diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 233413996..ec3143fb3 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       # Please look up the latest version from
       # https://github.com/amannn/action-semantic-pull-request/releases
-      - uses: amannn/action-semantic-pull-request@v5.2.0
+      - uses: amannn/action-semantic-pull-request@v5.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 269b45711..f0053c5a8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.81.0
+  rev: v1.83.4
   hooks:
     - id: terraform_fmt
     - id: terraform_validate
diff --git a/helm-dependencies.yaml b/helm-dependencies.yaml
index 9ba0097e1..bfc4231a9 100644
--- a/helm-dependencies.yaml
+++ b/helm-dependencies.yaml
@@ -57,19 +57,19 @@ dependencies:
     version: 2.27.0
     repository: https://charts.konghq.com
   - name: kube-prometheus-stack
-    version: 50.3.1
+    version: 51.2.0
     repository: https://prometheus-community.github.io/helm-charts
   - name: linkerd2-cni
-    version: 30.11.0
+    version: 30.12.1
     repository: https://helm.linkerd.io/stable
   - name: linkerd-control-plane
-    version: 1.15.0
+    version: 1.16.2
     repository: https://helm.linkerd.io/stable
   - name: linkerd-crds
     version: 1.8.0
     repository: https://helm.linkerd.io/stable
   - name: linkerd-viz
-    version: 30.11.0
+    version: 30.12.2
     repository: https://helm.linkerd.io/stable
   - name: loki
     version: 5.23.0
diff --git a/modules/aws/ingress-nginx.tf b/modules/aws/ingress-nginx.tf
index 88b46b551..b0993dd34 100644
--- a/modules/aws/ingress-nginx.tf
+++ b/modules/aws/ingress-nginx.tf
@@ -23,6 +23,7 @@ locals {
 
   values_ingress-nginx_l4 = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
@@ -47,6 +48,7 @@ VALUES
 
   values_ingress-nginx_nlb = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
@@ -71,6 +73,7 @@ VALUES
 
   values_ingress-nginx_nlb_ip = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
@@ -95,6 +98,7 @@ VALUES
 
   values_ingress-nginx_l7 = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
diff --git a/modules/aws/kube-prometheus.tf b/modules/aws/kube-prometheus.tf
index 6f1ff3e02..9774ca271 100644
--- a/modules/aws/kube-prometheus.tf
+++ b/modules/aws/kube-prometheus.tf
@@ -19,7 +19,7 @@ locals {
       thanos_bucket                     = "thanos-store-${var.cluster-name}"
       thanos_bucket_force_destroy       = false
       thanos_store_config               = null
-      thanos_version                    = "v0.31.0"
+      thanos_version                    = "v0.32.3"
       enabled                           = false
       allowed_cidrs                     = ["0.0.0.0/0"]
       default_network_policy            = true
@@ -204,12 +204,14 @@ grafana:
 VALUES
 
