diff --git a/Makefile.kube_git.var b/Makefile.kube_git.var
index 4560cb3e09..27ea19eed5 100644
--- a/Makefile.kube_git.var
+++ b/Makefile.kube_git.var
@@ -1,5 +1,5 @@
 KUBE_GIT_MAJOR=1
 KUBE_GIT_MINOR=33
 KUBE_GIT_VERSION=v1.33.4
-KUBE_GIT_COMMIT=679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
+KUBE_GIT_COMMIT=95b8140e3a53ffc6aab114c39e07a439dfdf7f9e
 KUBE_GIT_TREE_STATE=clean
diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var
index 178e7889fd..7b7db68e30 100644
--- a/Makefile.version.aarch64.var
+++ b/Makefile.version.aarch64.var
@@ -1 +1 @@
-OCP_VERSION := 4.21.0-0.nightly-arm64-2025-09-15-144433
+OCP_VERSION := 4.21.0-0.nightly-arm64-2025-09-16-163803
diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var
index f9bea3951d..cf320c38b1 100644
--- a/Makefile.version.x86_64.var
+++ b/Makefile.version.x86_64.var
@@ -1 +1 @@
-OCP_VERSION := 4.21.0-0.nightly-2025-09-15-042343
+OCP_VERSION := 4.21.0-0.nightly-2025-09-18-193221
diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml
index f4613c17be..621f0325ef 100644
--- a/assets/components/multus/kustomization.aarch64.yaml
+++ b/assets/components/multus/kustomization.aarch64.yaml
@@ -2,7 +2,7 @@
 images:
   - name: multus-cni-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:dee3513bfeee4ff391ee975b3e850027a913b32896aa2edd701dee92eb96a0d2
+    digest: sha256:ddbc09b143ab4922596a838082ba86b64f9f3d799db6f333de417c4a78802e2d
   - name: containernetworking-plugins-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:73860bbfc3f2264848baaf3de73196b06dd0c20123d129bc49a536e30fa384d9
+    digest: sha256:0a4e638174de0237bf2360fb467d035a2f02c48a8a27fd6053e3c98944d712d6
diff --git a/assets/components/multus/kustomization.x86_64.yaml b/assets/components/multus/kustomization.x86_64.yaml
index 9acf6ba944..34bb14879d 100644
--- a/assets/components/multus/kustomization.x86_64.yaml
+++ b/assets/components/multus/kustomization.x86_64.yaml
@@ -2,7 +2,7 @@
 images:
   - name: multus-cni-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:8a30db38bdb1fcb20eeaf810f8e51e7f963ef5645b4cf95d38b61c382a218bf1
+    digest: sha256:0719a66144b744eff9a1f8f5f7ccc029d190f4652ccbceed0fa12dd2b8a526d0
   - name: containernetworking-plugins-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:0c1d4a990009171aa1881bded5535eae6400f31eb9cd44af4c6dddc454d24f8d
+    digest: sha256:19a4d5eb5ffad99144302bab9006895cffce382080b7a9a2fc9b5d478636118b
diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json
index 99911f4e3f..627006e14f 100644
--- a/assets/components/multus/release-multus-aarch64.json
+++ b/assets/components/multus/release-multus-aarch64.json
@@ -1,9 +1,9 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-arm64-2025-09-15-144433"
+    "base": "4.21.0-0.nightly-arm64-2025-09-16-163803"
   },
   "images": {
-    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dee3513bfeee4ff391ee975b3e850027a913b32896aa2edd701dee92eb96a0d2",
-    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:73860bbfc3f2264848baaf3de73196b06dd0c20123d129bc49a536e30fa384d9"
+    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ddbc09b143ab4922596a838082ba86b64f9f3d799db6f333de417c4a78802e2d",
+    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0a4e638174de0237bf2360fb467d035a2f02c48a8a27fd6053e3c98944d712d6"
   }
 }
diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json
index f4a0ebd56f..3e2c9cd260 100644
--- a/assets/components/multus/release-multus-x86_64.json
+++ b/assets/components/multus/release-multus-x86_64.json
@@ -1,9 +1,9 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-2025-09-15-042343"
+    "base": "4.21.0-0.nightly-2025-09-18-193221"
   },
   "images": {
-    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8a30db38bdb1fcb20eeaf810f8e51e7f963ef5645b4cf95d38b61c382a218bf1",
-    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0c1d4a990009171aa1881bded5535eae6400f31eb9cd44af4c6dddc454d24f8d"
+    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0719a66144b744eff9a1f8f5f7ccc029d190f4652ccbceed0fa12dd2b8a526d0",
+    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:19a4d5eb5ffad99144302bab9006895cffce382080b7a9a2fc9b5d478636118b"
   }
 }
diff --git a/assets/controllers/kube-controller-manager/defaultconfig.yaml b/assets/controllers/kube-controller-manager/defaultconfig.yaml
index caa738f106..b621d2953d 100644
--- a/assets/controllers/kube-controller-manager/defaultconfig.yaml
+++ b/assets/controllers/kube-controller-manager/defaultconfig.yaml
@@ -23,8 +23,6 @@ extendedArguments:
     # Most upstream clusters don't care about SELinux, therefore this controller is opt-in. OCP cares.
     # Owner: OCP storage team, @jsafrane.
     - "selinux-warning-controller"
-  cloud-provider:
-    - "external"
   cluster-signing-duration:
     - "720h"
   secure-port:
diff --git a/assets/optional/kube-proxy/kustomization.aarch64.yaml b/assets/optional/kube-proxy/kustomization.aarch64.yaml
index ec0a9a5269..2c9225e609 100644
--- a/assets/optional/kube-proxy/kustomization.aarch64.yaml
+++ b/assets/optional/kube-proxy/kustomization.aarch64.yaml
@@ -2,4 +2,4 @@
 images:
   - name: kube-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:8fb1041934c9d683906359b524d6fc2c37d576ba2cf7f2698bcc238377fdd60d
+    digest: sha256:4247e573b4d95b9c3f47a64bb8865e142920670f96efcad8b8d483e24022f588
diff --git a/assets/optional/kube-proxy/kustomization.x86_64.yaml b/assets/optional/kube-proxy/kustomization.x86_64.yaml
index 14aa4f37f9..c82a7b3760 100644
--- a/assets/optional/kube-proxy/kustomization.x86_64.yaml
+++ b/assets/optional/kube-proxy/kustomization.x86_64.yaml
@@ -2,4 +2,4 @@
 images:
   - name: kube-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:b34cceb99dc3feda980ce47b49887c06f4df7fa342116470112b521ea9905e5c
+    digest: sha256:579115709c542137cab2ea08c59f4ab053a720a4baf1c5c44d1b0f531c43de63
diff --git a/assets/optional/kube-proxy/release-kube-proxy-aarch64.json b/assets/optional/kube-proxy/release-kube-proxy-aarch64.json
index 6832516608..7d3fcb1096 100644
--- a/assets/optional/kube-proxy/release-kube-proxy-aarch64.json
+++ b/assets/optional/kube-proxy/release-kube-proxy-aarch64.json
@@ -1,8 +1,8 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-arm64-2025-09-15-144433"
+    "base": "4.21.0-0.nightly-arm64-2025-09-16-163803"
   },
   "images": {
-    "kube-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8fb1041934c9d683906359b524d6fc2c37d576ba2cf7f2698bcc238377fdd60d"
+    "kube-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4247e573b4d95b9c3f47a64bb8865e142920670f96efcad8b8d483e24022f588"
   }
 }
diff --git a/assets/optional/kube-proxy/release-kube-proxy-x86_64.json b/assets/optional/kube-proxy/release-kube-proxy-x86_64.json
index 899ff48071..fb020aee1f 100644
--- a/assets/optional/kube-proxy/release-kube-proxy-x86_64.json
+++ b/assets/optional/kube-proxy/release-kube-proxy-x86_64.json
@@ -1,8 +1,8 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-2025-09-15-042343"
+    "base": "4.21.0-0.nightly-2025-09-18-193221"
   },
   "images": {
-    "kube-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b34cceb99dc3feda980ce47b49887c06f4df7fa342116470112b521ea9905e5c"
+    "kube-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:579115709c542137cab2ea08c59f4ab053a720a4baf1c5c44d1b0f531c43de63"
   }
 }
diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
index 552438b656..655f5d6101 100644
--- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
+++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
@@ -2,13 +2,13 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:a45337d15af61a18525ad9002e779aff50a9ef360c2d27948811c5ae76bbecac
+    digest: sha256:1fe4227bd4019cfa3a76b16e726cf8d4ac6d226569c5c5e604a2f6f09b0aab3b
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:41866f0e3ec52376819b26c3901e258199c347eaf9796020d236398a27920b87
+    digest: sha256:c29df2669ebd8ba8fe2ca518ce14d5d4e46d0d99c0c26b5b7ac8e75de47479b4
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:544c937726f939b853093473cc58cb09c91a9e5d1ebcc187591d5a5df58a40f6
+    digest: sha256:75ee75cc35ece4662bf58efaaddd073df362b7d6079ff83192f875cfe6e3c7c7
 
 patches:
   - patch: |-
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:41866f0e3ec52376819b26c3901e258199c347eaf9796020d236398a27920b87
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c29df2669ebd8ba8fe2ca518ce14d5d4e46d0d99c0c26b5b7ac8e75de47479b4
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a45337d15af61a18525ad9002e779aff50a9ef360c2d27948811c5ae76bbecac
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1fe4227bd4019cfa3a76b16e726cf8d4ac6d226569c5c5e604a2f6f09b0aab3b
     target:
       kind: Deployment
       labelSelector: app=catalog-operator
diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
index 14cd0ebd36..c128d1e29e 100644
--- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
+++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
@@ -2,13 +2,13 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:6dec6e0d2546fdae39acdb8ff8a5147dc96a29b77ac7fbfc7d08c7525f1c3dff
+    digest: sha256:1d609fb68b5621bcd1fb216a1f10a326d22acee9f451de7b4c41ceb390987e77
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:75c0472bdb093f7487e8ec0bb62cfc44fc2800aeb56b45ab444020e09ebc7ad0
+    digest: sha256:9aa2d72d8d4150ec247788e0d4cf0123345cbe2968b4f45115f83dbf67cd49b6
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:b09a18f7583bb9328f7d414cffdc3795d09160c18104055c8fdeea52e0c81b7a
+    digest: sha256:d3304374c72e9c4ddf88dbe402224b3736ab1994c19513bd6faa956bce493fc6
 
