diff --git a/CHANGELOG.md b/CHANGELOG.md
index 429e45ea..e86ad4c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
+- Add `spec.clusterConfig.lineage` to emit [OpenLineage](https://openlineage.io/) lineage events ([#914]).
 - Support floating tags for product images via the new `spec.image.stackableVersionPolicy` field
   ([#944]).
 - Add `/ready` endpoint to the operator Deployment, which reports the CRD installation status ([#949]).
@@ -60,6 +61,7 @@ All notable changes to this project will be documented in this file.
 
 [#909]: https://github.com/stackabletech/trino-operator/pull/909
 [#913]: https://github.com/stackabletech/trino-operator/pull/913
+[#914]: https://github.com/stackabletech/trino-operator/pull/914
 [#918]: https://github.com/stackabletech/trino-operator/pull/918
 [#923]: https://github.com/stackabletech/trino-operator/pull/923
 [#924]: https://github.com/stackabletech/trino-operator/pull/924
diff --git a/Cargo.lock b/Cargo.lock
index c7ffa6e5..93993df6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -169,7 +169,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -279,9 +279,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "block-buffer"
@@ -316,9 +316,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.4.3"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -328,9 +328,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "chacha20"
@@ -339,7 +339,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
 
@@ -356,9 +356,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -366,9 +366,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -378,21 +378,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
 
 [[package]]
 name = "colorchoice"
@@ -402,9 +402,9 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -462,6 +462,12 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -473,36 +479,36 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.16"
+version = "0.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.22"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
 [[package]]
 name = "crypto-bigint"
@@ -538,12 +544,12 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
 dependencies = [
- "darling_core 0.24.0",
- "darling_macro 0.24.0",
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
 ]
 
 [[package]]
@@ -561,15 +567,15 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
 dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -585,13 +591,13 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
- "darling_core 0.24.0",
+ "darling_core 0.24.1",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -622,7 +628,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -707,7 +713,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -771,14 +777,14 @@ dependencies = [
  "enum-ordinalize",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "either"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "elliptic-curve"
@@ -802,11 +808,16 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.35"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
 dependencies = [
  "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
 ]
 
 [[package]]
@@ -844,7 +855,7 @@ checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -901,9 +912,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.11"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "flagset"
@@ -913,12 +924,13 @@ checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -1004,7 +1016,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1098,7 +1110,7 @@ version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ddddbf932745a6be37109b6112d3ee09696106f848449069d3a57bba937ab82e"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
  "libc",
  "libgit2-sys",
  "log",
@@ -1145,9 +1157,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.17"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f877e75f39e9827ec50a572dd592684ac28c029578726c85f1b2aa6ab807449"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1258,9 +1270,9 @@ checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
 
 [[package]]
 name = "hyper"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1280,9 +1292,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http",
  "hyper",
@@ -1310,16 +1322,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http",
  "http-body",
+ "httparse",
  "hyper",
  "ipnet",
  "libc",
@@ -1425,9 +1438,9 @@ checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92a7ed671a6aad807a8651a2e1782a6598fda9ce5185dd8158549e95a91c6428"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1467,9 +1480,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -1486,9 +1499,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.12.1"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -1533,9 +1546,9 @@ dependencies = [
 
 [[package]]
 name = "jiff"
-version = "0.2.35"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
 dependencies = [
  "defmt",
  "jiff-core",
@@ -1550,18 +1563,19 @@ dependencies = [
 
 [[package]]
 name = "jiff-core"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
 dependencies = [
  "defmt",
+ "log",
 ]
 
 [[package]]
 name = "jiff-static"
-version = "0.2.35"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
 dependencies = [
  "jiff-core",
  "proc-macro2",
@@ -1596,7 +1610,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "walkdir",
  "windows-link",
 ]
@@ -1645,9 +1659,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.104"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1664,20 +1678,20 @@ dependencies = [
  "schemars",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "jsonpath-rust"
-version = "1.0.8"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e07021eefc09f897611b067ba7897b5e9266edfc902768418968772e5bb06a7"
+checksum = "d23892d4caa103325a558250e9f4e406d81cf64f7c01679ae7a64e0413321e51"
 dependencies = [
  "pest",
  "pest_derive",
  "regex",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -1706,9 +1720,9 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
- "darling 0.24.0",
+ "darling 0.24.1",
  "regex",
  "snafu 0.9.2",
 ]
@@ -1769,7 +1783,7 @@ dependencies = [
  "serde",
  "serde-saphyr",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-util",
  "tower",
@@ -1793,7 +1807,7 @@ dependencies = [
  "serde",
  "serde-value",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -1831,7 +1845,7 @@ dependencies = [
  "pin-project",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-util",
  "tracing",
@@ -1839,24 +1853,24 @@ dependencies = [
 
 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 dependencies = [
  "spin",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.18.7+1.9.6"
+version = "0.18.8+1.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23c7391e4b9f4ffab1a624223cc1d7385ff9a678f490768add717de7ea2f4d89"
+checksum = "7f7c568b25d7489bc3fb2988ed69ab111d2944d2f5fec3d5c987fe545ea97b50"
 dependencies = [
  "cc",
  "libc",
@@ -1899,9 +1913,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "matchers"
@@ -1932,9 +1946,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 dependencies = [
  "adler2",
  "simd-adler32",
@@ -1942,15 +1956,21 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.2"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
  "libc",
  "wasi",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -1977,7 +1997,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
  "smallvec",
  "zeroize",
 ]
@@ -2045,7 +2065,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
@@ -2088,7 +2108,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "reqwest",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tonic",
  "tonic-types",
@@ -2126,7 +2146,7 @@ dependencies = [
  "percent-encoding",
  "portable-atomic",
  "rand 0.9.5",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-stream",
 ]
@@ -2208,9 +2228,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a07a60cc7a4d00c91f95c685609d1d2f79050e6804b70ebedd7650f0b839bcf"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -2218,9 +2238,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3a83744a5c8455b8b3e0dc5031362780a347c878bdd11584d1a8984228cc88d"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
 dependencies = [
  "pest",
  "pest_generator",
@@ -2228,9 +2248,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd3451aa3de60d4b9a1e736885e4dea6b31617598026f12256ad566d63304a"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
 dependencies = [
  "pest",
  "pest_meta",
@@ -2241,9 +2261,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e04d3a0849e241d7dfce834c83b1c5edc8622009e8dd51a12ba1927c32f05496"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
 dependencies = [
  "pest",
 ]
@@ -2309,9 +2329,9 @@ checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
 dependencies = [
  "portable-atomic",
 ]
@@ -2327,9 +2347,9 @@ dependencies = [
 
 [[package]]
 name = "powerfmt"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "ppv-lite86"
@@ -2422,9 +2442,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "rand_chacha 0.3.1",
  "rand_core 0.6.4",
@@ -2442,9 +2462,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.2"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -2501,7 +2521,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 ]
 