   values_thanos_sidecar = <<VALUES
+prometheusOperator:
+  thanosImage:
+    tag: "${local.kube-prometheus-stack["thanos_version"]}"
 prometheus:
   prometheusSpec:
     externalLabels:
       cluster: ${var.cluster-name}
     thanos:
-      version: "${local.kube-prometheus-stack["thanos_version"]}"
       objectStorageConfig:
         key: thanos.yaml
         name: "${local.kube-prometheus-stack["thanos_bucket"]}-config"
diff --git a/modules/google/README.md b/modules/google/README.md
index d389aff70..601e84453 100644
--- a/modules/google/README.md
+++ b/modules/google/README.md
@@ -48,15 +48,15 @@ Provides various Kubernetes addons that are often used on Kubernetes with GCP
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_cert_manager_workload_identity"></a> [cert\_manager\_workload\_identity](#module\_cert\_manager\_workload\_identity) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0.0 |
-| <a name="module_external_dns_workload_identity"></a> [external\_dns\_workload\_identity](#module\_external\_dns\_workload\_identity) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0.0 |
-| <a name="module_iam_assumable_sa_kube-prometheus-stack_grafana"></a> [iam\_assumable\_sa\_kube-prometheus-stack\_grafana](#module\_iam\_assumable\_sa\_kube-prometheus-stack\_grafana) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_kube-prometheus-stack_thanos"></a> [iam\_assumable\_sa\_kube-prometheus-stack\_thanos](#module\_iam\_assumable\_sa\_kube-prometheus-stack\_thanos) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_loki-stack"></a> [iam\_assumable\_sa\_loki-stack](#module\_iam\_assumable\_sa\_loki-stack) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_thanos"></a> [iam\_assumable\_sa\_thanos](#module\_iam\_assumable\_sa\_thanos) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_thanos-compactor"></a> [iam\_assumable\_sa\_thanos-compactor](#module\_iam\_assumable\_sa\_thanos-compactor) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_thanos-sg"></a> [iam\_assumable\_sa\_thanos-sg](#module\_iam\_assumable\_sa\_thanos-sg) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
-| <a name="module_iam_assumable_sa_thanos-storegateway"></a> [iam\_assumable\_sa\_thanos-storegateway](#module\_iam\_assumable\_sa\_thanos-storegateway) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 27.0 |
+| <a name="module_cert_manager_workload_identity"></a> [cert\_manager\_workload\_identity](#module\_cert\_manager\_workload\_identity) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0.0 |
+| <a name="module_external_dns_workload_identity"></a> [external\_dns\_workload\_identity](#module\_external\_dns\_workload\_identity) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0.0 |
+| <a name="module_iam_assumable_sa_kube-prometheus-stack_grafana"></a> [iam\_assumable\_sa\_kube-prometheus-stack\_grafana](#module\_iam\_assumable\_sa\_kube-prometheus-stack\_grafana) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_kube-prometheus-stack_thanos"></a> [iam\_assumable\_sa\_kube-prometheus-stack\_thanos](#module\_iam\_assumable\_sa\_kube-prometheus-stack\_thanos) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_loki-stack"></a> [iam\_assumable\_sa\_loki-stack](#module\_iam\_assumable\_sa\_loki-stack) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_thanos"></a> [iam\_assumable\_sa\_thanos](#module\_iam\_assumable\_sa\_thanos) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_thanos-compactor"></a> [iam\_assumable\_sa\_thanos-compactor](#module\_iam\_assumable\_sa\_thanos-compactor) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_thanos-sg"></a> [iam\_assumable\_sa\_thanos-sg](#module\_iam\_assumable\_sa\_thanos-sg) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
+| <a name="module_iam_assumable_sa_thanos-storegateway"></a> [iam\_assumable\_sa\_thanos-storegateway](#module\_iam\_assumable\_sa\_thanos-storegateway) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | ~> 28.0 |
 | <a name="module_kube-prometheus-stack_grafana-iam-member"></a> [kube-prometheus-stack\_grafana-iam-member](#module\_kube-prometheus-stack\_grafana-iam-member) | terraform-google-modules/iam/google//modules/member_iam | ~> 7.6 |
 | <a name="module_kube-prometheus-stack_kube-prometheus-stack_bucket"></a> [kube-prometheus-stack\_kube-prometheus-stack\_bucket](#module\_kube-prometheus-stack\_kube-prometheus-stack\_bucket) | terraform-google-modules/cloud-storage/google//modules/simple_bucket | ~> 4.0 |
 | <a name="module_kube-prometheus-stack_thanos_bucket_iam"></a> [kube-prometheus-stack\_thanos\_bucket\_iam](#module\_kube-prometheus-stack\_thanos\_bucket\_iam) | terraform-google-modules/iam/google//modules/storage_buckets_iam | ~> 7.6 |
diff --git a/modules/google/cert-manager.tf b/modules/google/cert-manager.tf
index 6d9f1e914..9574c25f9 100644
--- a/modules/google/cert-manager.tf
+++ b/modules/google/cert-manager.tf
@@ -57,7 +57,7 @@ VALUES
 module "cert_manager_workload_identity" {
   count               = local.cert-manager.create_iam_resources && local.cert-manager.enabled ? 1 : 0
   source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version             = "~> 27.0.0"
+  version             = "~> 28.0.0"
   name                = local.cert-manager.service_account_name
   namespace           = local.cert-manager.namespace
   project_id          = local.cert-manager.project_id
diff --git a/modules/google/external-dns.tf b/modules/google/external-dns.tf
index c3a4c379b..fcf748136 100644
--- a/modules/google/external-dns.tf
+++ b/modules/google/external-dns.tf
@@ -55,7 +55,7 @@ locals {
 # to be allowed to use the workload identity on GKE.
 module "external_dns_workload_identity" {
   source  = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version = "~> 27.0.0"
+  version = "~> 28.0.0"
 
