diff --git a/.disvulncheck.yaml b/.disvulncheck.yaml
index f9f3be0f8..5954afe7e 100644
--- a/.disvulncheck.yaml
+++ b/.disvulncheck.yaml
@@ -4,26 +4,3 @@ ignore:
   - id: GO-2026-4923
     reason: No fix available, code not reachable in production.
     date: 2026-04-08
-
-  # fix them when updating tools package
-  - id: GO-2026-4864
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4865
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4866
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4869
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4870
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4946
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
-  - id: GO-2026-4947
-    reason: Waiting for tools package to be updated.
-    date: 2026-04-08
diff --git a/Makefile b/Makefile
index cc577472b..53cd5315b 100644
--- a/Makefile
+++ b/Makefile
@@ -25,9 +25,9 @@ DEBUG_TOOLS_SOURCE := scratch
 EMBED_TARGET ?= embed
 
 TOOLS_PREFIX ?= ghcr.io/siderolabs/tools
-TOOLS ?= v1.13.0-beta.0-1-g136f1de
+TOOLS ?= v1.13.0-beta.0-3-gc192d81
 PKGS_PREFIX ?= ghcr.io/siderolabs
-PKGS ?= v1.13.0-beta.0-5-g142b074
+PKGS ?= v1.13.0-beta.0-14-gb121566
 GENERATE_VEX_PREFIX ?= ghcr.io/siderolabs/generate-vex
 GENERATE_VEX ?= latest
 
diff --git a/hack/release.toml b/hack/release.toml
index 48d10c8d9..97bbd599d 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -18,8 +18,8 @@ preface = """
     [notes.updates]
         title = "Component Updates"
         description = """\
-Linux: 6.18.19
-containerd: 2.2.2
+Linux: 6.18.22
+containerd: 2.2.3
 etcd: 3.6.9
 CoreDNS: 1.14.2
 Kubernetes: 1.36.0-beta.0
@@ -27,14 +27,14 @@ CNI: 1.9.1
 Flannel CNI plugin: v1.9.0-flannel1
 Flannel: 0.28.2
 LVM2: 2_03_38
-runc: 1.4.1
+runc: 1.4.2
 systemd: 259.5
 cryptsetup: 2.8.3
 Tenstorrent: 2.7.0
 iptables: 1.8.12
 musl: 1.2.6
 
-Talos is built with Go 1.26.1.
+Talos is built with Go 1.26.2.
 """
 
     [notes.external_volumes]
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index 9ba14525b..0a24f4361 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -13,7 +13,7 @@ import (
 
 const (
 	// DefaultKernelVersion is the default Linux kernel version.
-	DefaultKernelVersion = "6.18.19-talos"
+	DefaultKernelVersion = "6.18.22-talos"
 
 	// KernelParamConfig is the kernel parameter name for specifying the URL.
 	// to the config.
@@ -523,10 +523,10 @@ const (
 	TrustdUserID = 51
 
 	// DefaultContainerdVersion is the default container runtime version.
-	DefaultContainerdVersion = "2.2.2"
+	DefaultContainerdVersion = "2.2.3"
 
 	// RuncVersion is the runc version.
-	RuncVersion = "1.4.1"
+	RuncVersion = "1.4.2"
 
 	// SystemContainerdNamespace is the Containerd namespace for Talos services.
 	SystemContainerdNamespace = "system"
@@ -1102,7 +1102,7 @@ const (
 	DBusClientSocketLabel = "system_u:object_r:dbus_client_socket_t:s0"
 
 	// GoVersion is the version of Go compiler this release was built with.
-	GoVersion = "go1.26.1"
+	GoVersion = "go1.26.2"
 
 	// KubernetesTalosAPIServiceName is the name of the Kubernetes service to access Talos API.
 	KubernetesTalosAPIServiceName = "talos"
diff --git a/pkg/machinery/gendata/data/pkgs b/pkg/machinery/gendata/data/pkgs
index 392954a2c..0c86b5622 100644
--- a/pkg/machinery/gendata/data/pkgs
+++ b/pkg/machinery/gendata/data/pkgs
@@ -1 +1 @@
-v1.13.0-beta.0-5-g142b074
\ No newline at end of file
+v1.13.0-beta.0-14-gb121566
\ No newline at end of file
diff --git a/pkg/machinery/gendata/data/tools b/pkg/machinery/gendata/data/tools
index 95fdef083..75c747c38 100644
--- a/pkg/machinery/gendata/data/tools
+++ b/pkg/machinery/gendata/data/tools
@@ -1 +1 @@
-v1.13.0-beta.0-1-g136f1de
\ No newline at end of file
+v1.13.0-beta.0-3-gc192d81
\ No newline at end of file