 [[package]]
@@ -2521,7 +2541,7 @@ checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2561,11 +2581,11 @@ checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
 [[package]]
 name = "reqwest"
-version = "0.13.4"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -2711,9 +2731,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
 dependencies = [
  "core-foundation",
  "core-foundation-sys",
@@ -2732,15 +2752,15 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier-android"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.14"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2800,7 +2820,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2838,7 +2858,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2921,7 +2941,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2932,7 +2952,7 @@ checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3152,14 +3172,14 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "const-oid",
  "ecdsa",
  "k8s-openapi",
  "kube",
  "p256",
- "rand 0.10.2",
+ "rand 0.10.3",
  "rand_core 0.6.4",
  "rsa",
  "sha2",
@@ -3176,7 +3196,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator"
 version = "0.119.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "base64 0.23.1",
  "clap",
@@ -3193,7 +3213,7 @@ dependencies = [
  "json-patch",
  "k8s-openapi",
  "kube",
- "rand 0.10.2",
+ "rand 0.10.3",
  "regex",
  "schemars",
  "semver",
@@ -3220,18 +3240,18 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
- "darling 0.24.0",
+ "darling 0.24.1",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "stackable-shared"
 version = "0.1.2"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3248,7 +3268,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "axum",
  "clap",
@@ -3295,7 +3315,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "kube",
  "schemars",
@@ -3309,10 +3329,10 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "convert_case",
- "darling 0.24.0",
+ "darling 0.24.1",
  "indoc",
  "itertools 0.15.0",
  "k8s-openapi",
@@ -3320,13 +3340,13 @@ dependencies = [
  "kube",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "stackable-webhook"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#ed84d456ff0b8324db3d7444659cb207564be8c9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#1b564c0196eda88099de52b8af317dce88ffec70"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -3339,7 +3359,7 @@ dependencies = [
  "kube",
  "opentelemetry",
  "opentelemetry-semantic-conventions",
- "rand 0.10.2",
+ "rand 0.10.3",
  "serde",
  "serde_json",
  "snafu 0.9.2",
@@ -3349,7 +3369,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower",
- "tower-http 0.7.0",
+ "tower-http 0.7.1",
  "tracing",
  "tracing-opentelemetry",
  "x509-cert",
@@ -3418,9 +3438,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3438,13 +3458,13 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3458,11 +3478,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl 2.0.20",
+ "thiserror-impl 2.0.21",
 ]
 
 [[package]]
@@ -3478,13 +3498,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3559,9 +3579,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
  "bytes",
  "libc",
@@ -3582,14 +3602,14 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.4"
+version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
  "rustls",
  "tokio",
@@ -3632,9 +3652,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.13+spec-1.1.0"
+version = "0.25.15+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
 dependencies = [
  "indexmap",
  "toml_datetime",
@@ -3726,7 +3746,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "base64 0.22.1",
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
  "bytes",
  "futures-util",
  "http",
@@ -3742,11 +3762,11 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
  "bytes",
  "http",
  "http-body",
@@ -3789,7 +3809,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "tracing-subscriber",
 ]
@@ -3893,9 +3913,9 @@ checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "unicode-segmentation"
@@ -3954,9 +3974,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.24.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3992,9 +4012,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -4016,9 +4036,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -4029,19 +4049,20 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.77"
+version = "0.4.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
 dependencies = [
  "js-sys",
+ "tokio",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -4049,31 +4070,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.104"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -4302,30 +4323,30 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.2"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.56"
+version = "0.8.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+checksum = "6400fc4bb7426f6faac3fb07566122bb18622e3022bd2c36426a92ed489b1dbe"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.56"
+version = "0.8.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+checksum = "99c27cc7525bad4df59a45e073c45b2c2aa820efb588234cc23a547ec69a34db"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4343,13 +4364,13 @@ dependencies = [
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
  "synstructure",
 ]
 
@@ -4397,15 +4418,21 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/Cargo.nix b/Cargo.nix
index ac9ca84b..4d33166b 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -508,7 +508,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             usesDefaultFeatures = false;
             features = [ "clone-impls" "full" "parsing" "printing" "proc-macro" "visit-mut" ];
           }
@@ -891,11 +891,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" ];
       };
-      "bitflags 2.13.1" = rec {
+      "bitflags 2.13.2" = rec {
         crateName = "bitflags";
-        version = "2.13.1";
+        version = "2.13.2";
         edition = "2021";
-        sha256 = "1nl76mpykmwmb8rq1l5vw1azdh1wvxdrnsk4sy3rdrzx01nvg25m";
+        sha256 = "01hbgjwvid66850fzi76mvn5f2bqycx6sf165ng1kfjqq9bl1v9x";
         authors = [
           "The Rust Project Developers"
         ];
@@ -989,9 +989,9 @@ rec {
       };
       "cc" = rec {
         crateName = "cc";
-        version = "1.4.3";
+        version = "1.6.0";
         edition = "2021";
-        sha256 = "0v9b5arr047vbihfbh3fmbd3aj9vf1i7dbdgfpvlwzynpjvr35ah";
+        sha256 = "0c3n82hdi355xa6z9x4zgnpjwsh1szkkcs0zl8q8nl5ggk874j7p";
         dependencies = [
           {
             name = "find-msvc-tools";
@@ -1022,9 +1022,9 @@ rec {
       };
       "cfg-if" = rec {
         crateName = "cfg-if";
-        version = "1.0.4";
+        version = "1.0.5";
         edition = "2018";
-        sha256 = "008q28ajc546z5p2hcwdnckmg0hia7rnx52fni04bwqkzyrghc4k";
+        sha256 = "0026j56901nzjraap3da0a8njw42j66zcxnn6s2s9aa5bcblhxjf";
         libName = "cfg_if";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
@@ -1049,7 +1049,7 @@ rec {
           }
           {
             name = "cpufeatures";
-            packageId = "cpufeatures 0.3.0";
+            packageId = "cpufeatures 0.3.1";
             target = { target, features }: (("x86_64" == target."arch" or null) || ("x86" == target."arch" or null));
           }
           {
@@ -1120,10 +1120,10 @@ rec {
       };
       "clap" = rec {
         crateName = "clap";
-        version = "4.6.6";
+        version = "4.6.7";
         edition = "2024";
         crateBin = [];
-        sha256 = "1jmx5z8d6jbvxdz6dybh599s4rd7ns6sl90p2rrdga09yh3pwg27";
+        sha256 = "0il98y2rfw75984ck59znd4n592p07bxz8yy3a9blddb02rpd25a";
         dependencies = [
           {
             name = "clap_builder";
@@ -1162,9 +1162,9 @@ rec {
       };
       "clap_builder" = rec {
         crateName = "clap_builder";
-        version = "4.6.6";
+        version = "4.6.7";
         edition = "2024";
-        sha256 = "12cqg25zpjc3k82cpqa2v9h7s3vk1vydpgnwl8lfg6lfm2jzwj3v";
+        sha256 = "0kbhai5rv1vj9r4np52g2b9fmhvy3y82digs9v40c57bgbxrf1zc";
         dependencies = [
           {
             name = "anstream";
@@ -1201,9 +1201,9 @@ rec {
       };
       "clap_derive" = rec {
         crateName = "clap_derive";
-        version = "4.6.4";
+        version = "4.6.7";
         edition = "2024";
-        sha256 = "0qd0v7pa2arwxjjinmjim6xrjy61bc28m1yryhc7zjjssswx44nh";
+        sha256 = "1q36bgbkfb9rdz7jcvd0ffv0wwlyw0lg3z6iwdcybm0mjjvm3izr";
         procMacro = true;
         dependencies = [
           {
@@ -1220,7 +1220,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "full" ];
           }
         ];
@@ -1233,9 +1233,9 @@ rec {
       };
       "clap_lex" = rec {
         crateName = "clap_lex";
-        version = "1.1.0";
+        version = "1.1.1";
         edition = "2024";
-        sha256 = "1ycqkpygnlqnndghhcxjb44lzl0nmgsia64x9581030yifxs7m68";
+        sha256 = "11k4m4ngn39iz39lnq6nn6kyxzp62mnm1d86qfad3q0vlk33n4qw";
 
