diff --git a/.konflux/olm-catalog/bundle/manifests/openshift-pipelines-operator-rh.clusterserviceversion.yaml b/.konflux/olm-catalog/bundle/manifests/openshift-pipelines-operator-rh.clusterserviceversion.yaml
index 2b7a2f32ac..ba20cf4e8f 100644
--- a/.konflux/olm-catalog/bundle/manifests/openshift-pipelines-operator-rh.clusterserviceversion.yaml
+++ b/.konflux/olm-catalog/bundle/manifests/openshift-pipelines-operator-rh.clusterserviceversion.yaml
@@ -1462,7 +1462,7 @@ spec:
                         value: registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:bb058b3de08a97a38b1eb1c65df636dcb0632194c30c4d57569762097f9b6b86
                       - name: IMAGE_PIPELINES_CONSOLE_PLUGIN_LEGACY
                         value: registry.redhat.io/openshift-pipelines/pipelines-console-plugin-pf5-rhel9@sha256:85fc10a62da7842eb0972f8141a08b000f79501067c3c2fa5decc146d9e7bab2
-                    image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bc8937f0363342da9bd2450b0e389b15f5ca978184da01d6433845449f804a92
+                    image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:7b4d5ef4394537652aa373237278131c17dc29f5730fc9783e9e729c190f7304
                     imagePullPolicy: Always
                     name: openshift-pipelines-operator-lifecycle
                     resources: {}
@@ -1500,7 +1500,7 @@ spec:
                         value: tekton.dev/operator
                       - name: CONFIG_LEADERELECTION_NAME
                         value: tekton-operator-controller-config-leader-election
-                    image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bc8937f0363342da9bd2450b0e389b15f5ca978184da01d6433845449f804a92
+                    image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:7b4d5ef4394537652aa373237278131c17dc29f5730fc9783e9e729c190f7304
                     imagePullPolicy: Always
                     name: openshift-pipelines-operator-cluster-operations
                     resources: {}
@@ -1606,9 +1606,9 @@ spec:
   provider:
     name: Red Hat
   relatedImages:
-    - image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bc8937f0363342da9bd2450b0e389b15f5ca978184da01d6433845449f804a92
+    - image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:7b4d5ef4394537652aa373237278131c17dc29f5730fc9783e9e729c190f7304
       name: OPENSHIFT_PIPELINES_OPERATOR_LIFECYCLE
-    - image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bc8937f0363342da9bd2450b0e389b15f5ca978184da01d6433845449f804a92
+    - image: registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:7b4d5ef4394537652aa373237278131c17dc29f5730fc9783e9e729c190f7304
       name: OPENSHIFT_PIPELINES_OPERATOR_CLUSTER_OPERATIONS
     - image: registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:d474e47f13acae06ec76c0d94e7707c9cd950f66737010f78245c8235b4b3c40
       name: IMAGE_PIPELINES_PROXY
diff --git a/head b/head
index abee4fca01..e547fb93bc 100644
--- a/head
+++ b/head
@@ -1 +1 @@
-e18041d05e015fc424a9e42b57ebe124af7474b2
+6a5b57b302528874834bb6ec21f904475566873c
diff --git a/project.yaml b/project.yaml
index 21f278f869..6400a6d7c9 100644
--- a/project.yaml
+++ b/project.yaml
@@ -1,6 +1,6 @@
 versions:
-  current: 5.0.5-842
-  previous: 5.0.5-841
+  current: 5.0.5-843
+  previous: 5.0.5-842
   previous_range: 1.20.0
   channel: pipelines-5.0
   openshift:
diff --git a/upstream/.github/workflows/codeql-analysis.yml b/upstream/.github/workflows/codeql-analysis.yml
index d0018e3562..9fed2a0c9d 100644
--- a/upstream/.github/workflows/codeql-analysis.yml
+++ b/upstream/.github/workflows/codeql-analysis.yml
@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+      uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -79,4 +79,4 @@ jobs:
         make bin/tool
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+      uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
diff --git a/upstream/.github/workflows/e2e-matrix.yml b/upstream/.github/workflows/e2e-matrix.yml
index 21f3d043db..f4516664d5 100644
--- a/upstream/.github/workflows/e2e-matrix.yml
+++ b/upstream/.github/workflows/e2e-matrix.yml
@@ -73,7 +73,7 @@ jobs:
         name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}
         path: ${{ env.ARTIFACTS }}
 
