diff --git a/.github/actions/kind-e2e-setup/action.yml b/.github/actions/kind-e2e-setup/action.yml
index 0b0aaf0a..ec6bfb25 100644
--- a/.github/actions/kind-e2e-setup/action.yml
+++ b/.github/actions/kind-e2e-setup/action.yml
@@ -42,7 +42,7 @@ runs:
 
     - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
       with:
-        version: 3.52.0
+        version: 3.54.0
 
     - name: Restore kind binary cache
       id: kind-cache
diff --git a/.github/workflows/changelog-sync.yaml b/.github/workflows/changelog-sync.yaml
index 8628b95d..54387659 100644
--- a/.github/workflows/changelog-sync.yaml
+++ b/.github/workflows/changelog-sync.yaml
@@ -92,7 +92,7 @@ jobs:
           persist-credentials: false
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Regenerate CHANGELOG.md
         run: task changelog:write
         env:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4507ee31..0e6fd482 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -242,7 +242,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Verify generated artifacts
         run: task verify
         env:
@@ -275,7 +275,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: govulncheck
         run: task vulncheck
 
@@ -297,7 +297,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Check formatting
         run: task format:check
       - name: Install ShellCheck
@@ -745,7 +745,7 @@ jobs:
           envtest: true
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Unit tests and coverage floor
         run: task coverage
         env:
@@ -785,7 +785,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Build manager
         run: task build
 
@@ -802,7 +802,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Verify Forgejo pre-pull safeguards
         run: bash test/ci/forgejo_prepull_test.sh
       - name: Pre-pull Forgejo image
@@ -828,7 +828,7 @@ jobs:
           persist-credentials: false
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Install Helm
         env:
           HELM_VERSION: v3.22.1
@@ -854,7 +854,7 @@ jobs:
           envtest: true
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Performance snapshot (optional gate)
         run: task perf-report
         env:
@@ -969,7 +969,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Build controller image
         run: task docker:build
 
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 99aed42b..cd92c8da 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -108,7 +108,7 @@ jobs:
           cache-dependency-path: docs/package-lock.json
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/e2e-nightly.yaml b/.github/workflows/e2e-nightly.yaml
index db1098f0..49a4dbf9 100644
--- a/.github/workflows/e2e-nightly.yaml
+++ b/.github/workflows/e2e-nightly.yaml
@@ -108,7 +108,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Micro-benchmarks
         run: task bench
@@ -140,7 +140,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Unit + envtest under -race
         id: race
@@ -206,7 +206,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Extractor hot-path budget (micro-benchmark, not a scale tier)
         run: task extract-budget
@@ -231,7 +231,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Extended envtest scale (10k)
         run: go test -run TestEngine_ScaleEnvtestOptIn -count=1 -timeout=35m ./internal/collect/...
diff --git a/.github/workflows/mutation.yaml b/.github/workflows/mutation.yaml
index 47a36e96..9eca3c22 100644
--- a/.github/workflows/mutation.yaml
+++ b/.github/workflows/mutation.yaml
@@ -33,7 +33,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Mutation measurement (report only)
         id: mutation
diff --git a/.github/workflows/preflight.yaml b/.github/workflows/preflight.yaml
index 817e8742..a17d0606 100644
--- a/.github/workflows/preflight.yaml
+++ b/.github/workflows/preflight.yaml
@@ -31,7 +31,7 @@ jobs:
       - uses: ./.github/actions/go-cache
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 64291c62..50029b1e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -417,7 +417,7 @@ jobs:
         id: cliff
         uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
         with:
-          version: v2.13.1
+          version: v2.14.2
           config: hack/release/cliff.toml
           args: --latest --strip header
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sonarcloud.yaml b/.github/workflows/sonarcloud.yaml
index ea157448..a0efc8c5 100644
--- a/.github/workflows/sonarcloud.yaml
+++ b/.github/workflows/sonarcloud.yaml
@@ -25,7 +25,7 @@ jobs:
           envtest: true
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
       - name: Unit tests and coverage
         run: task coverage
         env:
diff --git a/.github/workflows/test-shuffle.yaml b/.github/workflows/test-shuffle.yaml
index d2609fc9..93e4a8d0 100644
--- a/.github/workflows/test-shuffle.yaml
+++ b/.github/workflows/test-shuffle.yaml
@@ -36,7 +36,7 @@ jobs:
 
       - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.52.0
+          version: 3.54.0
 
       - name: Shuffled, repeated unit tests (seed printed first)
         run: task test:shuffle
diff --git a/Taskfile.yml b/Taskfile.yml
index 9ef6df11..24f983d7 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -19,14 +19,14 @@ vars:
   # Packages whose integration-tagged tests make up the L3 tier (task test-integration).
   INTEGRATION_PACKAGES: ./internal/sink/... ./internal/pipeline/...
   # renovate: datasource=github-releases depName=orhun/git-cliff
-  GIT_CLIFF_VERSION: v2.13.1
+  GIT_CLIFF_VERSION: v2.14.2
   GIT_CLIFF_BIN: "{{.BIN_DIR}}/git-cliff"
   CLIFF_CONFIG: hack/release/cliff.toml
   GO_ARCH_LINT_CONFIG: .go-arch-lint.yml
   GO_ARCH_LINT_GRAPH: docs/architecture-graph.svg
   MARKDOWNLINT_CONFIG: hack/tooling/markdownlint-cli2.yaml
   # renovate: datasource=github-releases depName=fe3dback/go-arch-lint
-  GO_ARCH_LINT_VERSION: v1.19.0
+  GO_ARCH_LINT_VERSION: v1.19.1
   # renovate: datasource=go depName=golang.org/x/vuln
   GOVULNCHECK_VERSION: v1.9.0
   # renovate: datasource=go depName=github.com/go-gremlins/gremlins
diff --git a/hack/test/mutation_signal_test.sh b/hack/test/mutation_signal_test.sh
index f598fddb..000c3446 100644
--- a/hack/test/mutation_signal_test.sh
+++ b/hack/test/mutation_signal_test.sh
@@ -1323,7 +1323,7 @@ done' 'measure aggregate "${ROOT}" ./internal/... ./internal/...'
   judge W1 "a pull_request trigger (W1)" "W1: on: is" lit "${W}" '  workflow_dispatch:' "  workflow_dispatch:${nl}  pull_request:"
   judge W1 "permissions widened (W1)" "W1: permissions: is" lit "${W}" '  contents: read' '  contents: write'
   judge W1 "setup-task at a version no other workflow uses (W1)" "W1: setup-task version: 99.0.0 is used by no other workflow" \
-    lit "${W}" '          version: 3.52.0' '          version: 99.0.0'
+    lit "${W}" '          version: 3.54.0' '          version: 99.0.0'
   judge 'W1|C1' "the workflow deleted (absence)" "W1: absence: .github/workflows/mutation.yaml is missing" rm -f "${W}"
   judge C1 "the workflow renamed (C1)" "C1: the reporter's 'Mutation testing' does not equal" \
     lit "${W}" 'name: Mutation testing' 'name: Mutation testing (nightly)'
diff --git a/hack/verify-changelog.sh b/hack/verify-changelog.sh
index ac2b3f16..88021066 100755
--- a/hack/verify-changelog.sh
+++ b/hack/verify-changelog.sh
@@ -8,7 +8,7 @@ cd "${ROOT}"
 CLIFF="${GIT_CLIFF_BIN:-${ROOT}/bin/git-cliff}"
 if [[ ! -x "${CLIFF}" ]]; then
   echo "verify-changelog: installing git-cliff into bin/" >&2
-  bash hack/install-git-cliff.sh v2.13.1 bin/git-cliff
+  bash hack/install-git-cliff.sh v2.14.2 bin/git-cliff
   CLIFF="${ROOT}/bin/git-cliff"
 fi
 
diff --git a/mise.toml b/mise.toml
index 09428035..d841bfed 100644
--- a/mise.toml
+++ b/mise.toml
@@ -52,7 +52,7 @@ idiomatic_version_file_enable_tools = ["go"]
 [tools]
 # Task runs the whole gate matrix (Taskfile.yml). Matches the `version:` input of every
 # `go-task/setup-task` step under .github/ (workflows and composite actions).
-task = "3.52.0"
+task = "3.54.0"
 
 # Node runs markdownlint-cli2 for `task lint:markdown` (pinned in docs/package.json).
 # Matches `node-version: "22"` in .github/workflows/docs.yaml and