       };
       "colorchoice" = rec {
@@ -1247,9 +1247,9 @@ rec {
       };
       "combine" = rec {
         crateName = "combine";
-        version = "4.6.7";
+        version = "4.6.8";
         edition = "2018";
-        sha256 = "1z8rh8wp59gf8k23ar010phgs0wgf5i8cx4fg01gwcnzfn5k0nms";
+        sha256 = "0ppwzwdmszpan9ybx1myc6ldg5zih2sazf9idckdxrh9gn9j1hyg";
         authors = [
           "Markus Westerlind <marwes91@gmail.com>"
         ];
@@ -1435,6 +1435,18 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" "link" ];
       };
+      "core_detect" = rec {
+        crateName = "core_detect";
+        version = "1.0.0";
+        edition = "2018";
+        sha256 = "0j0xp1j6f9lrp4ybylc3d0zdg8jq2hkmr1122qyil14qk84q13vz";
+        authors = [
+          "Thom Chiovoloni <chiovolonit@gmail.com>"
+        ];
+        features = {
+        };
+        resolvedDefaultFeatures = [ "default" ];
+      };
       "cpufeatures 0.2.17" = rec {
         crateName = "cpufeatures";
         version = "0.2.17";
@@ -1471,11 +1483,11 @@ rec {
         ];
 
       };
-      "cpufeatures 0.3.0" = rec {
+      "cpufeatures 0.3.1" = rec {
         crateName = "cpufeatures";
-        version = "0.3.0";
+        version = "0.3.1";
         edition = "2024";
-        sha256 = "00fjhygsqmh4kbxxlb99mcsbspxcai6hjydv4c46pwb67wwl2alb";
+        sha256 = "0rkm1l35jy1z1yfg723fddsxc7vr0gc1hhfvc138hnqiwc58p8jw";
         authors = [
           "RustCrypto Developers"
         ];
@@ -1509,9 +1521,9 @@ rec {
       };
       "crc32fast" = rec {
         crateName = "crc32fast";
-        version = "1.5.0";
+        version = "1.5.2";
         edition = "2021";
-        sha256 = "04d51liy8rbssra92p0qnwjw8i9rm9c4m3bwy19wjamz1k4w30cl";
+        sha256 = "0y0f955n2hr5a8rd9nw9sr23nhjc42ddx3bjc47dnlmqssgpk9q1";
         authors = [
           "Sam Rijs <srijs@airpost.net>"
           "Alex Crichton <alex@alexcrichton.com>"
@@ -1525,13 +1537,13 @@ rec {
         features = {
           "default" = [ "std" ];
         };
-        resolvedDefaultFeatures = [ "default" "std" ];
+        resolvedDefaultFeatures = [ "std" ];
       };
       "crossbeam-channel" = rec {
         crateName = "crossbeam-channel";
-        version = "0.5.16";
+        version = "0.5.17";
         edition = "2021";
-        sha256 = "17k72dh5qqkh0xvqzr27wny7gl1l7fgzlvh2xxx71jmfgz1n6lyq";
+        sha256 = "1wcy7y77hw7z5m140114iqxb90gsq062djd9zpkndisvgcrcrc4q";
         libName = "crossbeam_channel";
         dependencies = [
           {
@@ -1548,9 +1560,9 @@ rec {
       };
       "crossbeam-utils" = rec {
         crateName = "crossbeam-utils";
-        version = "0.8.22";
+        version = "0.8.23";
         edition = "2021";
-        sha256 = "05vwf7pmjq8c8f3fp5qqdm0z3cnk4p62wi8spf0jms5yjnh3v031";
+        sha256 = "1ilan2nw7fvka8hki80fr57a5dgd4mvcsvwq60437j6yvlwyw7m3";
         libName = "crossbeam_utils";
         features = {
           "default" = [ "std" ];
@@ -1662,22 +1674,22 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" "suggestions" ];
       };
-      "darling 0.24.0" = rec {
+      "darling 0.24.1" = rec {
         crateName = "darling";
-        version = "0.24.0";
+        version = "0.24.1";
         edition = "2021";
-        sha256 = "08vx6iikfg7nz88ljnvnb5rqx819ys3si2mclym7xn4hp7qhnjc8";
+        sha256 = "1v625grpyqddgaslgc0kzha41vzqy91yyg80ra9vjc363f8ga5zd";
         authors = [
           "Ted Driggs <ted.driggs@outlook.com>"
         ];
         dependencies = [
           {
             name = "darling_core";
-            packageId = "darling_core 0.24.0";
+            packageId = "darling_core 0.24.1";
           }
           {
             name = "darling_macro";
-            packageId = "darling_macro 0.24.0";
+            packageId = "darling_macro 0.24.1";
           }
         ];
         features = {
@@ -1727,11 +1739,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "strsim" "suggestions" ];
       };
-      "darling_core 0.24.0" = rec {
+      "darling_core 0.24.1" = rec {
         crateName = "darling_core";
-        version = "0.24.0";
+        version = "0.24.1";
         edition = "2021";
-        sha256 = "1i38i1vwm2a2p3knsyqd0rm7frkfil5lxqz1600ji0n4j57jfkh8";
+        sha256 = "1zyxlb9ypzb3pzm0l8jy09x2kvd7x7qd50b1z0caxal5fk7y4dv8";
         authors = [
           "Ted Driggs <ted.driggs@outlook.com>"
         ];
@@ -1755,7 +1767,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "full" "extra-traits" ];
           }
         ];
@@ -1791,11 +1803,11 @@ rec {
         ];
 
       };
-      "darling_macro 0.24.0" = rec {
+      "darling_macro 0.24.1" = rec {
         crateName = "darling_macro";
-        version = "0.24.0";
+        version = "0.24.1";
         edition = "2021";
-        sha256 = "0pimi94crlpzw72s18vi96ysw3il197sdzz0bhrd476ll0ppkxb8";
+        sha256 = "1197l1qqsxssys3nnz58x36nv5kzpbjipsxv6dw2yazh7rf17ira";
         procMacro = true;
         authors = [
           "Ted Driggs <ted.driggs@outlook.com>"
@@ -1803,7 +1815,7 @@ rec {
         dependencies = [
           {
             name = "darling_core";
-            packageId = "darling_core 0.24.0";
+            packageId = "darling_core 0.24.1";
           }
           {
             name = "quote";
@@ -1811,7 +1823,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
 