 patches:
   - patch: |-
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:75c0472bdb093f7487e8ec0bb62cfc44fc2800aeb56b45ab444020e09ebc7ad0
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9aa2d72d8d4150ec247788e0d4cf0123345cbe2968b4f45115f83dbf67cd49b6
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6dec6e0d2546fdae39acdb8ff8a5147dc96a29b77ac7fbfc7d08c7525f1c3dff
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1d609fb68b5621bcd1fb216a1f10a326d22acee9f451de7b4c41ceb390987e77
     target:
       kind: Deployment
       labelSelector: app=catalog-operator
diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
index 46946b8a5d..6b5568bad5 100644
--- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
+++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-arm64-2025-09-15-144433"
+    "base": "4.21.0-0.nightly-arm64-2025-09-16-163803"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a45337d15af61a18525ad9002e779aff50a9ef360c2d27948811c5ae76bbecac",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:41866f0e3ec52376819b26c3901e258199c347eaf9796020d236398a27920b87",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:544c937726f939b853093473cc58cb09c91a9e5d1ebcc187591d5a5df58a40f6"
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1fe4227bd4019cfa3a76b16e726cf8d4ac6d226569c5c5e604a2f6f09b0aab3b",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c29df2669ebd8ba8fe2ca518ce14d5d4e46d0d99c0c26b5b7ac8e75de47479b4",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:75ee75cc35ece4662bf58efaaddd073df362b7d6079ff83192f875cfe6e3c7c7"
   }
 }
diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
index 5d02d46b70..679c1e98ec 100644
--- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
+++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-2025-09-15-042343"
+    "base": "4.21.0-0.nightly-2025-09-18-193221"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6dec6e0d2546fdae39acdb8ff8a5147dc96a29b77ac7fbfc7d08c7525f1c3dff",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:75c0472bdb093f7487e8ec0bb62cfc44fc2800aeb56b45ab444020e09ebc7ad0",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b09a18f7583bb9328f7d414cffdc3795d09160c18104055c8fdeea52e0c81b7a"
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1d609fb68b5621bcd1fb216a1f10a326d22acee9f451de7b4c41ceb390987e77",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9aa2d72d8d4150ec247788e0d4cf0123345cbe2968b4f45115f83dbf67cd49b6",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d3304374c72e9c4ddf88dbe402224b3736ab1994c19513bd6faa956bce493fc6"
   }
 }
diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json
index 2dcf1a3b57..6433f1bccb 100644
--- a/assets/release/release-aarch64.json
+++ b/assets/release/release-aarch64.json
@@ -1,16 +1,16 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-arm64-2025-09-15-144433"
+    "base": "4.21.0-0.nightly-arm64-2025-09-16-163803"
   },
   "images": {
-    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a61692bef1caed795671449fe24e458cee1bad4b9092738068f4ede1ab493626",
-    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1c20707204befd67334c2d4c98de152aeff159bce34f36b9268a40132ad71a18",
-    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c1cd7e11630b921bb61f89637861e16bf6169e42d7321313682e6828f736ca89",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:544c937726f939b853093473cc58cb09c91a9e5d1ebcc187591d5a5df58a40f6",
-    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d1bd64ae838592c0ca3b924bda35f2b6a978dc3393035088acfc7d2b2fdd28e5",
-    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:190e85b5622ccf749c3acdf038bf1c490fe8ff3e760c3c657c51429895e774ce",
-    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:7baa77638952979e20e738a7e0783db32a445391e4d4f2631c4bbe859bcdbc04",
+    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f786b139e772e08de35e6ad45bcf956fcfc78c5d76c4217a55e4ae64ee7a3c24",
+    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8a9c72411c4eacabd7f45570bbf0467ee5a53d021562edf080385e8764a726cb",
+    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e2b91a1fbe4bd66e24099e0e77f08ad8814961c73a3be33d80cde13fd6cb197e",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:75ee75cc35ece4662bf58efaaddd073df362b7d6079ff83192f875cfe6e3c7c7",
+    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:cf5bf3ca0d85086b41daaa5d53eadc3c0038ab935873c926c1a109906b7d118f",
+    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c9dba3e46b2e0d04b7f0bb2e7da314a429d76f28573015f26f85c7baf6037998",
+    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:704fb9154fa0dfb8a4dc55474d7d24b8ab6185ea6e1bb1d79cadd38122669b65",
     "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:3766640b19c336b443619ecdb35f36b479c79ea71b21de97febf024a5eaf6c84",
-    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:08632df50d31f2b0d9b5a0b97ebe69365f2a31c7312a3181134c0d1b87c35551"
+    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:013450806f68220b5cdd74690a1f8fa992feda9f28fd76478e22b4e5cc73a0d4"
   }
 }
diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json
index e5e01b61fb..f0207c2133 100644
--- a/assets/release/release-x86_64.json
+++ b/assets/release/release-x86_64.json
@@ -1,16 +1,16 @@
 {
   "release": {
-    "base": "4.21.0-0.nightly-2025-09-15-042343"
+    "base": "4.21.0-0.nightly-2025-09-18-193221"
   },
   "images": {
-    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c40b050f84d02171c29c25b0b9adf4e650df4ebdfc00a68e1217c4733dec6c3c",
-    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:501531f6b82acb64efc87d7d7aaaa9969a5683e003ab45e5e767d30723dad602",
-    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e184887a22b45486c67979e1ffdc280e66e6edf50e35f1c934f38861d4a9a1f7",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b09a18f7583bb9328f7d414cffdc3795d09160c18104055c8fdeea52e0c81b7a",
-    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:13a0b05bb986146e903bdb19edeea91bbfd17c69ba3af2177b09e3ea6468c8cb",
-    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dba5d464bb715c7e03e2dcc144de10d7018f3b282afb9ca7362793457c8e6c62",
-    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:acb39a09d251987144e08d066366dcb71530364089874bc7bc758e64a86bb625",
+    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:71d4467239a45093b768070b6bf4459fd3f6b76c39ac060c693f90ee0b49a17a",
+    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:011884062ded852ff4ab394884334bcd6dc742441ba2aa9f71a58b5ea8921022",
+    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:aaf0ee390bd02dcf7102d331b720f2070e7e2eb7a08c2d31ec8ea27bd5d88997",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d3304374c72e9c4ddf88dbe402224b3736ab1994c19513bd6faa956bce493fc6",
+    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6634e031f549079832bfc4182a28b2e488ec01ad04285be1b95ad740cae91ce9",
+    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9a10adc59bc9e78b0f585016f45ff71a7b5bc1862895f72bf7dc8e461a5528ad",
+    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d64f615b78fb120046458c6f2309796b0c537ad0c83092fb1b207993f3790a7e",
     "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:58804d8baf922927b66cec9424d431a3bdb341d207024ce40cc8f0123bac03ee",
-    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4ca70604107d666011271f5b3c109a12ddb334017d25eae853769c3b3c1620af"
+    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:292e6b782caa72d44f558f288ea30cd95b2f1c3e93a7693bbb69783d9e832a32"
   }
 }
diff --git a/deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go b/deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
index 6209287bfd..ff7b99acad 100644
--- a/deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
+++ b/deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
@@ -26,13 +26,43 @@ var DefaultRetry = wait.Backoff{
 }
 
 type retryClient struct {
-	// embed because we only want to override a few states
-	storage.Interface
+	// All methods of storage.Interface are implemented directly on *retryClient, even when they
+	// are purely passthroughs to the delegate. During a rebase, consider whether or not it is
+	// safe and appropriate for a new method added to the method set of storage.Interface to
+	// perform retries.
+	delegate storage.Interface
+}
+
+func (c *retryClient) Count(key string) (int64, error) {
+	return c.delegate.Count(key)
+}
+
+func (c *retryClient) ReadinessCheck() error {
+	return c.delegate.ReadinessCheck()
+}
+
+func (c *retryClient) RequestWatchProgress(ctx context.Context) error {
+	return c.delegate.RequestWatchProgress(ctx)
+}
+
+func (c *retryClient) Versioner() storage.Versioner {
+	return c.delegate.Versioner()
 }
 
 // New returns an etcd3 implementation of storage.Interface.
 func NewRetryingEtcdStorage(delegate storage.Interface) storage.Interface {
-	return &retryClient{Interface: delegate}
+	return &retryClient{delegate: delegate}
+}
+
+func (c *retryClient) GetCurrentResourceVersion(ctx context.Context) (uint64, error) {
+	var (
+		rv  uint64
+		err error
+	)
+	return rv, OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
+		rv, err = c.delegate.GetCurrentResourceVersion(ctx)
+		return err
+	})
 }
 
 // Create adds a new object at a key unless it already exists. 'ttl' is time-to-live
@@ -40,7 +70,7 @@ func NewRetryingEtcdStorage(delegate storage.Interface) storage.Interface {
 // set to the read value from database.
 func (c *retryClient) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.Create(ctx, key, obj, out, ttl)
+		return c.delegate.Create(ctx, key, obj, out, ttl)
 	})
 }
 
@@ -48,7 +78,7 @@ func (c *retryClient) Create(ctx context.Context, key string, obj, out runtime.O
 // If key didn't exist, it will return NotFound storage error.
 func (c *retryClient) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts)
+		return c.delegate.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts)
 	})
 }
 
@@ -63,7 +93,7 @@ func (c *retryClient) Watch(ctx context.Context, key string, opts storage.ListOp
 	var ret watch.Interface
 	err := OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
 		var innerErr error
-		ret, innerErr = c.Interface.Watch(ctx, key, opts)
+		ret, innerErr = c.delegate.Watch(ctx, key, opts)
 		return innerErr
 	})
 	return ret, err
@@ -76,7 +106,7 @@ func (c *retryClient) Watch(ctx context.Context, key string, opts storage.ListOp
 // match 'opts.ResourceVersion' according 'opts.ResourceVersionMatch'.
 func (c *retryClient) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
-		return c.Interface.Get(ctx, key, opts, objPtr)
+		return c.delegate.Get(ctx, key, opts, objPtr)
 	})
 }
 
@@ -88,7 +118,7 @@ func (c *retryClient) Get(ctx context.Context, key string, opts storage.GetOptio
 // match 'opts.ResourceVersion' according 'opts.ResourceVersionMatch'.
 func (c *retryClient) GetList(ctx context.Context, key string, opts storage.ListOptions, listObj runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
-		return c.Interface.GetList(ctx, key, opts, listObj)
+		return c.delegate.GetList(ctx, key, opts, listObj)
 	})
 }
 
@@ -129,7 +159,7 @@ func (c *retryClient) GetList(ctx context.Context, key string, opts storage.List
 func (c *retryClient) GuaranteedUpdate(ctx context.Context, key string, destination runtime.Object, ignoreNotFound bool,
 	preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, cachedExistingObject runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject)
+		return c.delegate.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject)
 	})
 }
 
diff --git a/deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/volume_modify.go b/deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/volume_modify.go
index 4cbf089c20..93012513e6 100644
--- a/deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/volume_modify.go
+++ b/deps/github.com/openshift/kubernetes/test/e2e/storage/testsuites/volume_modify.go
@@ -328,7 +328,7 @@ func (v *volumeModifyTestSuite) DefineTests(driver storageframework.TestDriver,
 		originPv := pv.DeepCopy()
 		pv.Spec.PersistentVolumeReclaimPolicy = v1.PersistentVolumeReclaimRetain
 		_, err = f.ClientSet.CoreV1().PersistentVolumes().Update(ctx, pv, metav1.UpdateOptions{})
-		ginkgo.DeferCleanup(recoverPvReclaimPolicyAndRemoveClaimRef, f.ClientSet, originPv)
+		ginkgo.DeferCleanup(recoverPvReclaimPolicy, f.ClientSet, originPv)
 		framework.ExpectNoError(err, "Failed to update PV %q reclaim policy", pvName)
 
