chart as well as a summary of enabled features
     # TYPE grafana_kubernetes_monitoring_build_info gauge
-    grafana_kubernetes_monitoring_build_info{version="1.6.52", namespace="grafana", metrics="enabled,alloy,kube-state-metrics,node-exporter,kubelet,kubeletResource,cadvisor", logs="enabled,events,pod_logs,journal,extraConfig", traces="enabled", deployments="kube-state-metrics,prometheus-node-exporter,prometheus-operator-crds"} 1
+    grafana_kubernetes_monitoring_build_info{version="1.6.54", namespace="grafana", metrics="enabled,alloy,kube-state-metrics,node-exporter,kubelet,kubeletResource,cadvisor", logs="enabled,events,pod_logs,journal,extraConfig", traces="enabled", deployments="kube-state-metrics,prometheus-node-exporter,prometheus-operator-crds"} 1
diff --git a/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml b/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml
index 25f93a81..c377fc0b 100644
--- a/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml
+++ b/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml
@@ -65,7 +65,7 @@ spec:
               mountPath: /var/log
               readOnly: true
         - name: config-reloader
-          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0
+          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0@sha256:7d9e4eea5f1139e602508871f422b0116c60e87c662f3dcd234d5ab60cd0d8c1
           imagePullPolicy: IfNotPresent
           args:
             - --watched-dir=/etc/alloy
diff --git a/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-alloy-events.yml b/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-alloy-events.yml
index a5ea8532..a1994bf8 100644
--- a/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-alloy-events.yml
+++ b/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-alloy-events.yml
@@ -63,7 +63,7 @@ spec:
             - name: config
               mountPath: /etc/alloy
         - name: config-reloader
-          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0
+          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0@sha256:7d9e4eea5f1139e602508871f422b0116c60e87c662f3dcd234d5ab60cd0d8c1
           imagePullPolicy: IfNotPresent
           args:
             - --watched-dir=/etc/alloy
diff --git a/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-kube-state-metrics.yml b/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-kube-state-metrics.yml
index 63cceccb..957aba8c 100644
--- a/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-kube-state-metrics.yml
+++ b/apps/grafana/manifests/Deployment-grafana-k8s-monitoring-kube-state-metrics.yml
@@ -52,7 +52,7 @@ spec:
             - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
             - --metric-labels-allowlist=nodes=[agentpool,alpha.eksctl.io/cluster-name,alpha.eksctl.io/nodegroup-name,beta.kubernetes.io/instance-type,cloud.google.com/gke-nodepool,cluster_name,ec2_amazonaws_com_Name,ec2_amazonaws_com_aws_autoscaling_groupName,ec2_amazonaws_com_aws_autoscaling_group_name,ec2_amazonaws_com_name,eks_amazonaws_com_nodegroup,k8s_io_cloud_provider_aws,karpenter.sh/nodepool,kubernetes.azure.com/cluster,kubernetes.io/arch,kubernetes.io/hostname,kubernetes.io/os,node.kubernetes.io/instance-type,topology.kubernetes.io/region,topology.kubernetes.io/zone]
           imagePullPolicy: IfNotPresent
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0
           ports:
             - containerPort: 8080
               name: http
diff --git a/apps/grafana/manifests/Job-test-grafana-k8s-monitoring.yml b/apps/grafana/manifests/Job-test-grafana-k8s-monitoring.yml
index ca592180..93b26ffe 100644
--- a/apps/grafana/manifests/Job-test-grafana-k8s-monitoring.yml
+++ b/apps/grafana/manifests/Job-test-grafana-k8s-monitoring.yml
@@ -29,7 +29,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: query-test
-          image: ghcr.io/grafana/k8s-monitoring-test:1.6.52
+          image: ghcr.io/grafana/k8s-monitoring-test:1.6.54
           command: ["bash", "-c", "/etc/bin/query-test.sh /etc/test/testQueries.json"]
           volumeMounts:
             - name: test-files
diff --git a/apps/grafana/manifests/Pod-analyze-grafana-k8s-monitoring.yml b/apps/grafana/manifests/Pod-analyze-grafana-k8s-monitoring.yml
index dd79f8ab..52f7b5eb 100644
--- a/apps/grafana/manifests/Pod-analyze-grafana-k8s-monitoring.yml
+++ b/apps/grafana/manifests/Pod-analyze-grafana-k8s-monitoring.yml
@@ -18,7 +18,7 @@ spec:
     kubernetes.io/os: linux
   containers:
     - name: config-analysis
-      image: ghcr.io/grafana/k8s-monitoring-test:1.6.52
+      image: ghcr.io/grafana/k8s-monitoring-test:1.6.54
       command: [/etc/bin/config-analysis.sh]
       env:
         - name: ALLOY_HOST
diff --git a/apps/grafana/manifests/StatefulSet-grafana-k8s-monitoring-alloy.yml b/apps/grafana/manifests/StatefulSet-grafana-k8s-monitoring-alloy.yml
index 51e616b7..de17ca63 100644
--- a/apps/grafana/manifests/StatefulSet-grafana-k8s-monitoring-alloy.yml
+++ b/apps/grafana/manifests/StatefulSet-grafana-k8s-monitoring-alloy.yml
@@ -99,7 +99,7 @@ spec:
             - mountPath: /var/lib/agent
               name: agent-wal
         - name: config-reloader
-          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0
+          image: quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0@sha256:7d9e4eea5f1139e602508871f422b0116c60e87c662f3dcd234d5ab60cd0d8c1
           imagePullPolicy: IfNotPresent
           args:
             - --watched-dir=/etc/alloy
diff --git a/apps/grafana/release.yaml b/apps/grafana/release.yaml
index 3ef83950..bd91f356 100644
--- a/apps/grafana/release.yaml
+++ b/apps/grafana/release.yaml
@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: k8s-monitoring
-      version: 1.6.52
+      version: 1.6.54
       sourceRef:
         kind: HelmRepository
         name: grafana