@@ -1884,7 +1896,7 @@ rec {
         dependencies = [
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
         ];
         features = {
@@ -2179,7 +2191,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
         features = {
@@ -2387,7 +2399,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "visit" "visit-mut" ];
           }
         ];
@@ -2399,9 +2411,9 @@ rec {
       };
       "either" = rec {
         crateName = "either";
-        version = "1.17.0";
+        version = "1.18.0";
         edition = "2021";
-        sha256 = "07dagpwcfdzpkb1n7fxkx0q3nv80rnf81v7gwlz9ljx22mn8yply";
+        sha256 = "0d7dx31sf8rakcgp63070ngb2vkjynrni866pnx879pawndgnai5";
         features = {
           "default" = [ "std" ];
           "serde" = [ "dep:serde" ];
@@ -2509,9 +2521,9 @@ rec {
       };
       "encoding_rs" = rec {
         crateName = "encoding_rs";
-        version = "0.8.35";
-        edition = "2018";
-        sha256 = "1wv64xdrr9v37rqqdjsyb8l8wzlcbab80ryxhrszvnj59wy0y0vm";
+        version = "0.8.42";
+        edition = "2024";
+        sha256 = "0ycnbndly2jw5j69jl1r1lm512h2w9vb1dnjp0px46l7a425x64f";
         authors = [
           "Henri Sivonen <hsivonen@hsivonen.fi>"
         ];
@@ -2520,13 +2532,47 @@ rec {
             name = "cfg-if";
             packageId = "cfg-if";
           }
+          {
+            name = "core_detect";
+            packageId = "core_detect";
+            target = { target, features }: (("x86_64" == target."arch" or null) || ("x86" == target."arch" or null));
+          }
+          {
+            name = "multiversion_no_op";
+            packageId = "multiversion_no_op";
+          }
+          {
+            name = "rustversion";
+            packageId = "rustversion";
+            optional = true;
+          }
+          {
+            name = "scopeguard";
+            packageId = "scopeguard";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "simdutf8";
+            packageId = "simdutf8";
+            usesDefaultFeatures = false;
+            target = { target, features }: (("x86_64" == target."arch" or null) || ("x86" == target."arch" or null) || ("aarch64" == target."arch" or null) || (("wasm32" == target."arch" or null) && (builtins.elem "simd128" targetFeatures)));
+            features = [ "aarch64_neon" "public_imp" ];
+          }
+        ];
+        buildDependencies = [
+          {
+            name = "rustversion";
+            packageId = "rustversion";
+          }
         ];
         features = {
           "any_all_workaround" = [ "dep:any_all_workaround" ];
           "default" = [ "alloc" ];
           "fast-legacy-encode" = [ "fast-hangul-encode" "fast-hanja-encode" "fast-kanji-encode" "fast-gb-hanzi-encode" "fast-big5-hanzi-encode" ];
+          "rustversion" = [ "dep:rustversion" ];
           "serde" = [ "dep:serde" ];
-          "simd-accel" = [ "any_all_workaround" ];
+          "simd-accel" = [ "any_all_workaround" "rustversion" ];
+          "std" = [ "dep:multiversion" ];
         };
         resolvedDefaultFeatures = [ "alloc" "default" ];
       };
@@ -2601,7 +2647,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
         features = {
@@ -2769,9 +2815,9 @@ rec {
       };
       "find-msvc-tools" = rec {
         crateName = "find-msvc-tools";
-        version = "0.1.11";
+        version = "0.1.14";
         edition = "2021";
-        sha256 = "145qpfb9r4ml2klr8v4byvrkikp61qyiks9n69b8z0vbscbb0pfl";
+        sha256 = "112ljldlv150fpl8xr2jl5czg51k3kdfn6cy5fqdsvkl14sgpp5f";
         libName = "find_msvc_tools";
 