-    - uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7  # v1.6.29
+    - uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9  # v1.6.30
       if: ${{ failure() }}
       with:
         artifact-name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}-logs
diff --git a/upstream/.github/workflows/helm-release.yaml b/upstream/.github/workflows/helm-release.yaml
index 87bbb74cc7..fb44d24d80 100644
--- a/upstream/.github/workflows/helm-release.yaml
+++ b/upstream/.github/workflows/helm-release.yaml
@@ -46,7 +46,7 @@ jobs:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/upstream/.github/workflows/zizmor.yaml b/upstream/.github/workflows/zizmor.yaml
index cdb35fd7ce..f39acc6fcd 100644
--- a/upstream/.github/workflows/zizmor.yaml
+++ b/upstream/.github/workflows/zizmor.yaml
@@ -20,4 +20,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
diff --git a/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types.go b/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types.go
index a225e7132a..03f12ddc5a 100644
--- a/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types.go
+++ b/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types.go
@@ -59,7 +59,7 @@ type Prune struct {
 	Disabled bool `json:"disabled"`
 	// apply the prune job to the individual resources
 	// +optional
-	PrunePerResource bool `json:"prune-per-resource,omitempty"`
+	PrunePerResource bool `json:"prune-per-resource"`
 	// The resources which need to be pruned
 	Resources []string `json:"resources,omitempty"`
 	// The number of resource to keep
diff --git a/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types_test.go b/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types_test.go
new file mode 100644
index 0000000000..0043fc6161
--- /dev/null
+++ b/upstream/pkg/apis/operator/v1alpha1/tektonconfig_types_test.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2026 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+// TestPrune_PrunePerResourceJSONRoundTrip guards against the "prune-per-resource"
+// field being dropped when explicitly set to false. The admission webhook computes
+// a round-trip patch by marshaling a freshly unmarshaled copy of the request object
+// and diffing it against the original bytes; a `false` value on a field tagged
+// `omitempty` is indistinguishable from an unset field once marshaled, so the
+// webhook would emit a patch removing the key from the stored object.
+func TestPrune_PrunePerResourceJSONRoundTrip(t *testing.T) {
+	raw := []byte(`{"disabled":false,"prune-per-resource":false}`)
+
+	var p Prune
+	err := json.Unmarshal(raw, &p)
+	assert.NilError(t, err)
+	assert.Equal(t, p.PrunePerResource, false)
+
+	out, err := json.Marshal(p)
+	assert.NilError(t, err)
+
+	var roundTripped map[string]interface{}
+	err = json.Unmarshal(out, &roundTripped)
+	assert.NilError(t, err)
+
+	_, present := roundTripped["prune-per-resource"]
+	assert.Assert(t, present, "prune-per-resource key was dropped from marshaled JSON when false: %s", string(out))
+}
diff --git a/upstream/pkg/reconciler/shared/tektonconfig/tektonconfig.go b/upstream/pkg/reconciler/shared/tektonconfig/tektonconfig.go
index d246d3fe5d..7f79b680bb 100644
--- a/upstream/pkg/reconciler/shared/tektonconfig/tektonconfig.go
+++ b/upstream/pkg/reconciler/shared/tektonconfig/tektonconfig.go
@@ -408,6 +408,10 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tc *v1alpha1.TektonConfi
 
 	// Post-reconcile extension hooks
 	if err := r.extension.PostReconcile(ctx, tc); err != nil {
+		if err == v1alpha1.REQUEUE_EVENT_AFTER {
+			logger.Infow("Post-reconcile hook requested requeue", "error", err)
+			return err
+		}
 		logger.Errorw("Post-reconcile hook failed", "error", err)
 		return err
 	}
diff --git a/upstream/tekton/build-publish-images-manifests.yaml b/upstream/tekton/build-publish-images-manifests.yaml
index eec5301ae1..94b594fd86 100644
--- a/upstream/tekton/build-publish-images-manifests.yaml
+++ b/upstream/tekton/build-publish-images-manifests.yaml
@@ -99,7 +99,7 @@ spec:
       cp ${DOCKER_CONFIG} /workspace/${KUBE_DISTRO}-docker-config.json
 
   - name: rewrite-devel-in-source
-    image: ghcr.io/tektoncd/plumbing/ko@sha256:7561ceb48cbc9492b855da5560586274c1dd4bab403746db0fe56fb06bb32020
+    image: ghcr.io/tektoncd/plumbing/ko@sha256:976eb63239884a047d64ddfe3691e82359262a6fec8bfacd74dcb9861ffbeec3
     script: |
       #!/usr/bin/env sh
       set -ex
@@ -120,7 +120,7 @@ spec:
       fi
 
   - name: run-kustomize-ko
-    image: ghcr.io/tektoncd/plumbing/ko@sha256:7561ceb48cbc9492b855da5560586274c1dd4bab403746db0fe56fb06bb32020
+    image: ghcr.io/tektoncd/plumbing/ko@sha256:976eb63239884a047d64ddfe3691e82359262a6fec8bfacd74dcb9861ffbeec3
     env:
     - name: KO_DOCKER_REPO
       value: $(params.imageRegistry)/$(params.imageRegistryPath)
@@ -186,7 +186,7 @@ spec:
       sed -i -E -e 's/(app.kubernetes.io\/version): "?devel"?/\1: "$(params.versionTag)"/g' -e 's/(operator.tekton.dev\/release): "?devel"?/\1: "$(params.versionTag)"/g' -e 's/(version): "?devel"?/\1: "$(params.versionTag)"/g' ${OUTPUT_RELEASE_DIR}/${FILENAME_PREFIX}release.yaml
       sed -i -E -e 's/(app.kubernetes.io\/version): "?devel"?/\1: "$(params.versionTag)"/g' -e 's/(operator.tekton.dev\/release): "?devel"?/\1: "$(params.versionTag)"/g' -e 's/(version): "?devel"?/\1: "$(params.versionTag)"/g' ${OUTPUT_RELEASE_DIR}/${FILENAME_PREFIX}release.notags.yaml
   - name: koparse
-    image: ghcr.io/tektoncd/plumbing/koparse@sha256:6cf5d09b76e47c1f75f1e00195d6332cb94c467446a3fdf508a686f8aaeae90e
+    image: ghcr.io/tektoncd/plumbing/koparse@sha256:e060328da881ec03dee8f0a729677cdb9c6b26788e48988162b452f5158c5bce
     script: |
       set -ex