 		// The vac_protection_controller make sure there is a VolumeAttributesClass that is not used by any PVC/PV
@@ -369,7 +369,7 @@ func (v *volumeModifyTestSuite) DefineTests(driver storageframework.TestDriver,
 
 		ginkgo.By(fmt.Sprintf("Deleting PV %q to make the vac unused for the PV", newVAC.Name))
 		pv.Spec.PersistentVolumeReclaimPolicy = v1.PersistentVolumeReclaimDelete
-		recoverPvReclaimPolicyAndRemoveClaimRef(ctx, f.ClientSet, pv)
+		recoverPvReclaimPolicy(ctx, f.ClientSet, pv)
 
 		ginkgo.By(fmt.Sprintf("Waiting for PV %q to be deleted", pvName))
 		gomega.Eventually(func() bool {
@@ -432,8 +432,8 @@ func CleanupVAC(ctx context.Context, vac *storagev1beta1.VolumeAttributesClass,
 	}, timeout, modifyPollInterval).Should(gomega.BeNil())
 }
 
-// recoverPvReclaimPolicyAndRemoveClaimRef recovers the test pv's reclaim policy to expected used for clean up test PV
-func recoverPvReclaimPolicyAndRemoveClaimRef(ctx context.Context, c clientset.Interface, expectedPv *v1.PersistentVolume) {
+// recoverPvReclaimPolicy recovers the test pv's reclaim policy to expected used for clean up test PV
+func recoverPvReclaimPolicy(ctx context.Context, c clientset.Interface, expectedPv *v1.PersistentVolume) {
 	setPvReclaimPolicyErr := retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		pv, err := c.CoreV1().PersistentVolumes().Get(ctx, expectedPv.Name, metav1.GetOptions{})
 		if err != nil {
@@ -443,11 +443,10 @@ func recoverPvReclaimPolicyAndRemoveClaimRef(ctx context.Context, c clientset.In
 			}
 			return err
 		}
-		if pv.Spec.PersistentVolumeReclaimPolicy == expectedPv.Spec.PersistentVolumeReclaimPolicy && pv.Spec.ClaimRef == nil {
+		if pv.Spec.PersistentVolumeReclaimPolicy == expectedPv.Spec.PersistentVolumeReclaimPolicy {
 			framework.Logf("PV %q reclaim policy is already recovered to %q", expectedPv.Name, expectedPv.Spec.PersistentVolumeReclaimPolicy)
 			return nil
 		}
-		pv.Spec.ClaimRef = nil
 		pv.Spec.PersistentVolumeReclaimPolicy = expectedPv.Spec.PersistentVolumeReclaimPolicy
 		_, err = c.CoreV1().PersistentVolumes().Update(ctx, pv, metav1.UpdateOptions{})
 		return err
diff --git a/go.mod b/go.mod
index 82d30effb2..0c6c9433a1 100644
--- a/go.mod
+++ b/go.mod
@@ -31,7 +31,7 @@ require (
 	github.com/go-kit/kit v0.9.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/snappy v0.0.4
-	github.com/openshift/cluster-policy-controller v0.0.0-20250725081630-3e7538547c8f
+	github.com/openshift/cluster-policy-controller v0.0.0-20250915194436-0e2948510331
 	github.com/openshift/route-controller-manager v0.0.0-20250725082216-bf2fa662f57f
 	github.com/prometheus/client_model v0.6.1
 	github.com/prometheus/common v0.62.0
diff --git a/go.sum b/go.sum
index 67abb5d211..8a2dad3005 100644
--- a/go.sum
+++ b/go.sum
@@ -261,8 +261,8 @@ github.com/openshift/build-machinery-go v0.0.0-20250602125535-1b6d00b8c37c h1:gJ
 github.com/openshift/build-machinery-go v0.0.0-20250602125535-1b6d00b8c37c/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
 github.com/openshift/client-go v0.0.0-20250710075018-396b36f983ee h1:tOtrrxfDEW8hK3eEsHqxsXurq/D6LcINGfprkQC3hqY=
 github.com/openshift/client-go v0.0.0-20250710075018-396b36f983ee/go.mod h1:zhRiYyNMk89llof2qEuGPWPD+joQPhCRUc2IK0SB510=
-github.com/openshift/cluster-policy-controller v0.0.0-20250725081630-3e7538547c8f h1:ZlSflmSPh5wdgrmuG4n/UWWtGZQgggIqWG8+EXiFXpo=
-github.com/openshift/cluster-policy-controller v0.0.0-20250725081630-3e7538547c8f/go.mod h1:977DPepMAwnGNdJQdAzVSL+Qpem/aLS9d9sGnt1yEsg=
+github.com/openshift/cluster-policy-controller v0.0.0-20250915194436-0e2948510331 h1:Vm+BxLt2wMVLlAor0JdatxFK74pIddQ7GjzsYI/OHXE=
+github.com/openshift/cluster-policy-controller v0.0.0-20250915194436-0e2948510331/go.mod h1:977DPepMAwnGNdJQdAzVSL+Qpem/aLS9d9sGnt1yEsg=
 github.com/openshift/etcd/api/v3 v3.5.1-0.20250829062802-9c065d4d842c h1:Xty9QBBJwUlug0FGix5rwjOg7rIVnmfbsg4dEaBBFM4=
 github.com/openshift/etcd/api/v3 v3.5.1-0.20250829062802-9c065d4d842c/go.mod h1:c3aH5wcvXv/9dqIw2Y810LDXJfhSYdHQ0vxmP3CCHVY=
 github.com/openshift/etcd/client/pkg/v3 v3.5.1-0.20250829062802-9c065d4d842c h1:XYHqfMdW35QxSQ6/BWJNF84YPEKRIxvvyAUgfhpo78k=
diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf
index 1cee96d838..e4fe925660 100644
--- a/packaging/crio.conf.d/10-microshift_amd64.conf
+++ b/packaging/crio.conf.d/10-microshift_amd64.conf
@@ -2,6 +2,6 @@
 # for community builds on top of OKD, this setting has no effect
 [crio.image]
 global_auth_file="/etc/crio/openshift-pull-secret"
-pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dba5d464bb715c7e03e2dcc144de10d7018f3b282afb9ca7362793457c8e6c62"
+pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9a10adc59bc9e78b0f585016f45ff71a7b5bc1862895f72bf7dc8e461a5528ad"
 pause_image_auth_file = "/etc/crio/openshift-pull-secret"
 pause_command = "/usr/bin/pod"
diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf
index 6799afe1b8..f5c1bb444a 100644
--- a/packaging/crio.conf.d/10-microshift_arm64.conf
+++ b/packaging/crio.conf.d/10-microshift_arm64.conf
@@ -2,6 +2,6 @@
 # for community builds on top of OKD, this setting has no effect
 [crio.image]
 global_auth_file="/etc/crio/openshift-pull-secret"
-pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:190e85b5622ccf749c3acdf038bf1c490fe8ff3e760c3c657c51429895e774ce"
+pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c9dba3e46b2e0d04b7f0bb2e7da314a429d76f28573015f26f85c7baf6037998"
 pause_image_auth_file = "/etc/crio/openshift-pull-secret"
 pause_command = "/usr/bin/pod"
diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt
index e3c936b9a3..8accfc999d 100644
--- a/scripts/auto-rebase/changelog.txt
+++ b/scripts/auto-rebase/changelog.txt
@@ -1,209 +1,131 @@
-- api embedded-component 4a165b214722ff53fbdac1d250f62d4b0bb2bd3d to 61248d910ff74aef020492922d14e6dadaba598b
-  - 0aed54e6 2025-09-09T13:06:31-04:00 Add more details about the Progressing condition
-  - 5d8d667e 2025-09-09T09:12:41-04:00 A New rule about CO's update duration
-  - 75e8efa1 2025-09-09T09:12:41-04:00 NO-JIRA: New rules about CO's Degraded and Available conditions
-  - 5c209c35 2025-09-08T10:21:44+01:00 Update schema checker to avoid incorrect new required fields checks
-  - c9031253 2025-09-06T18:40:40-05:00 Update NodeSwap with owner and doc blurb.
-  - 06a725ad 2025-09-05T09:45:51-05:00 Adjust typos
-  - 1780521e 2025-09-05T10:12:26-03:00 make update
-  - 8557d385 2025-09-05T10:03:36-03:00 Introduce CBORServingAndStorage feature gates
-  - 23717968 2025-09-04T12:34:18-04:00 apiservers.config.openshift.io: remove spec.tlsSecurityProfile GoDoc caveats
-  - 5f5acf37 2025-09-03T15:47:56-04:00 Add Featuregates for Dual Stack support on AWS, Azure and GCP
-  - fc52f6ed 2025-09-03T14:54:23-04:00 create new featuregate for ClusterAPIMachineManagementVSphere
-  - e0349455 2025-09-01T11:30:26+02:00 Add default value for MachineHealthCheck's maxUnhealthy to the description
-  - daaca27e 2025-08-12T09:14:01-04:00 update DesiredImage tag to include 'omitempty'
-  - 9439983b 2025-08-06T16:07:28-04:00 fixing generated files
-  - 9d44d1af 2025-08-06T08:28:52-04:00 updates to documentation
-  - 6aec27bc 2025-08-05T23:34:03-04:00 added extra line in test file
-  - b10cf04d 2025-08-05T23:24:22-04:00 fixing comments
-  - 36982cdd 2025-08-05T08:23:55-04:00 Updating API for ImageModeStatusReporting needs
-  - 677781c5 2025-07-29T14:49:37-04:00 Promote GCPClusterHostedDNSInstall to Default
-  - e65fd12f 2025-05-27T17:01:57+02:00 config/v1/cluster_operator improve documentation
-
-- cluster-dns-operator embedded-component 82578923164636746e0d74d594ab32d83a660c0b to 63a93b05b131a3f7ee8b482a5cb4f0c1eac8660e
-  - dbd776a 2025-09-05T16:42:57+02:00 Add davidesalerno to OWNERS
-
-- cluster-ingress-operator embedded-component 2371120eedb27049160c70859ef9972a7599c7e3 to 60b4279f91f6fbc135d8f15bda96a5ae664e252a
-  - d87b5e6 2025-09-10T13:32:39-03:00 NE-2139: Bump Kubernetes libraries to 1.33.4 and controller-runtime to 0.21 - vendor
-  - 66485b8 2025-09-10T13:32:31-03:00 NE-2139: Bump Kubernetes libraries to 1.33.4 and controller-runtime to 0.21
-  - 31aafe2 2025-09-05T16:38:34+02:00 Add davidesalerno to OWNERS
-  - 3c912f0 2025-09-03T13:58:34-03:00 Adjust some logs and comments per review
-  - 2502380 2025-08-26T14:25:58-03:00 OCPBUGS-60859: e2e: Improve resilience of helper functions when managing gw api resourecs
-  - a42ecfe 2025-08-26T11:33:37-03:00 OCPBUGS-60859: Fix logic on gatewayapi test cleanup
-
-- cluster-kube-controller-manager-operator embedded-component 7030e7353408e83096a285404700c573273c25c8 to 3b20c534b1b92d46055147c4f82f69b2ad3044c9
-  - 1088b7f 2025-09-05T14:35:22+05:30 Fixing arch issue
-
-- cluster-network-operator embedded-component 746b8fb86171dfc75011a7b8db29de5c2355d848 to 09a4accb5ee420155d19fbf78c6be058be50ee0e
-  - 50bac1d 2025-09-12T11:35:43-07:00 Revert "OCPBUGS-61196: Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes"
-  - a795c90 2025-09-05T09:20:50-04:00 Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes
-  - fc890bc 2025-08-26T12:55:33+02:00 Set maxUnavailable 10% on MultiNetworkPolicy DS
