diff --git a/artifact-scanner/Dockerfile b/artifact-scanner/Dockerfile
index f550690c..e0e6bacc 100644
--- a/artifact-scanner/Dockerfile
+++ b/artifact-scanner/Dockerfile
@@ -1,5 +1,5 @@
 ARG BUILDER_IMAGE=build-harbor.alauda.cn/devops/nonroot/builder-go:latest@sha256:4f740d7c64d43e955f2ab8d02b462ec940e3ba88d9134514f4318c3a82c300e7
-ARG BASE_IMAGE=build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202605061100
+ARG BASE_IMAGE=build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202606111722
 
 FROM ${BUILDER_IMAGE} AS builder
 
diff --git a/pr-cli/Dockerfile b/pr-cli/Dockerfile
index b0e9ad12..d8db0092 100644
--- a/pr-cli/Dockerfile
+++ b/pr-cli/Dockerfile
@@ -28,7 +28,7 @@ RUN if [ -z "$BUILD_DATE" ]; then export BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%
 
 RUN ./pr-cli version
 
-FROM build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202605061100
+FROM build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202606111722
 
 RUN apk add --no-cache \
     bash \
diff --git a/roadmap-planner/Dockerfile b/roadmap-planner/Dockerfile
index 8f5bc633..284a2c3a 100644
--- a/roadmap-planner/Dockerfile
+++ b/roadmap-planner/Dockerfile
@@ -2,7 +2,7 @@
 # Build args (all declared once, at the top of the file).
 # CI overrides these via `--build-arg`; locals use these defaults.
 ARG NODE_IMAGE=node:24-alpine
-ARG GO_IMAGE=golang:1.26.3-alpine
+ARG GO_IMAGE=golang:1.26.4-alpine
 ARG RUNTIME_IMAGE=alpine:latest
 
 # Stage 1: Build frontend
diff --git a/roadmap-planner/backend/Dockerfile b/roadmap-planner/backend/Dockerfile
index 42f96c47..41c9aa07 100644
--- a/roadmap-planner/backend/Dockerfile
+++ b/roadmap-planner/backend/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.26.3-alpine AS builder
+FROM golang:1.26.4-alpine AS builder
 
 # Install git and ca-certificates (needed for go modules and HTTPS)
 RUN apk add --no-cache git ca-certificates
diff --git a/tekton/cleanup-runs-pvc/Dockerfile b/tekton/cleanup-runs-pvc/Dockerfile
index 65529c47..fdfed92a 100644
--- a/tekton/cleanup-runs-pvc/Dockerfile
+++ b/tekton/cleanup-runs-pvc/Dockerfile
@@ -1,10 +1,10 @@
 # use curl to download cli
-ARG BUILDER_IMAGE=build-harbor.alauda.cn/ops/photon:5-alauda-202604171100
-ARG RUNTIME_IMAGE=build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202605061100
+ARG BUILDER_IMAGE=build-harbor.alauda.cn/ops/photon:5-alauda-202606031100
+ARG RUNTIME_IMAGE=build-harbor.alauda.cn/ops/alpine:3.23.3-alauda-202606111722
 FROM ${BUILDER_IMAGE} AS download
 
 # renovate: datasource=github-releases depName=kubectl packageName=AlaudaDevops/kubernetes
-ARG KUBECTL_VERSION=v1.33.8-alauda-15
+ARG KUBECTL_VERSION=v1.33.8-alauda-16
 
 RUN set -eux; \
     if [ "$(uname -m)" = "arm64" ] || [ "$(uname -m)" = "aarch64" ]; then \