diff --git a/ansible/roles/cloud_compose/defaults/main.yml b/ansible/roles/cloud_compose/defaults/main.yml
index 4dff754..dd140c3 100644
--- a/ansible/roles/cloud_compose/defaults/main.yml
+++ b/ansible/roles/cloud_compose/defaults/main.yml
@@ -12,7 +12,7 @@ cloud_compose_home: /home/cloud-compose
 cloud_compose_data_dir: /mnt/disks/data
 cloud_compose_volumes_dir: /mnt/disks/volumes
 
-cloud_compose_docker_compose_version: v5.3.1
+cloud_compose_docker_compose_version: v5.4.0
 cloud_compose_docker_buildx_version: v0.35.0
 cloud_compose_sitectl_version: latest
 cloud_compose_sitectl_package_versions: {}
diff --git a/ci/config-management-cloud-smoke.sh b/ci/config-management-cloud-smoke.sh
index 13f596e..23dfb0b 100755
--- a/ci/config-management-cloud-smoke.sh
+++ b/ci/config-management-cloud-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6"
 
 usage() {
   cat <<EOF
diff --git a/ci/config-management-smoke.sh b/ci/config-management-smoke.sh
index 42e356d..6d870f0 100755
--- a/ci/config-management-smoke.sh
+++ b/ci/config-management-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6"
 image="${CLOUD_COMPOSE_CONFIG_MANAGEMENT_IMAGE:-$CONFIG_MANAGEMENT_IMAGE_DEFAULT}"
 
 require_cmd() {
diff --git a/docs/Dockerfile b/docs/Dockerfile
index f19dc39..6e002d4 100644
--- a/docs/Dockerfile
+++ b/docs/Dockerfile
@@ -3,8 +3,8 @@ FROM python:3.14-alpine3.22@sha256:6b91e66ab2a880ce9ca5a1b91c70f45963ff71ff68268
 WORKDIR /work
 
 RUN apk add --no-cache git && \
-    pip install uv==0.11.29 && \
-    uv pip install --break-system-packages --system zensical==0.0.50
+    pip install uv==0.12.1 && \
+    uv pip install --break-system-packages --system zensical==0.0.52
 
 EXPOSE 8080
 
diff --git a/modules/digitalocean/variables.tf b/modules/digitalocean/variables.tf
index 9f65b80..ea6717d 100644
--- a/modules/digitalocean/variables.tf
+++ b/modules/digitalocean/variables.tf
@@ -135,9 +135,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({
diff --git a/modules/gcp/variables.tf b/modules/gcp/variables.tf
index fd7522e..56ec03a 100644
--- a/modules/gcp/variables.tf
+++ b/modules/gcp/variables.tf
@@ -347,14 +347,14 @@ variable "sitectl_package_versions" {
 variable "docker_compose_version" {
   type = string
   # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-  default     = "v5.3.1"
+  default     = "v5.4.0"
   description = "Docker Compose release tag installed as the docker compose CLI plugin on hosts that need a manually managed plugin."
 }
 
 variable "docker_buildx_version" {
   type = string
   # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-  default     = "v0.35.0"
+  default     = "v0.36.0"
   description = "Docker Buildx release tag installed as the docker buildx CLI plugin on hosts that need a manually managed plugin."
 }
 
diff --git a/modules/linode/variables.tf b/modules/linode/variables.tf
index 6f3dae8..ad13142 100644
--- a/modules/linode/variables.tf
+++ b/modules/linode/variables.tf
@@ -149,9 +149,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({
diff --git a/modules/linux-vm-runtime/variables.tf b/modules/linux-vm-runtime/variables.tf
index 968cf42..b27e285 100644
--- a/modules/linux-vm-runtime/variables.tf
+++ b/modules/linux-vm-runtime/variables.tf
@@ -340,14 +340,14 @@ variable "sitectl_verify_args" {
 variable "docker_compose_version" {
   type = string
   # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-  default     = "v5.3.1"
+  default     = "v5.4.0"
   description = "Docker Compose release tag installed as the Docker CLI plugin."
 }
 
 variable "docker_buildx_version" {
   type = string
   # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-  default     = "v0.35.0"
+  default     = "v0.36.0"
   description = "Docker Buildx release tag installed as the Docker CLI plugin."
 }
 