       };
@@ -2789,9 +2835,9 @@ rec {
       };
       "flate2" = rec {
         crateName = "flate2";
-        version = "1.1.9";
+        version = "1.1.10";
         edition = "2018";
-        sha256 = "0g2pb7cxnzcbzrj8bw4v6gpqqp21aycmf6d84rzb6j748qkvlgw4";
+        sha256 = "1jvd2cl8j5hyf8imi62y1x7gwzz1hajirni0801yxhds1qp4wqvf";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
           "Josh Triplett <josh@joshtriplett.org>"
@@ -2801,33 +2847,33 @@ rec {
             name = "crc32fast";
             packageId = "crc32fast";
             optional = true;
+            usesDefaultFeatures = false;
           }
           {
             name = "miniz_oxide";
             packageId = "miniz_oxide";
             optional = true;
-            usesDefaultFeatures = false;
-            features = [ "with-alloc" "simd" ];
+            features = [ "simd" ];
           }
           {
-            name = "miniz_oxide";
-            packageId = "miniz_oxide";
+            name = "zlib-rs";
+            packageId = "zlib-rs";
+            optional = true;
             usesDefaultFeatures = false;
-            target = { target, features }: (("wasm32" == target."arch" or null) && (!("emscripten" == target."os" or null)));
-            features = [ "with-alloc" "simd" ];
+            features = [ "rust-allocator" ];
           }
         ];
         features = {
           "any_c_zlib" = [ "any_zlib" ];
           "any_zlib" = [ "any_impl" ];
-          "cloudflare-zlib-sys" = [ "dep:cloudflare-zlib-sys" ];
-          "cloudflare_zlib" = [ "any_c_zlib" "cloudflare-zlib-sys" "dep:crc32fast" ];
-          "default" = [ "rust_backend" ];
+          "cloudflare_zlib" = [ "zlib" ];
+          "default" = [ "rust_backend" "runtime_detection" ];
           "document-features" = [ "dep:document-features" ];
           "libz-ng-sys" = [ "dep:libz-ng-sys" ];
           "libz-sys" = [ "dep:libz-sys" ];
           "miniz-sys" = [ "rust_backend" ];
           "miniz_oxide" = [ "any_impl" "dep:miniz_oxide" "dep:crc32fast" ];
+          "runtime_detection" = [ "zlib-rs?/std" "crc32fast?/std" ];
           "rust_backend" = [ "miniz_oxide" "any_impl" ];
           "zlib" = [ "any_c_zlib" "libz-sys" "dep:crc32fast" ];
           "zlib-default" = [ "any_c_zlib" "libz-sys/default" "dep:crc32fast" ];
@@ -2835,7 +2881,7 @@ rec {
           "zlib-ng-compat" = [ "zlib" "libz-sys/zlib-ng" "dep:crc32fast" ];
           "zlib-rs" = [ "any_zlib" "dep:zlib-rs" ];
         };
-        resolvedDefaultFeatures = [ "any_impl" "default" "miniz_oxide" "rust_backend" ];
+        resolvedDefaultFeatures = [ "any_impl" "default" "miniz_oxide" "runtime_detection" "rust_backend" ];
       };
       "fnv" = rec {
         crateName = "fnv";
@@ -3060,7 +3106,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "full" ];
           }
         ];
@@ -3458,7 +3504,7 @@ rec {
         dependencies = [
           {
             name = "bitflags";
-            packageId = "bitflags 2.13.1";
+            packageId = "bitflags 2.13.2";
           }
           {
             name = "libc";
@@ -3596,9 +3642,9 @@ rec {
       };
       "h2" = rec {
         crateName = "h2";
-        version = "0.4.17";
+        version = "0.4.19";
         edition = "2021";
-        sha256 = "0jblh2mscahvbz42d1sp5702ib444rcxswm5a3n2g64yydspx1wz";
+        sha256 = "05mw60jmsq97vjgj607nxjkx8dl6rxv6jj9i4r2z92056id5x3pg";
         authors = [
           "Carl Lerche <me@carllerche.com>"
           "Sean McArthur <sean@seanmonstar.com>"
@@ -3907,9 +3953,9 @@ rec {
       };
       "hyper" = rec {
         crateName = "hyper";
-        version = "1.11.0";
+        version = "1.11.1";
         edition = "2021";
-        sha256 = "0wha96biivgpj0fpf80a2aar5dfbff1lk62i9x9i2bl53wl5686j";
+        sha256 = "0hxyikj5livhmw5q3x3ifyhphh1g2cjsc32nsg1jcyhflpx03d97";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
         ];
@@ -4012,9 +4058,9 @@ rec {
       };
       "hyper-rustls" = rec {
         crateName = "hyper-rustls";
-        version = "0.27.9";
+        version = "0.27.10";
         edition = "2021";
-        sha256 = "03vfnsm873wsp1dk0q85nxvk7w6syp8c2m5bcdjcyfgg4786ijik";
+        sha256 = "0lvz2bxpphyxmkws5ysfnydvsd0q4smbwgy254g92irjf1afda6z";
         libName = "hyper_rustls";
         dependencies = [
           {
@@ -4151,9 +4197,9 @@ rec {
       };
       "hyper-util" = rec {
         crateName = "hyper-util";
-        version = "0.1.20";
-        edition = "2021";
-        sha256 = "186zdc58hmm663csmjvrzgkr6jdh93sfmi3q2pxi57gcaqjpqm4n";
+        version = "0.1.21";
+        edition = "2024";
+        sha256 = "1zwbrhqr9js6r7db3zd8bsmm6ys1i0abgkc7lyw2d4jgd2b3vh6x";
         libName = "hyper_util";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
@@ -4161,7 +4207,7 @@ rec {
         dependencies = [
           {
             name = "base64";
-            packageId = "base64 0.22.1";
+            packageId = "base64 0.23.1";
             optional = true;
           }
           {
@@ -4187,6 +4233,11 @@ rec {
             name = "http-body";
             packageId = "http-body";
           }
+          {
+            name = "httparse";
+            packageId = "httparse";
+            optional = true;
+          }
           {
             name = "hyper";
             packageId = "hyper";
@@ -4254,18 +4305,19 @@ rec {
           {
             name = "tokio";
             packageId = "tokio";
-            features = [ "macros" "test-util" "signal" ];
+            features = [ "macros" "test-util" "signal" "net" "io-util" ];
           }
         ];
         features = {
-          "client" = [ "hyper/client" "tokio/net" "dep:tracing" "dep:futures-channel" "dep:tower-service" ];
-          "client-legacy" = [ "client" "dep:socket2" "tokio/sync" "dep:libc" "dep:futures-util" ];
-          "client-pool" = [ "client" "dep:futures-util" "dep:tower-layer" ];
+          "client" = [ "hyper/client" "dep:tracing" "dep:futures-channel" "dep:tower-service" ];
+          "client-legacy" = [ "client" "tokio/net" "dep:socket2" "tokio/sync" "dep:libc" "dep:futures-util" "dep:httparse" ];
+          "client-pool" = [ "client" "dep:futures-util" "dep:tower-layer" "tokio/sync" ];
           "client-proxy" = [ "client" "dep:base64" "dep:ipnet" "dep:percent-encoding" ];
           "client-proxy-system" = [ "dep:system-configuration" "dep:windows-registry" ];
           "full" = [ "client" "client-legacy" "client-pool" "client-proxy" "client-proxy-system" "server" "server-auto" "server-graceful" "service" "http1" "http2" "tokio" "tracing" ];
           "http1" = [ "hyper/http1" ];
           "http2" = [ "hyper/http2" ];
+          "rt-tracing-exec-force" = [ "tokio" "tracing" ];
           "server" = [ "hyper/server" ];
           "server-auto" = [ "server" "http1" "http2" ];
           "server-graceful" = [ "server" "tokio/sync" ];
@@ -4583,9 +4635,9 @@ rec {
       };
       "icu_provider" = rec {
         crateName = "icu_provider";
-        version = "2.3.0";
+        version = "2.3.1";
         edition = "2024";
-        sha256 = "0a343jlrb7jlb20xv1airslzv63559wf38jihrx81bba39kyv9wj";
+        sha256 = "0wrydhwprwgyka3r3sw6276syjnlw6fpqr2zsm2srvxv7afvnyyj";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4711,9 +4763,9 @@ rec {
       };
       "indexmap" = rec {
         crateName = "indexmap";
-        version = "2.14.0";
+        version = "2.14.2";
         edition = "2024";
-        sha256 = "1na9z6f0d5pkjr1lgsni470v98gv2r7c41j8w48skr089x2yjrnl";
+        sha256 = "0mf86hbjkkcd82cpq683bblbs0zwa8ndla96ci8p1ji6bl7ijknc";
         dependencies = [
           {
             name = "equivalent";
@@ -4762,9 +4814,9 @@ rec {
       };
       "ipnet" = rec {
         crateName = "ipnet";
-        version = "2.12.1";
+        version = "2.12.2";
         edition = "2018";
-        sha256 = "0y6xssyvfy85k90pnnanxv9phayxalhp8bacy61rw4vkmhznqxba";
+        sha256 = "1h65hw16sqv8nrrmqp0g8drv5wh98n4z7a4h1lb76n8d7js306br";
         authors = [
           "Kris Price <kris@krisprice.nz>"
         ];
@@ -4870,9 +4922,9 @@ rec {
       };
       "jiff" = rec {
         crateName = "jiff";
-        version = "0.2.35";
+        version = "0.2.37";
         edition = "2021";
-        sha256 = "1k1d1n8k46192xz6ph8km43lcg68ql65phzmhm49mbq7pn1p32v6";
+        sha256 = "1nxgdj2wajw9ml8fcc2zq858k6v9618m22864vh6sy885zvvmc8a";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
         ];
@@ -4943,6 +4995,7 @@ rec {
         ];
         features = {
           "alloc" = [ "jcore/alloc" "serde_core?/alloc" "portable-atomic-util/alloc" "defmt?/alloc" ];
+          "arbitrary" = [ "dep:arbitrary" "jcore/arbitrary" "std" ];
           "default" = [ "std" "tz-system" "tz-fat" "tzdb-bundle-platform" "tzdb-zoneinfo" "tzdb-concatenated" "perf-inline" ];
           "defmt" = [ "dep:defmt" "jcore/defmt" ];
           "js" = [ "dep:wasm-bindgen" "dep:js-sys" ];
@@ -4962,9 +5015,9 @@ rec {
       };
       "jiff-core" = rec {
         crateName = "jiff-core";
-        version = "0.1.0";
+        version = "0.1.1";
         edition = "2021";
-        sha256 = "02axx56pkh2w4bw5rp94qlvcpwzd3n2w2025fnikvrgg762aiv3z";
+        sha256 = "130jqxlbrmll1ahvm9lwr06grmzpmnx5wc6j0n8crkiw0ivgwljy";
         libName = "jiff_core";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
@@ -4975,21 +5028,28 @@ rec {
             packageId = "defmt";
             optional = true;
           }
+          {
+            name = "log";
+            packageId = "log";
+            optional = true;
+            usesDefaultFeatures = false;
+          }
         ];
         features = {
           "alloc" = [ "defmt?/alloc" ];
+          "arbitrary" = [ "dep:arbitrary" "std" ];
           "default" = [ "std" "tz-fat" ];
           "defmt" = [ "dep:defmt" ];
           "logging" = [ "dep:log" ];
-          "std" = [ "alloc" ];
+          "std" = [ "alloc" "log?/std" ];
         };
         resolvedDefaultFeatures = [ "alloc" "default" "std" "tz-fat" ];
       };
       "jiff-static" = rec {
         crateName = "jiff-static";
-        version = "0.2.35";
+        version = "0.2.37";
         edition = "2021";
-        sha256 = "014jli8v46c8hzkndmvdfvq4la6a6y9icmnh3k735yqwlarxqs9s";
+        sha256 = "04kjdzg4h4wy38ghm91qva7xg4glr65120c74bk7mmka26hni0ip";
         procMacro = true;
         libName = "jiff_static";
         authors = [
@@ -5084,7 +5144,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
           {
             name = "windows-link";
@@ -5202,9 +5262,9 @@ rec {
       };
       "js-sys" = rec {
         crateName = "js-sys";
-        version = "0.3.104";
+        version = "0.3.106";
         edition = "2021";
-        sha256 = "0fjsgady7wbv7bbyy6c8qhrd93bnx11qbl83l1g7bb9a4601030f";
+        sha256 = "1icwmpjw54lb7vg5926k5y4y5jbiih0zxhwgjwnzn475v90xk0vq";
         libName = "js_sys";
         authors = [
           "The wasm-bindgen Developers"
@@ -5219,7 +5279,6 @@ rec {
             packageId = "futures-util";
             optional = true;
             usesDefaultFeatures = false;
-            features = [ "std" ];
           }
           {
             name = "wasm-bindgen";
@@ -5230,7 +5289,7 @@ rec {
         features = {
           "default" = [ "std" "unsafe-eval" ];
           "futures-core-03-stream" = [ "dep:futures-util" "dep:futures-core" ];
-          "std" = [ "wasm-bindgen/std" "dep:futures-util" ];
+          "std" = [ "wasm-bindgen/std" "futures-util/std" ];
         };
         resolvedDefaultFeatures = [ "default" "std" "unsafe-eval" ];
       };
@@ -5264,7 +5323,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
         ];
         devDependencies = [
@@ -5287,9 +5346,9 @@ rec {
       };
       "jsonpath-rust" = rec {
         crateName = "jsonpath-rust";
-        version = "1.0.8";
+        version = "1.0.11";
         edition = "2021";
-        sha256 = "19q6pgjp51wn3227c0n9vxp2dsdmjxwblrxh25v8k7y0xwg041rf";
+        sha256 = "0l8y689h8km6wyd6f0bw9zv1rn06wksfjl42amd340x1rba94f6j";
         libName = "jsonpath_rust";
         authors = [
           "BorisZhguchev <zhguchev@gmail.com>"
@@ -5313,7 +5372,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
         ];
 