-  - ee2829b 2025-08-25T16:59:11-04:00 Correct context refs in test
-  - 1548405 2025-08-25T16:49:29-04:00 replace deprecated golang-cli linters
-  - fb3f46d 2025-08-20T14:43:26-05:00 Set RunAsUser for network-node-identity
-
-- cluster-openshift-controller-manager-operator embedded-component dfaeb8d5fdf1f43df37916ec3d70f57ddebb1028 to da1e14c45093c19bc79e2055c9f4a55efc1cc1a8
-  - a4b4a9a 2025-09-10T12:37:03+05:30 CNTRLPLANE-1257: set up openshift-tests-extension for cluster-openshift-controller-manager-operator and add a sanity test
-
-- csi-external-snapshotter embedded-component 42604822c25eb2aa0ecb017c24e328221b238eb9 to ba8194d5920973069bc56a8bf5844afeedc66bbd
-  - 8b132ec 2025-09-06T20:57:06Z UPSTREAM: <carry>: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/5c68d71385f72cd67a199bc4590068053a833c7d/images/ose-csi-external-snapshotter.yml
-
-- kubernetes embedded-component a237dcbeee8bbe1440c94349399cc6eac8870910 to 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
-  - fe0fab6a7 2025-09-11T12:12:16-04:00 UPSTREAM: <drop>: bump apiserver-library-go for adding missing safe sysctls
-  - 7f377252f 2025-09-05T13:09:39-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
-  - f96a1512d 2025-09-03T18:33:25+02:00 UPSTREAM: <carry>: Fix tests after backport
-  - 1be80ebbd 2025-09-03T18:25:42+02:00 UPSTREAM: 131725: Avoid encoding in LogResponseObject when we are not going to use it
-  - bc53e37c1 2025-09-03T18:25:42+02:00 UPSTREAM: 131694: Eliminate AuditContext`s SetEventLevel
-  - 76f5a22c1 2025-09-03T18:20:01+02:00 UPSTREAM: 129472: Fix API server crash on concurrent map iteration and write
-  - 5356b2a1a 2025-09-03T09:14:32-04:00 UPSTREAM: 133625: Remove patch/update from ServiceCIDR API conformance test
-  - b991326d9 2025-08-29T08:23:42+03:00 UPSTREAM: 133682: Increase port-forward broken connection detection client timeout
-  - fe93594a7 2025-08-28T12:26:22+02:00 UPSTREAM: 133425: Fix SELinux label comparison
-  - 589943de5 2025-08-27T15:56:17-04:00 UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: Revert "OCPBUGS-60507: Bump 1.33.4""
-
-- machine-config-operator embedded-component 7a56cf0048a05d576e746c3e992ce586e07c97e8 to cd9b709c16ad9d8b32701d13af2d068eb4ca9c49
-  - e2bd1c04 2025-09-04T16:17:36-04:00 drain: re-cordon nodes if needed
-  - c2c1b708 2025-08-28T15:59:44-04:00 crc & kcc: Before deleting a degraded MC, ensure that the annotations have not been updated since the last check
-  - 4d7ad609 2025-08-19T12:40:18-04:00 Azure: Update services that run on control plane nodes
-  - 9533431d 2025-08-19T12:40:18-04:00 Start in-cluster CoreDNS pod for Azure on the control-plane
-  - 62ee24c2 2025-08-13T12:51:17-04:00 Start in-cluster CoreDNS pod on bootstrap node for Azure
-
-- operator-framework-olm embedded-component e53cf3090214284bf913bd2d7165a0a9422635a0 to 52b69a5bc151303c21268007009c0300f3170bc2
-  - ecfa3e3f 2025-09-12T00:04:17Z :seedling: Bump github.com/maxbrunsfeld/counterfeiter/v6 (#3646)
-  - a2ef2515 2025-09-10T00:03:50Z Test NetworkPolicy support in e2es (#3630)
-  - 334ca436 2025-09-09T10:31:00Z Updating ose-operator-framework-tools-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/5c68d71385f72cd67a199bc4590068053a833c7d/images/ose-operator-framework-tools.yml
-  - c18d94a2 2025-09-09T03:38:36Z Updating operator-lifecycle-manager-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/5c68d71385f72cd67a199bc4590068053a833c7d/images/operator-lifecycle-manager.yml
-  - ea4354d7 2025-09-08T10:00:00+02:00 UPSTREAM: <carry>: make downstream csv namespace labeler plugin e2e more resilient to race conditions
-  - 8b092cd3 2025-09-07T00:17:10Z Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#444)
-  - fd330ff6 2025-09-07T00:16:32Z Bump the k8s-dependencies group with 4 updates (#442)
-  - 70560289 2025-09-07T00:16:19Z Bump actions/checkout from 4 to 5 (#441)
-  - d7be82e9 2025-09-07T00:16:07Z Bump the k8s-dependencies group with 5 updates (#440)
-  - 07329cd7 2025-09-07T00:15:54Z bump api to v0.34.0 (#1773)
-  - 6add5c7c 2025-09-07T00:15:40Z Bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.2 (#1771)
-  - 0259430c 2025-09-07T00:15:26Z Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 (#1770)
-  - 576a2b34 2025-09-07T00:15:11Z Bump github.com/onsi/gomega from 1.38.1 to 1.38.2 (#1768)
-  - c2f8fb46 2025-09-07T00:14:57Z Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#1765)
-  - b737ed49 2025-09-07T00:14:43Z Bump github.com/onsi/gomega from 1.38.0 to 1.38.1 (#1764)
-  - deb21689 2025-09-07T00:14:29Z Add sort to linkChannels output before diff check (#1767)
-  - f0ef0eea 2025-09-07T00:14:14Z initial working viz of ignored v0 edges (#1744)
-  - 052575ce 2025-09-07T00:14:00Z eliminate skipping same-Y.maxZ, which should only replace (#1749)
-  - 05ec0d60 2025-09-07T00:13:46Z Bump google.golang.org/protobuf from 1.36.7 to 1.36.8 (#1761)
-  - 89010427 2025-09-07T00:13:32Z Bump golang from 1.24-alpine to 1.25-alpine (#1760)
-  - 4a8998f2 2025-09-07T00:13:18Z Bump k8s.io/apiextensions-apiserver from 0.33.3 to 0.33.4 (#1756)
-  - 775261cc 2025-09-07T00:13:04Z Fix typo in dependabot config (#1759)
-  - 0f6dc285 2025-09-07T00:12:50Z Bump google.golang.org/protobuf from 1.36.6 to 1.36.7 (#1758)
-  - 2aeb32f0 2025-09-07T00:12:35Z Bump google.golang.org/grpc from 1.74.2 to 1.75.0 (#1755)
-  - bda3165e 2025-09-07T00:12:20Z Bump go.etcd.io/bbolt from 1.4.2 to 1.4.3 (#1753)
-  - 8d82f96f 2025-09-07T00:12:06Z Bump k8s.io/client-go from 0.33.3 to 0.33.4 (#1752)
-  - 39977861 2025-09-07T00:11:52Z Bump github.com/grpc-ecosystem/grpc-health-probe from 0.4.39 to 0.4.40 (#1751)
-  - 75b46ba3 2025-09-07T00:11:37Z Bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 (#1748)
-  - 660b7319 2025-09-07T00:11:23Z Bump golang.org/x/net from 0.42.0 to 0.43.0 (#1746)
-  - ea3f4c21 2025-09-07T00:11:09Z Bump github.com/mattn/go-sqlite3 from 1.14.30 to 1.14.32 (#1745)
-  - c4ee5876 2025-09-07T00:10:55Z Bump actions/checkout from 4 to 5 (#1743)
-  - 14f4cf27 2025-09-07T00:10:41Z Bump github.com/containers/common from 0.64.0 to 0.64.1 (#1737)
-  - 8594cda8 2025-09-07T00:10:26Z Fix invalid ConfigMap key translation (#1742)
-  - e581bb2f 2025-09-07T00:10:12Z Bump golang.org/x/mod from 0.26.0 to 0.27.0 (#1740)
-  - 1ca42f6b 2025-09-07T00:09:58Z Bump golang.org/x/sys from 0.34.0 to 0.35.0 (#1739)
-  - 1fd1ad0f 2025-09-07T00:09:44Z Bump github.com/tidwall/btree from 1.8.0 to 1.8.1 (#1738)
-  - ca44b13d 2025-09-07T00:09:30Z Bump actions/download-artifact from 4 to 5 (#1736)
-  - 939a58be 2025-09-07T00:09:16Z Bump github.com/containers/image/v5 from 5.36.0 to 5.36.1 (#1735)
-  - 3ee086c6 2025-09-07T00:09:01Z Bump github.com/containerd/containerd from 1.7.27 to 1.7.28 (#1732)
-  - d298f21d 2025-09-07T00:08:47Z Bump github.com/docker/cli (#1734)
-  - c45965d0 2025-09-07T00:08:33Z Bump github.com/mattn/go-sqlite3 from 1.14.28 to 1.14.30 (#1733)
-  - 1e754e94 2025-09-07T00:08:19Z Bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 (#1730)
-  - 18830aa6 2025-09-07T00:08:05Z Bump github.com/onsi/gomega from 1.37.0 to 1.38.0 (#1729)
-  - 90bde1f8 2025-09-07T00:07:51Z Bump github.com/containers/common from 0.63.1 to 0.64.0 (#1728)
-  - c5aab87d 2025-09-07T00:07:36Z Bump github.com/operator-framework/api from 0.32.0 to 0.33.0 (#1725)
-  - 7cc41a2f 2025-09-07T00:07:21Z Bump google.golang.org/grpc from 1.73.0 to 1.74.2 (#1727)
-  - ede09d18 2025-09-07T00:07:07Z Bump k8s.io/apiextensions-apiserver from 0.33.2 to 0.33.3 (#1722)
-  - 37e846f0 2025-09-07T00:06:49Z Bump github.com/spf13/pflag from 1.0.6 to 1.0.7 (#1723)
-  - 7c37111f 2025-09-07T00:06:35Z Bump k8s.io/apimachinery from 0.33.2 to 0.33.3 (#1721)
-  - eb276a54 2025-09-07T00:06:21Z Bump github.com/containers/image/v5 from 5.35.0 to 5.36.0 (#1720)
-  - 42da0bc5 2025-09-07T00:06:05Z Bump github.com/maxbrunsfeld/counterfeiter/v6 from 6.11.2 to 6.11.3 (#1719)
-  - d1bac153 2025-09-07T00:05:50Z Bump golang.org/x/net from 0.41.0 to 0.42.0 (#1717)
-  - 7a329b0e 2025-09-07T00:05:35Z Bump golang.org/x/mod from 0.25.0 to 0.26.0 (#1712)
-  - 25c25c4a 2025-09-07T00:05:21Z Bump golang.org/x/text from 0.26.0 to 0.27.0 (#1715)
-  - 4c8208dc 2025-09-07T00:05:06Z Bump golang.org/x/sync from 0.15.0 to 0.16.0 (#1714)
-  - 2b2ce479 2025-09-07T00:04:51Z Bump github.com/docker/cli (#1713)
-  - fb136a03 2025-09-07T00:04:37Z Bump github.com/tidwall/btree from 1.7.0 to 1.8.0 (#1711)
-  - a6a90e86 2025-09-07T00:04:15Z Make PSA catalog tests more resilient (#3645)
-  - 7119af05 2025-09-07T00:04:00Z refactor ensure job to remove named parameters (#3644)
-  - 8fc22306 2025-09-07T00:03:46Z rorfs for cacheless lacks write access to /tmp/ to generate cache (#3640)
-  - 05ab3721 2025-09-07T00:03:23Z switch kindest/node version to fix linux (#3643)
-  - c76c5a56 2025-09-07T00:03:08Z :seedling: Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#3639)
-  - 9c13d90a 2025-09-07T00:02:52Z bumps for api, operator-registry prepping for release (#3636)
-
-- oc image-amd64 31597edbaedc6d8d206deda350cfc93e89fa24bf to f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d