diff --git a/providers/do/variables.tf b/providers/do/variables.tf
index 571ca4c..df5e5ac 100644
--- a/providers/do/variables.tf
+++ b/providers/do/variables.tf
@@ -146,9 +146,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({
diff --git a/providers/gcp/variables.tf b/providers/gcp/variables.tf
index d120fe3..2c46c6c 100644
--- a/providers/gcp/variables.tf
+++ b/providers/gcp/variables.tf
@@ -257,9 +257,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({
diff --git a/providers/linode/variables.tf b/providers/linode/variables.tf
index 725ce0b..bbab2ea 100644
--- a/providers/linode/variables.tf
+++ b/providers/linode/variables.tf
@@ -161,9 +161,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({
diff --git a/rootfs/home/cloud-compose/install-dependencies-cos.sh b/rootfs/home/cloud-compose/install-dependencies-cos.sh
index 0f6320e..c1e27ff 100644
--- a/rootfs/home/cloud-compose/install-dependencies-cos.sh
+++ b/rootfs/home/cloud-compose/install-dependencies-cos.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 # renovate: datasource=docker depName=alpine packageName=alpine versioning=docker
-ALPINE_BUILD_IMAGE="alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"
+ALPINE_BUILD_IMAGE="alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
 MAKE_VERSION="4.4.1"
 
 valid_make_binary() {
diff --git a/rootfs/home/cloud-compose/install-docker-plugins.sh b/rootfs/home/cloud-compose/install-docker-plugins.sh
index 50b7671..299e466 100644
--- a/rootfs/home/cloud-compose/install-docker-plugins.sh
+++ b/rootfs/home/cloud-compose/install-docker-plugins.sh
@@ -103,9 +103,9 @@ install_docker_plugins() {
     local compose_arch buildx_asset_arch
 
     # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-    DOCKER_COMPOSE_VERSION="${DOCKER_COMPOSE_VERSION:-v5.3.1}"
+    DOCKER_COMPOSE_VERSION="${DOCKER_COMPOSE_VERSION:-v5.4.0}"
     # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-    DOCKER_BUILDX_VERSION="${DOCKER_BUILDX_VERSION:-v0.35.0}"
+    DOCKER_BUILDX_VERSION="${DOCKER_BUILDX_VERSION:-v0.36.0}"
 
     validate_release_version docker-compose "$DOCKER_COMPOSE_VERSION"
     validate_release_version docker-buildx "$DOCKER_BUILDX_VERSION"
diff --git a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
index 21579cc..eab1330 100644
--- a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
+++ b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
@@ -4,7 +4,7 @@ services:
   lightsout:
     profiles:
       - lightsout
-    image: ghcr.io/libops/lightsout:main@sha256:4d38ac380c86514d72efbcce0af9ea8ffd7ff86e97abea3d0b3c946cf204eaae
+    image: ghcr.io/libops/lightsout:main@sha256:76b57748e8c21fda14bc842676ecf9e8af7b59ebb8211d5e4fda5d19129b2f19
     ports:
       - "8808:8808"
     networks:
diff --git a/salt/cloud-compose/init.sls b/salt/cloud-compose/init.sls
index a6ac016..1fb6ac0 100644
--- a/salt/cloud-compose/init.sls
+++ b/salt/cloud-compose/init.sls
@@ -470,7 +470,7 @@
   'DOCKER_COMPOSE_DIR': primary_project.get('project_dir', project_dir),
   'DOCKER_COMPOSE_REPO': primary_project.get('docker_compose_repo', repo),
   'DOCKER_COMPOSE_BRANCH': primary_project.get('docker_compose_branch', branch),
-  'DOCKER_COMPOSE_VERSION': docker.get('compose_version', cc.get('docker_compose_version', 'v5.3.1')),
+  'DOCKER_COMPOSE_VERSION': docker.get('compose_version', cc.get('docker_compose_version', 'v5.4.0')),
   'DOCKER_BUILDX_VERSION': docker.get('buildx_version', cc.get('docker_buildx_version', 'v0.35.0')),
   'GCP_PROJECT': '',
   'GCP_PROJECT_NUMBER': '',
diff --git a/variables.tf b/variables.tf
index 199b556..63db534 100644
--- a/variables.tf
+++ b/variables.tf
@@ -268,9 +268,9 @@ variable "runtime" {
 
     docker = optional(object({
       # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
-      compose_version = optional(string, "v5.3.1")
+      compose_version = optional(string, "v5.4.0")
       # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
-      buildx_version = optional(string, "v0.35.0")
+      buildx_version = optional(string, "v0.36.0")
     }), {})
 
     managed_runtime = optional(object({