@@ -5410,9 +5469,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "k8s_version";
         authors = [
@@ -5421,7 +5480,7 @@ rec {
         dependencies = [
           {
             name = "darling";
-            packageId = "darling 0.24.0";
+            packageId = "darling 0.24.1";
             optional = true;
           }
           {
@@ -5690,7 +5749,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
           {
             name = "tokio";
@@ -5856,7 +5915,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
         ];
         devDependencies = [
@@ -6008,7 +6067,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
           {
             name = "tokio";
@@ -6048,9 +6107,9 @@ rec {
       };
       "lazy_static" = rec {
         crateName = "lazy_static";
-        version = "1.5.0";
+        version = "1.5.1";
         edition = "2015";
-        sha256 = "1zk6dqqni0193xg6iijh7i3i44sryglwgvx20spdvwk3r6sbrlmv";
+        sha256 = "1yqaqmp510xw2ldpw88mx9b5s5qj8flb4rw0wd9ks1zpk9j0z1r0";
         authors = [
           "Marvin Löbel <loebel.marvin@gmail.com>"
         ];
@@ -6071,9 +6130,9 @@ rec {
       };
       "libc" = rec {
         crateName = "libc";
-        version = "0.2.189";
+        version = "0.2.190";
         edition = "2021";
-        sha256 = "1whjfs375vlng2q6yrbzs73cvp5lm3w1n2gfqajb2vgf7zg3xbry";
+        sha256 = "0y5yap4bfp7rfsldcbk9pb5alcgygca5xn1n2pmh181zdpf3spff";
         features = {
           "default" = [ "std" ];
           "rustc-dep-of-std" = [ "align" "rustc-std-workspace-core" ];
@@ -6084,10 +6143,10 @@ rec {
       };
       "libgit2-sys" = rec {
         crateName = "libgit2-sys";
-        version = "0.18.7+1.9.6";
+        version = "0.18.8+1.9.7";
         edition = "2021";
         links = "git2";
-        sha256 = "12ad5zmffzbivn57d47lg2kgjprqsz0kq8i4lsqzlkwz9cg3kir3";
+        sha256 = "0l3vm5g59zl7r7aw7zpms922j78imdlyv219zg1rnj6p4n5mcz3z";
         libName = "libgit2_sys";
         libPath = "lib.rs";
         authors = [
@@ -6225,9 +6284,9 @@ rec {
       };
       "log" = rec {
         crateName = "log";
-        version = "0.4.33";
+        version = "0.4.34";
         edition = "2021";
-        sha256 = "1bd9dmk22pxgnf0h0slba6rz99zb0a0b2mdhpk8p92bp26ycbvhc";
+        sha256 = "1ihkzn0m33ab79fcl4mkb04n5iwqzbxzyw7l7hazqkffaqzbvy7r";
         authors = [
           "The Rust Project Developers"
         ];
@@ -6241,11 +6300,12 @@ rec {
           "kv_unstable_sval" = [ "kv_sval" "kv_unstable" ];
           "serde" = [ "serde_core" ];
           "serde_core" = [ "dep:serde_core" ];
+          "std" = [ "alloc" ];
           "sval" = [ "dep:sval" ];
           "sval_ref" = [ "dep:sval_ref" ];
           "value-bag" = [ "dep:value-bag" ];
         };
-        resolvedDefaultFeatures = [ "std" ];
+        resolvedDefaultFeatures = [ "alloc" "std" ];
       };
       "matchers" = rec {
         crateName = "matchers";
@@ -6310,9 +6370,9 @@ rec {
       };
       "miniz_oxide" = rec {
         crateName = "miniz_oxide";
-        version = "0.8.9";
+        version = "0.9.1";
         edition = "2021";
-        sha256 = "05k3pdg8bjjzayq3rf0qhpirq9k37pxnasfn4arbs17phqn6m9qz";
+        sha256 = "0k2bgjzk2sbsynpsv4wizwxbqp6vs7g08y5anbkrh3l6a15bqgxn";
         authors = [
           "Frommi <daniil.liferenko@gmail.com>"
           "oyvindln <oyvindln@users.noreply.github.com>"
@@ -6339,14 +6399,15 @@ rec {
           "serde" = [ "dep:serde" ];
           "simd" = [ "simd-adler32" ];
           "simd-adler32" = [ "dep:simd-adler32" ];
+          "std" = [ "serde?/std" ];
         };
-        resolvedDefaultFeatures = [ "simd" "simd-adler32" "with-alloc" ];
+        resolvedDefaultFeatures = [ "default" "simd" "simd-adler32" "with-alloc" ];
       };
       "mio" = rec {
         crateName = "mio";
-        version = "1.2.2";
+        version = "1.2.4";
         edition = "2021";
-        sha256 = "09y4b7gc42ymgssshh8sz6gs3y5r8bbigqaw2c4snh6fy5qmrmih";
+        sha256 = "1vl6px9zy0pwhlwnw3cknsqyzkg8bcpiwiq4cgicf2fwgywfv20p";
         authors = [
           "Carl Lerche <me@carllerche.com>"
           "Thomas de Zeeuw <thomasdezeeuw@gmail.com>"
@@ -6377,6 +6438,17 @@ rec {
         };
         resolvedDefaultFeatures = [ "net" "os-ext" "os-poll" ];
       };
+      "multiversion_no_op" = rec {
+        crateName = "multiversion_no_op";
+        version = "1.0.0";
+        edition = "2021";
+        sha256 = "03d2k7xk7vky38q48h08miw4jca34ymckggnrqggn60vlddvagvl";
+        procMacro = true;
+        authors = [
+          "Henri Sivonen <hsivonen@hsivonen.fi>"
+        ];
+
+      };
       "nohash-hasher" = rec {
         crateName = "nohash-hasher";
         version = "0.2.0";
@@ -6459,7 +6531,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.8.7";
+            packageId = "rand 0.8.8";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -6478,7 +6550,7 @@ rec {
         devDependencies = [
           {
             name = "rand";
-            packageId = "rand 0.8.7";
+            packageId = "rand 0.8.8";
             features = [ "small_rng" ];
           }
         ];
@@ -6651,7 +6723,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -6825,7 +6897,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
             usesDefaultFeatures = false;
           }
           {
@@ -7029,7 +7101,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -7332,9 +7404,9 @@ rec {
       };
       "pest" = rec {
         crateName = "pest";
-        version = "2.9.0";
+        version = "2.9.2";
         edition = "2021";
-        sha256 = "1kwvhc5hyrfpxpmp0jw0wr891xyjs44mcs2wz68hrl54qw6ac1ss";
+        sha256 = "1a11k95dyrpfrn2ql5lprdh4k31k4hksg83w67vfdlps62iarls5";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7361,9 +7433,9 @@ rec {
       };
       "pest_derive" = rec {
         crateName = "pest_derive";
-        version = "2.9.0";
+        version = "2.9.2";
         edition = "2021";
-        sha256 = "13f8ihi8928s9mc13pcbhxy382kqc89h7i8d7s5mnif8lm23ga5k";
+        sha256 = "1ky22vlsbqha1jhx5l31d95gm8l54va38b9zmmr2wjicgxan0jr8";
         procMacro = true;
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
@@ -7389,9 +7461,9 @@ rec {
       };
       "pest_generator" = rec {
         crateName = "pest_generator";
-        version = "2.9.0";
+        version = "2.9.2";
         edition = "2021";
-        sha256 = "0jihcdnmdban4bqjd02r2wbb79nywj2nhwqyk95hvrixm98k9kg0";
+        sha256 = "029igkh6nsw62bn4325gkjm5c3lf4bjqbkv8jblrwc0ml441z78x";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7427,9 +7499,9 @@ rec {
       };
       "pest_meta" = rec {
         crateName = "pest_meta";
-        version = "2.9.0";
+        version = "2.9.2";
         edition = "2021";
-        sha256 = "15jly0r7r4m15fhm3pg814h65j7dqnqq6k43rvgxfhg29443lkg0";
+        sha256 = "1jxd8gbm328lsl3m0z2b1pq9ri60h4f7122i189k5jpwkwdbm4zd";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7584,9 +7656,9 @@ rec {
       };
       "portable-atomic-util" = rec {
         crateName = "portable-atomic-util";
-        version = "0.2.7";
+        version = "0.2.8";
         edition = "2018";
-        sha256 = "0616j0fhy6y71hyxg3n86f6hng0fmsc269s3wp4gl8ww4p8hd8f2";
+        sha256 = "059729m166s1ccvqfyj6lv0wz5kr4qh6yb2gphf3mk5yyfvkxaqh";
         libName = "portable_atomic_util";
         dependencies = [
           {
@@ -7630,9 +7702,9 @@ rec {
       };
       "powerfmt" = rec {
         crateName = "powerfmt";
-        version = "0.2.0";
+        version = "0.2.1";
         edition = "2021";
-        sha256 = "14ckj2xdpkhv3h6l5sdmb9f1d57z8hbfpdldjc2vl5givq2y77j3";
+        sha256 = "0n293rvnpisjmxdqhq6zmrvcdql7j1c4zrcy5053vrv5x6wr8qsa";
         authors = [
           "Jacob Pratt <jacob@jhpratt.dev>"
         ];
@@ -7865,11 +7937,11 @@ rec {
           "rustc-dep-of-std" = [ "core" ];
         };
       };
-      "rand 0.10.2" = rec {
+      "rand 0.10.3" = rec {
         crateName = "rand";
-        version = "0.10.2";
+        version = "0.10.3";
         edition = "2024";
-        sha256 = "105yqkdzqbgggd3r1yjm9jg0zvibfdsmxylvxxkmblwc0lxgmxf7";
+        sha256 = "1bxlhj4m9zrgfgk1yirf0nny86izrngscydfx9w387n9rfbgpjb5";
         authors = [
           "The Rand Project Developers"
           "The Rust Project Developers"
@@ -7904,11 +7976,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "alloc" "default" "std" "std_rng" "sys_rng" "thread_rng" ];
       };
-      "rand 0.8.7" = rec {
+      "rand 0.8.8" = rec {
         crateName = "rand";
-        version = "0.8.7";
+        version = "0.8.8";
         edition = "2018";
-        sha256 = "06iaf16fr0z8zly7anmn8ky0p80xnx9yv0gdcm30fwn9vqmigxi2";
+        sha256 = "0k3d9psya5icpiylff1w1wjbnc3q4pb1953n1iw7gbr61ggcfn70";
         authors = [
           "The Rand Project Developers"
           "The Rust Project Developers"
@@ -8105,7 +8177,7 @@ rec {
         dependencies = [
           {
             name = "bitflags";
-            packageId = "bitflags 2.13.1";
+            packageId = "bitflags 2.13.2";
           }
         ];
         features = {
@@ -8153,7 +8225,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
 