-  - e2784fcc 2025-09-11T09:23:15+03:00 Add unit tests to verify the behavior
-  - c550a52b 2025-09-09T11:05:35-07:00 pkg/cli/admin/upgrade/recommend/examples/4.19.0-okd-scos.16: Add OKD example
-  - 24209697 2025-09-09T12:48:19+03:00 Add some warnings into excluded list
-  - 5d053a4d 2025-09-09T10:35:05+03:00 oc adm policy: Only initialize UserClient if built-in OAuth is enabled
-  - af08082d 2025-09-08T12:50:51+03:00 Introduce auto-open-browser flag for external OIDC issuer login
-  - effd73ed 2025-09-04T09:18:42+02:00 oc adm must-gather: Wrap gather in a session
-  - 8bdac163 2025-09-03T16:28:10-07:00 pkg/cli/admin/upgrade/recommend: Enable precheck and accept gates
-  - 24d5b0a8 2025-09-01T16:49:27+03:00 Rely on overall available disk space of the mounted volume
-  - ea3cacdc 2025-08-29T13:21:45+02:00 must-gather: Fix usage checker for custom commands
-
-- csi-external-snapshotter image-amd64 42604822c25eb2aa0ecb017c24e328221b238eb9 to ba8194d5920973069bc56a8bf5844afeedc66bbd
-  - 8b132ec 2025-09-06T20:57:06Z UPSTREAM: <carry>: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/5c68d71385f72cd67a199bc4590068053a833c7d/images/ose-csi-external-snapshotter.yml
-
-- router image-amd64 7c50294cfbc9a7c0d3c715de56fb92dadeefb8e6 to 2bc8169c87ccd69cceeeab7552bedb6f16a34c84
-  - ac22e22 2025-09-09T08:48:01-04:00 Revert "OCPBUGS-55506: Prevent startup failures due to name resolution"
-  - 2f97b4d 2025-09-05T16:46:08+02:00 Add davidesalerno to OWNERS
-
-- ovn-kubernetes image-amd64 9741174157381d7b87e2d21559cbe06b8f2b5ebf to 8567f11fa93e164b6eb424ce2f831c608e1094f4
-  - 962f7070 2025-08-26T16:38:32+02:00 [kind] Fix kubevirt/ipam-extensions version to the latest v0.3.0
-  - 08dd5ed8 2025-08-25T09:54:51-04:00 Fixes proper per-test initialization of prInterfaceOpsStub
-  - 9f75d19f 2025-08-22T17:01:26-04:00 Enable unprivileged CNI mode in some e2es
-  - 1a5f4102 2025-08-22T16:53:14-04:00 Adds CNI Shim unit testing
-  - 402b187d 2025-08-22T11:24:38-04:00 Adds missing CNI server tests for unprivileged mode
-  - 809edf44 2025-08-19T17:17:19+01:00 Improve ACL logging file metrics monitor
-
-- kubernetes image-amd64 a237dcbeee8bbe1440c94349399cc6eac8870910 to 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
-  - fe0fab6a7 2025-09-11T12:12:16-04:00 UPSTREAM: <drop>: bump apiserver-library-go for adding missing safe sysctls
-  - 7f377252f 2025-09-05T13:09:39-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
-  - f96a1512d 2025-09-03T18:33:25+02:00 UPSTREAM: <carry>: Fix tests after backport
-  - 1be80ebbd 2025-09-03T18:25:42+02:00 UPSTREAM: 131725: Avoid encoding in LogResponseObject when we are not going to use it
-  - bc53e37c1 2025-09-03T18:25:42+02:00 UPSTREAM: 131694: Eliminate AuditContext`s SetEventLevel
-  - 76f5a22c1 2025-09-03T18:20:01+02:00 UPSTREAM: 129472: Fix API server crash on concurrent map iteration and write
-  - 5356b2a1a 2025-09-03T09:14:32-04:00 UPSTREAM: 133625: Remove patch/update from ServiceCIDR API conformance test
-  - b991326d9 2025-08-29T08:23:42+03:00 UPSTREAM: 133682: Increase port-forward broken connection detection client timeout
-  - fe93594a7 2025-08-28T12:26:22+02:00 UPSTREAM: 133425: Fix SELinux label comparison
-  - 589943de5 2025-08-27T15:56:17-04:00 UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: Revert "OCPBUGS-60507: Bump 1.33.4""
-
-- oc image-arm64 a43428189603f12ae190703cb725f66f742fbe52 to f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d
-  - e2784fcc 2025-09-11T09:23:15+03:00 Add unit tests to verify the behavior
-  - c550a52b 2025-09-09T11:05:35-07:00 pkg/cli/admin/upgrade/recommend/examples/4.19.0-okd-scos.16: Add OKD example
-  - 24209697 2025-09-09T12:48:19+03:00 Add some warnings into excluded list
-  - 5d053a4d 2025-09-09T10:35:05+03:00 oc adm policy: Only initialize UserClient if built-in OAuth is enabled
-  - af08082d 2025-09-08T12:50:51+03:00 Introduce auto-open-browser flag for external OIDC issuer login
-  - effd73ed 2025-09-04T09:18:42+02:00 oc adm must-gather: Wrap gather in a session
-  - 8bdac163 2025-09-03T16:28:10-07:00 pkg/cli/admin/upgrade/recommend: Enable precheck and accept gates
-  - 24d5b0a8 2025-09-01T16:49:27+03:00 Rely on overall available disk space of the mounted volume
-
-- csi-external-snapshotter image-arm64 42604822c25eb2aa0ecb017c24e328221b238eb9 to ba8194d5920973069bc56a8bf5844afeedc66bbd
-  - 8b132ec 2025-09-06T20:57:06Z UPSTREAM: <carry>: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/5c68d71385f72cd67a199bc4590068053a833c7d/images/ose-csi-external-snapshotter.yml
-
-- router image-arm64 7c50294cfbc9a7c0d3c715de56fb92dadeefb8e6 to 2bc8169c87ccd69cceeeab7552bedb6f16a34c84
-  - ac22e22 2025-09-09T08:48:01-04:00 Revert "OCPBUGS-55506: Prevent startup failures due to name resolution"
-  - 2f97b4d 2025-09-05T16:46:08+02:00 Add davidesalerno to OWNERS
-
-- ovn-kubernetes image-arm64 9741174157381d7b87e2d21559cbe06b8f2b5ebf to 8567f11fa93e164b6eb424ce2f831c608e1094f4
-  - 962f7070 2025-08-26T16:38:32+02:00 [kind] Fix kubevirt/ipam-extensions version to the latest v0.3.0
-  - 08dd5ed8 2025-08-25T09:54:51-04:00 Fixes proper per-test initialization of prInterfaceOpsStub
-  - 9f75d19f 2025-08-22T17:01:26-04:00 Enable unprivileged CNI mode in some e2es
-  - 1a5f4102 2025-08-22T16:53:14-04:00 Adds CNI Shim unit testing
-  - 402b187d 2025-08-22T11:24:38-04:00 Adds missing CNI server tests for unprivileged mode
-  - 809edf44 2025-08-19T17:17:19+01:00 Improve ACL logging file metrics monitor
-
-- kubernetes image-arm64 a237dcbeee8bbe1440c94349399cc6eac8870910 to 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
-  - fe0fab6a7 2025-09-11T12:12:16-04:00 UPSTREAM: <drop>: bump apiserver-library-go for adding missing safe sysctls
-  - 7f377252f 2025-09-05T13:09:39-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
-  - f96a1512d 2025-09-03T18:33:25+02:00 UPSTREAM: <carry>: Fix tests after backport
-  - 1be80ebbd 2025-09-03T18:25:42+02:00 UPSTREAM: 131725: Avoid encoding in LogResponseObject when we are not going to use it
-  - bc53e37c1 2025-09-03T18:25:42+02:00 UPSTREAM: 131694: Eliminate AuditContext`s SetEventLevel
-  - 76f5a22c1 2025-09-03T18:20:01+02:00 UPSTREAM: 129472: Fix API server crash on concurrent map iteration and write
-  - 5356b2a1a 2025-09-03T09:14:32-04:00 UPSTREAM: 133625: Remove patch/update from ServiceCIDR API conformance test
-  - b991326d9 2025-08-29T08:23:42+03:00 UPSTREAM: 133682: Increase port-forward broken connection detection client timeout
-  - fe93594a7 2025-08-28T12:26:22+02:00 UPSTREAM: 133425: Fix SELinux label comparison
-  - 589943de5 2025-08-27T15:56:17-04:00 UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: Revert "OCPBUGS-60507: Bump 1.33.4""
+- api embedded-component 61248d910ff74aef020492922d14e6dadaba598b to 83b017b06367bf8564bf94f5c6c1ad8aed5d3ab9
+  - b6f0e27a 2025-09-16T10:45:31+01:00 Update controller-tools
+  - 881674e4 2025-09-01T15:03:56+02:00 Add metric server API
+
+- cluster-dns-operator embedded-component 63a93b05b131a3f7ee8b482a5cb4f0c1eac8660e to 1272aef21dd5dcdbefbf4888c7b0a4a427683fd7
+  - 6f21905 2025-09-15T15:07:12-04:00 Add bentito (btofel@redhat.com) to OWNERS
+
+- cluster-ingress-operator embedded-component 60b4279f91f6fbc135d8f15bda96a5ae664e252a to c968596268df58ed8747a8f88ebb8c501824bbb2
+  - c5c5c85 2025-09-15T14:55:09-04:00 Add bentito (btofel@redhat.com) to OWNERS
+  - cc00436 2025-08-20T17:16:07+01:00 OCPBUGS-55673: Remove IngressControllerLBSubnetsAWS featuregate
+
+- cluster-kube-apiserver-operator embedded-component 0bec046c8c10682390e2a20ae4f416a2d8589f40 to 25092d8447b0186402dcf2a6564f6ac2ebf55c9b
+  - f127598 2025-09-15T09:51:28-07:00 bump(k8s): promote MutatingAdmissionPolicy to v1beta1 for > 1.34.0
+
+- cluster-kube-controller-manager-operator embedded-component 3b20c534b1b92d46055147c4f82f69b2ad3044c9 to a92da07ac1f335c148411c838dd2982c9ca90988
+  - 1e279cb 2025-08-20T17:37:46+02:00 Remove --cloud-provider=external from KCM
+
+- cluster-kube-scheduler-operator embedded-component f9b5b31943f2be768af6373def4c8946a30d0ed6 to 2345371abed5896006ac4a60c7d555fc25502c0a
+  - 4339305 2025-09-05T13:59:33+02:00 adding ROFS
+  - 9d6fe98 2025-09-05T10:17:36+02:00 adding ROFS
+
+- cluster-network-operator embedded-component 09a4accb5ee420155d19fbf78c6be058be50ee0e to c069f36d58d9d8ad4a9cd23a410fb263a5e689ed
+  - 7e8f8cc 2025-09-11T15:41:54-04:00 Add validation check for labels and test
+  - 97b68b8 2025-09-11T15:40:31-04:00 Add documentation surrounding the Smart-NIC/DPU Host/DPU mode labels
+  - 842c48c 2025-09-11T15:39:37-04:00 Relax label req. of DPU/DPU Host/Smart NIC
+
+- cluster-policy-controller embedded-component 3e7538547c8f209c72083097a4ebaada6e9c46c5 to 0e2948510331ff9351c5eb6d7f2f440afc7aa17a
+  - f281462 2025-08-19T14:18:12+02:00 scc allocation controller: Use server-side apply
+
+- kubernetes embedded-component 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b to 95b8140e3a53ffc6aab114c39e07a439dfdf7f9e
+  - bd238e196 2025-09-17T10:47:16-04:00 UPSTREAM: <carry>: Add retries for GetCurrentResourceVersion.