   for_each = { for k, v in local.external-dns : k => v if v.enabled && v.create_iam_resources }
 
diff --git a/modules/google/ingress-nginx.tf b/modules/google/ingress-nginx.tf
index ac84a99d0..129b46f18 100644
--- a/modules/google/ingress-nginx.tf
+++ b/modules/google/ingress-nginx.tf
@@ -19,6 +19,7 @@ locals {
 
   values_ingress-nginx_l4 = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
@@ -43,6 +44,7 @@ VALUES
 
   values_ingress-nginx_nlb = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
diff --git a/modules/google/kube-prometheus.tf b/modules/google/kube-prometheus.tf
index c3e7687ee..07bb5a09f 100644
--- a/modules/google/kube-prometheus.tf
+++ b/modules/google/kube-prometheus.tf
@@ -22,7 +22,7 @@ locals {
       thanos_bucket_location                = ""
       thanos_kms_bucket_location            = ""
       thanos_store_config                   = null
-      thanos_version                        = "v0.30.0"
+      thanos_version                        = "v0.32.3"
       thanos_service_account                = ""
       enabled                               = false
       allowed_cidrs                         = ["0.0.0.0/0"]
@@ -190,12 +190,14 @@ grafana:
 VALUES
 
   values_thanos_sidecar = <<VALUES
+prometheusOperator:
+  thanosImage:
+    tag: "${local.kube-prometheus-stack["thanos_version"]}"
 prometheus:
   prometheusSpec:
     externalLabels:
       cluster: ${var.cluster-name}
     thanos:
-      version: "${local.kube-prometheus-stack["thanos_version"]}"
       objectStorageConfig:
         key: thanos.yaml
         name: "${local.kube-prometheus-stack["thanos_bucket"]}-config"
@@ -252,7 +254,7 @@ VALUES
 module "iam_assumable_sa_kube-prometheus-stack_grafana" {
   count               = local.kube-prometheus-stack["enabled"] ? 1 : 0
   source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version             = "~> 27.0"
+  version             = "~> 28.0"
   namespace           = local.kube-prometheus-stack["namespace"]
   project_id          = var.project_id
   name                = local.kube-prometheus-stack["grafana_service_account_name"]
@@ -262,7 +264,7 @@ module "iam_assumable_sa_kube-prometheus-stack_grafana" {
 module "iam_assumable_sa_kube-prometheus-stack_thanos" {
   count               = local.kube-prometheus-stack["enabled"] && local.kube-prometheus-stack["thanos_sidecar_enabled"] ? 1 : 0
   source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version             = "~> 27.0"
+  version             = "~> 28.0"
   namespace           = local.kube-prometheus-stack["namespace"]
   project_id          = var.project_id
   name                = "${local.kube-prometheus-stack["name_prefix"]}-thanos"
diff --git a/modules/google/loki-stack.tf b/modules/google/loki-stack.tf
index 8317525a6..c758454ed 100644
--- a/modules/google/loki-stack.tf
+++ b/modules/google/loki-stack.tf
@@ -73,7 +73,7 @@ locals {
 module "iam_assumable_sa_loki-stack" {
   count      = local.loki-stack["enabled"] ? 1 : 0
   source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version    = "~> 27.0"
+  version    = "~> 28.0"
   namespace  = local.loki-stack["namespace"]
   project_id = var.project_id
   name       = local.loki-stack["name"]
diff --git a/modules/google/thanos-storegateway.tf b/modules/google/thanos-storegateway.tf