@@ -8310,16 +8382,16 @@ rec {
       };
       "reqwest" = rec {
         crateName = "reqwest";
-        version = "0.13.4";
+        version = "0.13.5";
         edition = "2021";
-        sha256 = "1hy1plns9krbh3h1dy2sdjygsfkdcnxm6pbxdi0ya9b5vq8mi711";
+        sha256 = "0ac0n0g7xaffc6q3dhn9rixr4h1f0h7533l1smrxv1n1bjkwz88n";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
         ];
         dependencies = [
           {
             name = "base64";
-            packageId = "base64 0.22.1";
+            packageId = "base64 0.23.1";
           }
           {
             name = "bytes";
@@ -8437,7 +8509,7 @@ rec {
             name = "web-sys";
             packageId = "web-sys";
             target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
-            features = [ "AbortController" "AbortSignal" "Headers" "Request" "RequestInit" "RequestMode" "Response" "Window" "FormData" "Blob" "BlobPropertyBag" "ServiceWorkerGlobalScope" "RequestCredentials" "File" "ReadableStream" "RequestCache" ];
+            features = [ "AbortController" "AbortSignal" "Headers" "Request" "RequestInit" "RequestMode" "Response" "Window" "FormData" "Blob" "BlobPropertyBag" "ServiceWorkerGlobalScope" "RequestCredentials" "File" "ReadableStream" "ReferrerPolicy" "RequestCache" ];
           }
         ];
         devDependencies = [
@@ -8941,9 +9013,9 @@ rec {
       };
       "rustls-platform-verifier" = rec {
         crateName = "rustls-platform-verifier";
-        version = "0.7.0";
+        version = "0.7.1";
         edition = "2021";
-        sha256 = "181v4d0vl53vdh2wq56vghal1zyhdgqvy4xa8r45zwz4di9y5l96";
+        sha256 = "164gb7kn9a8c0yrpqv879wf20z611qcfi4xjzf5qpcg2j5j5hrqi";
         libName = "rustls_platform_verifier";
         dependencies = [
           {
@@ -9047,7 +9119,7 @@ rec {
             name = "rustls";
             packageId = "rustls";
             usesDefaultFeatures = false;
-            features = [ "ring" ];
+            features = [ "aws-lc-rs" ];
           }
           {
             name = "webpki-root-certs";
@@ -9059,24 +9131,24 @@ rec {
           "base64" = [ "dep:base64" ];
           "cert-logging" = [ "base64" ];
           "docsrs" = [ "jni" "once_cell" ];
-          "ffi-testing" = [ "android_logger" "rustls/ring" ];
+          "ffi-testing" = [ "android_logger" "rustls/aws-lc-rs" ];
           "jni" = [ "dep:jni" ];
           "once_cell" = [ "dep:once_cell" ];
         };
       };
       "rustls-platform-verifier-android" = rec {
         crateName = "rustls-platform-verifier-android";
-        version = "0.1.1";
+        version = "0.2.0";
         edition = "2021";
-        sha256 = "13vq6sxsgz9547xm2zbdxiw8x7ad1g8n8ax6xvxsjqszk7q6awgq";
+        sha256 = "0pqsbv8656sr3h9jmq0q9848g03irccncywplmc29zs0pk08kipf";
         libName = "rustls_platform_verifier_android";
 