+  - 87b26c865 2025-09-09T13:36:27+02:00 UPSTREAM: 133959: Do not remove PVC ClaimRef to fix flaky VAC test
+
+- machine-config-operator embedded-component cd9b709c16ad9d8b32701d13af2d068eb4ca9c49 to 223bed017865d085a6fda3a41050627be96ed340
+  - 139dd0c2 2025-09-15T16:27:15-05:00 OCPBUGS-61695: Override NMState service definition
+  - fd87e53a 2025-09-15T15:52:14-04:00 units: add delays to TestOSBuildController
+  - c6f988c0 2025-09-15T10:48:16-05:00 add new recording rule for unsuported packages
+  - 1889a793 2025-08-27T10:00:56-04:00 msbic: add unit tests
+  - 55a0cc80 2025-08-27T10:00:56-04:00 msbic: add azure platform support
+  - 0c077d64 2025-08-25T11:59:59-04:00 operator: add azure boot image update gates
+  - ae39bd1b 2025-08-25T11:59:59-04:00 vendor bump for Azure stream updates
+  - 3f274443 2025-08-19T09:13:17-04:00 Add nil/null checks to image registry secret decode
+  - 715f38dd 2025-08-12T09:02:58-04:00 install: remove mcn crd cleanup cronjob
+
+- openshift-controller-manager embedded-component 49aaf599fb9024f36359f55bac6b3bb1482e24b8 to b297407761ee836f0a43a42ba0486bc97b54f888
+  - 6c2059d 2025-09-15T14:20:48+05:30 set up openshift-tests-extension for cluster-openshift-controller-manager-operator and add a sanity test
+
+- operator-framework-olm embedded-component 52b69a5bc151303c21268007009c0300f3170bc2 to 44c993131781ff5bfb8665b0e6cc1d2a3bf23839
+  - fd5119fc 2025-09-18T14:07:22+08:00 move golangci-lint and go-bindata to new location to fix sync
+  - 62ce21ab 2025-09-17T14:07:14+08:00 add OTE into olmv0 with new location
+  - 57aa443f 2025-09-16T18:32:25+00:00 migrate containers libs to new mono-repo (#1799)
+  - cdba3e50 2025-09-16T18:31:45+00:00 set an exception for migrate file permissions (#1798)
+  - 8bc227c4 2025-09-16T18:31:21+00:00 Bump the golang-x-deps group across 1 directory with 2 updates (#1797)
+  - f1e8858f 2025-09-16T18:30:35+00:00 Bump google.golang.org/grpc from 1.75.0 to 1.75.1 (#1796)
+  - 9e6853ab 2025-09-16T18:30:21+00:00 Bump github.com/maxbrunsfeld/counterfeiter/v6 from 6.11.3 to 6.12.0 (#1791)
+  - f1d6e13b 2025-09-16T18:30:07+00:00 Bump google.golang.org/protobuf from 1.36.8 to 1.36.9 (#1793)
+  - abfd941b 2025-09-16T18:29:53+00:00 switch tactics (#1750)
+  - eba479a4 2025-09-16T18:29:39+00:00 Bump the golang-x-deps group with 2 updates (#1789)
+  - 872ca763 2025-09-16T18:29:25+00:00 Bump actions/setup-go from 5 to 6 (#1788)
+  - 7de9f98d 2025-09-16T18:29:11+00:00 Bump actions/stale from 9 to 10 (#1787)
+  - 269b972a 2025-09-16T18:28:57+00:00 Bump github.com/onsi/ginkgo/v2 from 2.25.2 to 2.25.3 (#1786)
+  - d6aa1ba3 2025-09-16T18:28:43+00:00 Bump github.com/containers/common from 0.64.1 to 0.64.2 (#1785)
+  - 57264134 2025-09-16T18:28:27+00:00 Bump github.com/docker/cli (#1784)
+  - af9d1f73 2025-09-16T18:28:13+00:00 Bump github.com/containers/image/v5 from 5.36.1 to 5.36.2 (#1783)
+  - 8633b4bc 2025-09-16T18:27:59+00:00 Bump github.com/spf13/pflag from 1.0.9 to 1.0.10 (#1782)
+  - 0ff2fb3d 2025-09-16T18:27:45+00:00 Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#1781)
+  - eb1a07e9 2025-09-16T18:27:31+00:00 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#1779)
+  - 301f97f5 2025-09-16T18:27:16+00:00 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#1776)
+  - b5926636 2025-09-16T18:27:01+00:00 Add key ordering for mermaid graph output (#1778)
+  - e3b314e5 2025-09-16T18:26:47+00:00 Bump github.com/spf13/pflag from 1.0.7 to 1.0.8 (#1775)
+  - 93fa5af0 2025-09-16T18:26:32+00:00 Bump github.com/golang-migrate/migrate/v4 from 4.18.3 to 4.19.0 (#1774)
+  - 74e7824b 2025-09-16T18:26:10+00:00 OPRUN-4119: migrate containers libs to new mono repo (#3657)
+  - 15c068ae 2025-09-16T18:25:53+00:00 :seedling: Bump github.com/containers/image/v5 from 5.36.1 to 5.36.2 (#3655)
+  - b3909aea 2025-09-16T18:25:36+00:00 :seedling: Bump golang.org/x/time from 0.12.0 to 0.13.0 (#3654)
+  - 0dd890f4 2025-09-16T18:25:19+00:00 :seedling: Bump github.com/operator-framework/operator-registry (#3656)
+  - 6b718ac6 2025-09-16T18:24:57+00:00 :seedling: Bump golang.org/x/net from 0.43.0 to 0.44.0 (#3653)
+  - 57b4385b 2025-09-16T18:24:37+00:00 :seedling: Bump github.com/prometheus/client_golang from 1.23.0 to 1.23.2 (#3649)
+  - 9f255f70 2025-09-16T18:24:17+00:00 Bump actions/stale from 9 to 10 (#3651)
+  - 28fa15aa 2025-09-16T18:23:58+00:00 Bump actions/setup-go from 5 to 6 (#3650)
+  - c240bda3 2025-09-16T18:23:28+00:00 :seedling: Bump github.com/prometheus/common from 0.65.0 to 0.66.1 (#3648)
+  - b65ec3fb 2025-09-16T14:05:25+08:00 UPSTREAM: <carry>: add jiazha to approvers
+  - 22a2cb72 2025-09-16T10:41:32+08:00 Revert "OCPQE-29415: UPSTREAM: <carry>: add OTE into olmv0"
+  - ec6e19a6 2025-09-12T20:31:11+00:00 Updating operator-registry-container image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/1097a63a576d216981abbff7a60c4c5da67d1644/images/operator-registry.yml
+  - a3ba3ae2 2025-09-12T13:42:21+08:00 UPSTREAM: <carry>: add OTE into olmv0
+  - 825dc7b2 2025-09-12T09:30:09+08:00 set package-server-manager as default container
+
+- service-ca-operator embedded-component b0fe556a981964728306f803864af9d2881db967 to a40d9a8ec60e0c6c1578300c372b6104130f2ecc
+  - dc11bc4 2025-09-15T11:18:02+02:00 secret_creating_controller: improve hotloop tests
+  - ae08731 2025-09-12T14:56:47+02:00 secret_creating_controller: fix hotloop on create secret error
+  - 9052e26 2025-09-12T14:41:46+02:00 secret_creating_controller_test: cover failure with invalid name
+  - 8a83a3f 2025-09-11T17:24:11+02:00 secret_creating_controller_test: add secretName to test struct
+  - 9e0422c 2025-09-11T17:22:42+02:00 secret_creating_controller_test: fix typo in test struct field name
+
+- oc image-amd64 f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d to 0e4fabc98dc46c9fca79544297783053a49370ce
+  - 4e6421d1 2025-09-17T14:26:04+02:00 pkg/.../inspect: Add support for context
+  - 08ec7194 2025-09-17T13:08:45+02:00 must-gather: Align cleanup order
+  - 19c0d4b7 2025-09-17T12:59:07+03:00 Add tchap as reviewer in oc
+  - 582a8bdc 2025-09-11T14:31:15+02:00 vendor: Update library-go and go-ldap
+  - 21b0e7cb 2025-09-11T14:31:15+02:00 oc adm groups sync: Use client.Unbind
+
+- coredns image-amd64 6f39336e6da9dc77b2db140a96773c413d50a665 to 42e2cf1e46dfd9dd11669b06fb1d619cd9335e17
+  - 6e38175 2025-09-15T16:48:48-04:00 Add bentito (btofel@redhat.com) to OWNERS
+
+- router image-amd64 2bc8169c87ccd69cceeeab7552bedb6f16a34c84 to 2c1a6790a4208cea7b8809ebdba3d2a8223827a8
+  - c153dfe 2025-09-15T16:49:10-04:00 Add bentito (btofel@redhat.com) to OWNERS
+  - 2add7ea 2025-06-20T06:39:20+00:00 Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/8f77fc475c95f9d98c348deb2feb88f5952d7357/images/ose-haproxy-router-base.yml
+
+- ovn-kubernetes image-amd64 8567f11fa93e164b6eb424ce2f831c608e1094f4 to 5ad762f86466c2e11b94da2cee211cec97e16a3a
+  - b36bb31d 2025-08-29T13:27:35-04:00 OCPBUGS-61065: As part of DPF installation we are required to use OCP downstream image for dpu service. Dpu service uses upstream ovnkube.sh script that requires ovndb-raft-functions.sh as a dependency. This change copies it into the image as part of Dockerfile.base
+
+- kubernetes image-amd64 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b to 95b8140e3a53ffc6aab114c39e07a439dfdf7f9e
+  - bd238e196 2025-09-17T10:47:16-04:00 UPSTREAM: <carry>: Add retries for GetCurrentResourceVersion.
+  - 87b26c865 2025-09-09T13:36:27+02:00 UPSTREAM: 133959: Do not remove PVC ClaimRef to fix flaky VAC test
+
+- service-ca-operator image-amd64 b0fe556a981964728306f803864af9d2881db967 to a40d9a8ec60e0c6c1578300c372b6104130f2ecc
+  - dc11bc4 2025-09-15T11:18:02+02:00 secret_creating_controller: improve hotloop tests
+  - ae08731 2025-09-12T14:56:47+02:00 secret_creating_controller: fix hotloop on create secret error
+  - 9052e26 2025-09-12T14:41:46+02:00 secret_creating_controller_test: cover failure with invalid name
+  - 8a83a3f 2025-09-11T17:24:11+02:00 secret_creating_controller_test: add secretName to test struct
+  - 9e0422c 2025-09-11T17:22:42+02:00 secret_creating_controller_test: fix typo in test struct field name
+
+- oc image-arm64 f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d to fa1bc38754e9b24d392d7845a290cf996d8da146
+  - 582a8bdc 2025-09-11T14:31:15+02:00 vendor: Update library-go and go-ldap
+  - 21b0e7cb 2025-09-11T14:31:15+02:00 oc adm groups sync: Use client.Unbind
+
+- ovn-kubernetes image-arm64 8567f11fa93e164b6eb424ce2f831c608e1094f4 to 5ad762f86466c2e11b94da2cee211cec97e16a3a
+  - b36bb31d 2025-08-29T13:27:35-04:00 OCPBUGS-61065: As part of DPF installation we are required to use OCP downstream image for dpu service. Dpu service uses upstream ovnkube.sh script that requires ovndb-raft-functions.sh as a dependency. This change copies it into the image as part of Dockerfile.base
+
+- kubernetes image-arm64 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b to b59afbdc1eb4ecb7c8b19b8cc95c4657df6caf6d
+  - 87b26c865 2025-09-09T13:36:27+02:00 UPSTREAM: 133959: Do not remove PVC ClaimRef to fix flaky VAC test
 
diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt
index f56a2217bb..966c8b52ff 100644
--- a/scripts/auto-rebase/commits.txt
+++ b/scripts/auto-rebase/commits.txt
@@ -1,35 +1,35 @@
-https://github.com/openshift/api embedded-component 61248d910ff74aef020492922d14e6dadaba598b
+https://github.com/openshift/api embedded-component 83b017b06367bf8564bf94f5c6c1ad8aed5d3ab9
 https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 3880c9659829c9904e58a943050e8dfd4c9a79cb
-https://github.com/openshift/cluster-dns-operator embedded-component 63a93b05b131a3f7ee8b482a5cb4f0c1eac8660e
-https://github.com/openshift/cluster-ingress-operator embedded-component 60b4279f91f6fbc135d8f15bda96a5ae664e252a
-https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 0bec046c8c10682390e2a20ae4f416a2d8589f40
-https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 3b20c534b1b92d46055147c4f82f69b2ad3044c9
-https://github.com/openshift/cluster-kube-scheduler-operator embedded-component f9b5b31943f2be768af6373def4c8946a30d0ed6
-https://github.com/openshift/cluster-network-operator embedded-component 09a4accb5ee420155d19fbf78c6be058be50ee0e
+https://github.com/openshift/cluster-dns-operator embedded-component 1272aef21dd5dcdbefbf4888c7b0a4a427683fd7
+https://github.com/openshift/cluster-ingress-operator embedded-component c968596268df58ed8747a8f88ebb8c501824bbb2
+https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 25092d8447b0186402dcf2a6564f6ac2ebf55c9b
+https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component a92da07ac1f335c148411c838dd2982c9ca90988
+https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 2345371abed5896006ac4a60c7d555fc25502c0a
+https://github.com/openshift/cluster-network-operator embedded-component c069f36d58d9d8ad4a9cd23a410fb263a5e689ed
 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component da1e14c45093c19bc79e2055c9f4a55efc1cc1a8
-https://github.com/openshift/cluster-policy-controller embedded-component 3e7538547c8f209c72083097a4ebaada6e9c46c5
+https://github.com/openshift/cluster-policy-controller embedded-component 0e2948510331ff9351c5eb6d7f2f440afc7aa17a
 https://github.com/openshift/csi-external-snapshotter embedded-component ba8194d5920973069bc56a8bf5844afeedc66bbd
 https://github.com/openshift/etcd embedded-component 9c065d4d842c8de57806426c13201413b4d595e2
-https://github.com/openshift/kubernetes embedded-component 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
+https://github.com/openshift/kubernetes embedded-component 95b8140e3a53ffc6aab114c39e07a439dfdf7f9e
 https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 0f8a4eb84ace9b746cf25d51d80dacf34ca5f953
-https://github.com/openshift/machine-config-operator embedded-component cd9b709c16ad9d8b32701d13af2d068eb4ca9c49
-https://github.com/openshift/openshift-controller-manager embedded-component 49aaf599fb9024f36359f55bac6b3bb1482e24b8
-https://github.com/openshift/operator-framework-olm embedded-component 52b69a5bc151303c21268007009c0300f3170bc2
+https://github.com/openshift/machine-config-operator embedded-component 223bed017865d085a6fda3a41050627be96ed340
+https://github.com/openshift/openshift-controller-manager embedded-component b297407761ee836f0a43a42ba0486bc97b54f888
+https://github.com/openshift/operator-framework-olm embedded-component 44c993131781ff5bfb8665b0e6cc1d2a3bf23839
 https://github.com/openshift/route-controller-manager embedded-component bf2fa662f57f233d8541f94c4953e0dcd7a5ab20
-https://github.com/openshift/service-ca-operator embedded-component b0fe556a981964728306f803864af9d2881db967
-https://github.com/openshift/oc image-amd64 f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d
-https://github.com/openshift/coredns image-amd64 6f39336e6da9dc77b2db140a96773c413d50a665
+https://github.com/openshift/service-ca-operator embedded-component a40d9a8ec60e0c6c1578300c372b6104130f2ecc
+https://github.com/openshift/oc image-amd64 0e4fabc98dc46c9fca79544297783053a49370ce
+https://github.com/openshift/coredns image-amd64 42e2cf1e46dfd9dd11669b06fb1d619cd9335e17
 https://github.com/openshift/csi-external-snapshotter image-amd64 ba8194d5920973069bc56a8bf5844afeedc66bbd
-https://github.com/openshift/router image-amd64 2bc8169c87ccd69cceeeab7552bedb6f16a34c84
+https://github.com/openshift/router image-amd64 2c1a6790a4208cea7b8809ebdba3d2a8223827a8
 https://github.com/openshift/kube-rbac-proxy image-amd64 b9134351be37c43408334047d8eb85d0ac01fe4e
-https://github.com/openshift/ovn-kubernetes image-amd64 8567f11fa93e164b6eb424ce2f831c608e1094f4
-https://github.com/openshift/kubernetes image-amd64 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
-https://github.com/openshift/service-ca-operator image-amd64 b0fe556a981964728306f803864af9d2881db967
-https://github.com/openshift/oc image-arm64 f7c9fc36fbaa85b3cbf0c2e85dd4a42e20f6952d
+https://github.com/openshift/ovn-kubernetes image-amd64 5ad762f86466c2e11b94da2cee211cec97e16a3a
+https://github.com/openshift/kubernetes image-amd64 95b8140e3a53ffc6aab114c39e07a439dfdf7f9e
+https://github.com/openshift/service-ca-operator image-amd64 a40d9a8ec60e0c6c1578300c372b6104130f2ecc
+https://github.com/openshift/oc image-arm64 fa1bc38754e9b24d392d7845a290cf996d8da146
 https://github.com/openshift/coredns image-arm64 6f39336e6da9dc77b2db140a96773c413d50a665
 https://github.com/openshift/csi-external-snapshotter image-arm64 ba8194d5920973069bc56a8bf5844afeedc66bbd
 https://github.com/openshift/router image-arm64 2bc8169c87ccd69cceeeab7552bedb6f16a34c84
 https://github.com/openshift/kube-rbac-proxy image-arm64 b9134351be37c43408334047d8eb85d0ac01fe4e
-https://github.com/openshift/ovn-kubernetes image-arm64 8567f11fa93e164b6eb424ce2f831c608e1094f4
-https://github.com/openshift/kubernetes image-arm64 679fad59c6fcb6cd86bccb25ac702ec10d5ea15b
+https://github.com/openshift/ovn-kubernetes image-arm64 5ad762f86466c2e11b94da2cee211cec97e16a3a
+https://github.com/openshift/kubernetes image-arm64 b59afbdc1eb4ecb7c8b19b8cc95c4657df6caf6d
 https://github.com/openshift/service-ca-operator image-arm64 b0fe556a981964728306f803864af9d2881db967
diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh
index 7808cf7b75..e07a6f373d 100755
--- a/scripts/auto-rebase/last_rebase.sh
+++ b/scripts/auto-rebase/last_rebase.sh
@@ -1,2 +1,2 @@
 #!/bin/bash -x
-./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.21.0-0.nightly-2025-09-15-042343" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.21.0-0.nightly-arm64-2025-09-15-144433"
+./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.21.0-0.nightly-2025-09-18-193221" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.21.0-0.nightly-arm64-2025-09-16-163803"
diff --git a/vendor/github.com/openshift/cluster-policy-controller/pkg/security/controller/namespace_scc_allocation_controller.go b/vendor/github.com/openshift/cluster-policy-controller/pkg/security/controller/namespace_scc_allocation_controller.go
index d7676e715f..7704d673b0 100644
--- a/vendor/github.com/openshift/cluster-policy-controller/pkg/security/controller/namespace_scc_allocation_controller.go
+++ b/vendor/github.com/openshift/cluster-policy-controller/pkg/security/controller/namespace_scc_allocation_controller.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/openshift/library-go/pkg/operator/events"
 	"math/big"
 	"reflect"
 	"time"
@@ -13,19 +12,17 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer"
-	runtimejson "k8s.io/apimachinery/pkg/runtime/serializer/json"
-	"k8s.io/apimachinery/pkg/types"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/apimachinery/pkg/util/strategicpatch"
 	"k8s.io/apimachinery/pkg/util/wait"
+	applycorev1 "k8s.io/client-go/applyconfigurations/core/v1"
+	applymetav1 "k8s.io/client-go/applyconfigurations/meta/v1"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	corev1listers "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/klog/v2"
 	coreapi "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/utils/ptr"
 