index ecb87748f..ba1f23af5 100644
--- a/modules/google/thanos-storegateway.tf
+++ b/modules/google/thanos-storegateway.tf
@@ -58,7 +58,7 @@ locals {
 module "iam_assumable_sa_thanos-storegateway" {
   for_each   = local.thanos-storegateway
   source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version    = "~> 27.0"
+  version    = "~> 28.0"
   namespace  = each.value["namespace"]
   project_id = data.google_project.current.id
   name       = "${each.value["name_prefix"]}-${each.key}"
diff --git a/modules/google/thanos.tf b/modules/google/thanos.tf
index f17eea97b..b4b396073 100644
--- a/modules/google/thanos.tf
+++ b/modules/google/thanos.tf
@@ -219,7 +219,7 @@ locals {
 module "iam_assumable_sa_thanos" {
   count      = local.thanos["enabled"] ? 1 : 0
   source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version    = "~> 27.0"
+  version    = "~> 28.0"
   namespace  = local.thanos["namespace"]
   project_id = var.project_id
   name       = local.thanos["name"]
@@ -228,7 +228,7 @@ module "iam_assumable_sa_thanos" {
 module "iam_assumable_sa_thanos-compactor" {
   count      = local.thanos["enabled"] ? 1 : 0
   source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version    = "~> 27.0"
+  version    = "~> 28.0"
   namespace  = local.thanos["namespace"]
   project_id = var.project_id
   name       = "${local.thanos["name"]}-compactor"
@@ -237,7 +237,7 @@ module "iam_assumable_sa_thanos-compactor" {
 module "iam_assumable_sa_thanos-sg" {
   count      = local.thanos["enabled"] ? 1 : 0
   source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  version    = "~> 27.0"
+  version    = "~> 28.0"
   namespace  = local.thanos["namespace"]
   project_id = var.project_id
   name       = "${local.thanos["name"]}-sg"
diff --git a/modules/scaleway/ingress-nginx.tf b/modules/scaleway/ingress-nginx.tf
index e2b1bf721..617b53607 100644
--- a/modules/scaleway/ingress-nginx.tf
+++ b/modules/scaleway/ingress-nginx.tf
@@ -20,6 +20,7 @@ locals {
 
   values_ingress-nginx_l4 = <<VALUES
 controller:
+  allowSnippetAnnotations: true
   metrics:
     enabled: ${local.kube-prometheus-stack["enabled"] || local.victoria-metrics-k8s-stack["enabled"]}
     serviceMonitor:
diff --git a/modules/scaleway/kube-prometheus.tf b/modules/scaleway/kube-prometheus.tf
index 1fb3e6fb1..faf8a08b7 100644
--- a/modules/scaleway/kube-prometheus.tf
+++ b/modules/scaleway/kube-prometheus.tf
@@ -13,7 +13,7 @@ locals {
       thanos_bucket            = "thanos-store-${var.cluster-name}"
       thanos_bucket_region     = local.scaleway["region"]
       thanos_store_config      = null
-      thanos_version           = "v0.31.0"
+      thanos_version           = "v0.32.3"
       enabled                  = false
       allowed_cidrs            = ["0.0.0.0/0"]
       default_network_policy   = true
@@ -186,12 +186,14 @@ grafana:
 VALUES
 
   values_thanos_sidecar = <<VALUES
+prometheusOperator:
+  thanosImage:
+    tag: "${local.kube-prometheus-stack["thanos_version"]}"
 prometheus:
   prometheusSpec:
     externalLabels:
       cluster: ${var.cluster-name}
     thanos:
-      version: "${local.kube-prometheus-stack["thanos_version"]}"
       objectStorageConfig:
         key: thanos.yaml
         name: "${local.kube-prometheus-stack["thanos_bucket"]}-config"