 	securityv1 "github.com/openshift/api/security/v1"
 	securityinternalv1 "github.com/openshift/api/securityinternal/v1"
@@ -33,11 +30,14 @@ import (
 	"github.com/openshift/cluster-policy-controller/pkg/security/mcs"
 	"github.com/openshift/cluster-policy-controller/pkg/security/uidallocator"
 	"github.com/openshift/library-go/pkg/controller/factory"
+	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/security/uid"
 )
 
 const (
-	controllerName   = "namespace-security-allocation-controller"
+	controllerName = "namespace-security-allocation-controller"
+	fieldManager   = "cluster-policy-controller"
+
 	rangeName        = "scc-uid"
 	initialRepairKey = "__internal/initialRepair"
 
@@ -56,24 +56,15 @@ type NamespaceSCCAllocationController struct {
 
 	namespaceClient       corev1client.NamespaceInterface
 	rangeAllocationClient securityv1client.RangeAllocationsGetter
-
-	encoder runtime.Encoder
 }
 
 func NewNamespaceSCCAllocationController(namespaceInformer corev1informers.NamespaceInformer, client corev1client.NamespaceInterface, rangeAllocationClient securityv1client.RangeAllocationsGetter, requiredUIDRange *uid.Range, mcs MCSAllocationFunc, eventRecorder events.Recorder) factory.Controller {
-	scheme := runtime.NewScheme()
-	utilruntime.Must(corev1.AddToScheme(scheme))
-	codecs := serializer.NewCodecFactory(scheme)
-	jsonSerializer := runtimejson.NewSerializer(runtimejson.DefaultMetaFactory, scheme, scheme, false)
-	encoder := codecs.WithoutConversion().EncoderForVersion(jsonSerializer, corev1.SchemeGroupVersion)
-
 	c := &NamespaceSCCAllocationController{
 		requiredUIDRange:      requiredUIDRange,
 		mcsAllocator:          mcs,
 		namespaceClient:       client,
 		rangeAllocationClient: rangeAllocationClient,
 		nsLister:              namespaceInformer.Lister(),
-		encoder:               encoder,
 	}
 
 	eventRecorderWithSuffix := eventRecorder.WithComponentSuffix(controllerName)
@@ -142,7 +133,11 @@ func (c *NamespaceSCCAllocationController) syncNamespace(ctx context.Context, sy
 		return nil
 	}
 
-	return c.allocate(ctx, syncCtx, ns)
+	err = c.allocate(ctx, syncCtx, ns)
+	if apierrors.IsConflict(err) {
+		return factory.SyntheticRequeueError
+	}
+	return err
 }
 
 func (c *NamespaceSCCAllocationController) allocate(ctx context.Context, syncCtx factory.SyncContext, ns *corev1.Namespace) error {
@@ -194,40 +189,40 @@ func (c *NamespaceSCCAllocationController) allocate(ctx context.Context, syncCtx
 		return fmt.Errorf("%d not in range", bitIndex)
 	}
 
-	// Now modify the namespace
-	nsCopy := ns.DeepCopy()
-	if nsCopy.Annotations == nil {
-		nsCopy.Annotations = make(map[string]string)
+	// Update the namespace using server-side apply.
+	patch := &applycorev1.NamespaceApplyConfiguration{
+		TypeMetaApplyConfiguration: applymetav1.TypeMetaApplyConfiguration{
+			Kind:       ptr.To("Namespace"),
+			APIVersion: ptr.To("v1"),
+		},
+		ObjectMetaApplyConfiguration: &applymetav1.ObjectMetaApplyConfiguration{
+			Name:            ptr.To(ns.Name),
+			ResourceVersion: ptr.To(ns.ResourceVersion),
+			Annotations: map[string]string{
+				securityv1.UIDRangeAnnotation:           block.String(),
+				securityv1.SupplementalGroupsAnnotation: block.String(),
+			},
+		},
 	}
-	nsCopy.Annotations[securityv1.UIDRangeAnnotation] = block.String()
-	nsCopy.Annotations[securityv1.SupplementalGroupsAnnotation] = block.String()
-	if _, ok := nsCopy.Annotations[securityv1.MCSAnnotation]; !ok {
+	// We need to make sure all annotations are always set for server-side apply, otherwise some would get removed.
+	// The following code actually makes sure the annotation is always set once it is set, which is ok regarding SSA.
+	if v, ok := ns.Annotations[securityv1.MCSAnnotation]; ok {
+		patch.ObjectMetaApplyConfiguration.Annotations[securityv1.MCSAnnotation] = v
+	} else {
 		if label := c.mcsAllocator(block); label != nil {
-			nsCopy.Annotations[securityv1.MCSAnnotation] = label.String()
+			patch.ObjectMetaApplyConfiguration.Annotations[securityv1.MCSAnnotation] = label.String()
 		}
 	}
-	nsCopyBytes, err := runtime.Encode(c.encoder, nsCopy)
-	if err != nil {
-		return err
-	}
-	nsBytes, err := runtime.Encode(c.encoder, ns)
-	if err != nil {
-		return err
-	}
-	patchBytes, err := strategicpatch.CreateTwoWayMergePatch(nsBytes, nsCopyBytes, &corev1.Namespace{})
-	if err != nil {
-		return err
-	}
-	// use patch here not to conflict with other actors
-	_, err = c.namespaceClient.Patch(context.TODO(), ns.Name, types.StrategicMergePatchType, patchBytes, metav1.PatchOptions{})
-	if apierrors.IsNotFound(err) {
-		return nil
-	}
-	if err != nil {
+
+	if _, err := c.namespaceClient.Apply(context.TODO(), patch, metav1.ApplyOptions{FieldManager: fieldManager}); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil
+		}
 		return err
 	}
-	// emit event once per namespace.  There aren't many of these, but it will let us know how long it takes from namespace creation
-	// until the SCC ranges are created.  There is a suspicion that this takes a while.
+
+	// Emit event once per namespace. There aren't many of these, but it will let us know how long it takes from namespace creation
+	// until the SCC ranges are created. There is a suspicion that this takes a while.
 	syncCtx.Recorder().Eventf("CreatedSCCRanges", "created SCC ranges for %v namespace", ns.Name)
 
 	success = true
diff --git a/vendor/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go b/vendor/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
index 6209287bfd..ff7b99acad 100644
--- a/vendor/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
+++ b/vendor/k8s.io/apiserver/pkg/storage/etcd3/etcd3retry/retry_etcdclient.go
@@ -26,13 +26,43 @@ var DefaultRetry = wait.Backoff{
 }
 
 type retryClient struct {
-	// embed because we only want to override a few states
-	storage.Interface
+	// All methods of storage.Interface are implemented directly on *retryClient, even when they
+	// are purely passthroughs to the delegate. During a rebase, consider whether or not it is
+	// safe and appropriate for a new method added to the method set of storage.Interface to
+	// perform retries.
+	delegate storage.Interface
+}
+
+func (c *retryClient) Count(key string) (int64, error) {
+	return c.delegate.Count(key)
+}
+
+func (c *retryClient) ReadinessCheck() error {
+	return c.delegate.ReadinessCheck()
+}
+
+func (c *retryClient) RequestWatchProgress(ctx context.Context) error {
+	return c.delegate.RequestWatchProgress(ctx)
+}
+
+func (c *retryClient) Versioner() storage.Versioner {
+	return c.delegate.Versioner()
 }
 
 // New returns an etcd3 implementation of storage.Interface.
 func NewRetryingEtcdStorage(delegate storage.Interface) storage.Interface {
-	return &retryClient{Interface: delegate}
+	return &retryClient{delegate: delegate}
+}
+
+func (c *retryClient) GetCurrentResourceVersion(ctx context.Context) (uint64, error) {
+	var (
+		rv  uint64
+		err error
+	)
+	return rv, OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
+		rv, err = c.delegate.GetCurrentResourceVersion(ctx)
+		return err
+	})
 }
 
 // Create adds a new object at a key unless it already exists. 'ttl' is time-to-live
@@ -40,7 +70,7 @@ func NewRetryingEtcdStorage(delegate storage.Interface) storage.Interface {
 // set to the read value from database.
 func (c *retryClient) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.Create(ctx, key, obj, out, ttl)
+		return c.delegate.Create(ctx, key, obj, out, ttl)
 	})
 }
 
@@ -48,7 +78,7 @@ func (c *retryClient) Create(ctx context.Context, key string, obj, out runtime.O
 // If key didn't exist, it will return NotFound storage error.
 func (c *retryClient) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts)
+		return c.delegate.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts)
 	})
 }
 
@@ -63,7 +93,7 @@ func (c *retryClient) Watch(ctx context.Context, key string, opts storage.ListOp
 	var ret watch.Interface
 	err := OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
 		var innerErr error
-		ret, innerErr = c.Interface.Watch(ctx, key, opts)
+		ret, innerErr = c.delegate.Watch(ctx, key, opts)
 		return innerErr
 	})
 	return ret, err
@@ -76,7 +106,7 @@ func (c *retryClient) Watch(ctx context.Context, key string, opts storage.ListOp
 // match 'opts.ResourceVersion' according 'opts.ResourceVersionMatch'.
 func (c *retryClient) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
-		return c.Interface.Get(ctx, key, opts, objPtr)
+		return c.delegate.Get(ctx, key, opts, objPtr)
 	})
 }
 
@@ -88,7 +118,7 @@ func (c *retryClient) Get(ctx context.Context, key string, opts storage.GetOptio
 // match 'opts.ResourceVersion' according 'opts.ResourceVersionMatch'.
 func (c *retryClient) GetList(ctx context.Context, key string, opts storage.ListOptions, listObj runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnRead, func() error {
-		return c.Interface.GetList(ctx, key, opts, listObj)
+		return c.delegate.GetList(ctx, key, opts, listObj)
 	})
 }
 
@@ -129,7 +159,7 @@ func (c *retryClient) GetList(ctx context.Context, key string, opts storage.List
 func (c *retryClient) GuaranteedUpdate(ctx context.Context, key string, destination runtime.Object, ignoreNotFound bool,
 	preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, cachedExistingObject runtime.Object) error {
 	return OnError(ctx, DefaultRetry, IsRetriableErrorOnWrite, func() error {
-		return c.Interface.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject)
+		return c.delegate.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject)
 	})
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 82a6189a89..1736d1a6ab 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -655,7 +655,7 @@ github.com/openshift/client-go/user/informers/externalversions/internalinterface
 github.com/openshift/client-go/user/informers/externalversions/user
 github.com/openshift/client-go/user/informers/externalversions/user/v1
 github.com/openshift/client-go/user/listers/user/v1
-# github.com/openshift/cluster-policy-controller v0.0.0-20250725081630-3e7538547c8f
+# github.com/openshift/cluster-policy-controller v0.0.0-20250915194436-0e2948510331
 ## explicit; go 1.24.0
 github.com/openshift/cluster-policy-controller/pkg/client/genericinformers
 github.com/openshift/cluster-policy-controller/pkg/cmd/cluster-policy-controller