       };
       "rustls-webpki" = rec {
         crateName = "rustls-webpki";
-        version = "0.103.14";
+        version = "0.103.15";
         edition = "2021";
-        sha256 = "0njk28gvbqrsfg1b5r35y4f80n37kcjylj72fpc0k0g60n3529q5";
+        sha256 = "1hhanq3lz384v4nccacnjfwsyy99n3yc6m6iw8kljz8yicfwzhzk";
         libName = "webpki";
         dependencies = [
           {
@@ -9277,13 +9349,13 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
         devDependencies = [
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "extra-traits" ];
           }
         ];
@@ -9394,7 +9466,7 @@ rec {
         dependencies = [
           {
             name = "bitflags";
-            packageId = "bitflags 2.13.1";
+            packageId = "bitflags 2.13.2";
           }
           {
             name = "core-foundation";
@@ -9665,7 +9737,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             usesDefaultFeatures = false;
             features = [ "clone-impls" "derive" "parsing" "printing" "proc-macro" ];
           }
@@ -9697,7 +9769,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             usesDefaultFeatures = false;
             features = [ "clone-impls" "derive" "parsing" "printing" ];
           }
@@ -10066,7 +10138,7 @@ rec {
         features = {
           "default" = [ "std" ];
         };
-        resolvedDefaultFeatures = [ "std" ];
+        resolvedDefaultFeatures = [ "aarch64_neon" "public_imp" "std" ];
       };
       "slab" = rec {
         crateName = "slab";
@@ -10327,9 +10399,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_certs";
         authors = [
@@ -10365,7 +10437,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.10.2";
+            packageId = "rand 0.10.3";
           }
           {
             name = "rand_core";
@@ -10430,9 +10502,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_operator";
         authors = [
@@ -10509,7 +10581,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.10.2";
+            packageId = "rand 0.10.3";
           }
           {
             name = "regex";
@@ -10629,9 +10701,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         procMacro = true;
         libName = "stackable_operator_derive";
@@ -10641,7 +10713,7 @@ rec {
         dependencies = [
           {
             name = "darling";
-            packageId = "darling 0.24.0";
+            packageId = "darling 0.24.1";
           }
           {
             name = "proc-macro2";
@@ -10653,7 +10725,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
 
@@ -10664,9 +10736,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_shared";
         authors = [
@@ -10745,9 +10817,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_telemetry";
         authors = [
@@ -10958,9 +11030,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_versioned";
         authors = [
@@ -11008,9 +11080,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         procMacro = true;
         libName = "stackable_versioned_macros";
@@ -11024,7 +11096,7 @@ rec {
           }
           {
             name = "darling";
-            packageId = "darling 0.24.0";
+            packageId = "darling 0.24.1";
           }
           {
             name = "indoc";
@@ -11061,7 +11133,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
 
@@ -11072,9 +11144,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "ed84d456ff0b8324db3d7444659cb207564be8c9";
-          sha256 = "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "1b564c0196eda88099de52b8af317dce88ffec70";
+          sha256 = "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb";
         };
         libName = "stackable_webhook";
         authors = [
@@ -11133,7 +11205,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.10.2";
+            packageId = "rand 0.10.3";
           }
           {
             name = "serde";
@@ -11179,7 +11251,7 @@ rec {
           }
           {
             name = "tower-http";
-            packageId = "tower-http 0.7.0";
+            packageId = "tower-http 0.7.1";
             features = [ "trace" ];
           }
           {
@@ -11351,13 +11423,13 @@ rec {
           "proc-macro" = [ "proc-macro2/proc-macro" "quote?/proc-macro" ];
           "test" = [ "syn-test-suite/all-features" ];
         };
-        resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "extra-traits" "fold" "full" "parsing" "printing" "proc-macro" "visit" "visit-mut" ];
+        resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "extra-traits" "full" "parsing" "printing" "proc-macro" "visit" "visit-mut" ];
       };
-      "syn 3.0.3" = rec {
+      "syn 3.0.6" = rec {
         crateName = "syn";
-        version = "3.0.3";
+        version = "3.0.6";
         edition = "2021";
-        sha256 = "18srnql3cd39j9q6hf1az02p67rlr1rf6njx9zx4vxj9i3jvmsak";
+        sha256 = "1vmw7s58rzrs926nv5m06x7qbgswm1aa9iw3s1bj5var47kyi4w5";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -11384,7 +11456,7 @@ rec {
           "proc-macro" = [ "proc-macro2/proc-macro" "quote?/proc-macro" ];
           "test" = [ "syn-test-suite/all-features" ];
         };
-        resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "extra-traits" "full" "parsing" "printing" "proc-macro" "visit" "visit-mut" ];
+        resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "extra-traits" "fold" "full" "parsing" "printing" "proc-macro" "visit" "visit-mut" ];
       };
       "sync_wrapper" = rec {
         crateName = "sync_wrapper";
@@ -11410,9 +11482,9 @@ rec {
       };
       "synstructure" = rec {
         crateName = "synstructure";
-        version = "0.13.2";
+        version = "0.14.0";
         edition = "2018";
-        sha256 = "1lh9lx3r3jb18f8sbj29am5hm9jymvbwh6jb1izsnnxgvgrp12kj";
+        sha256 = "00kzyz38xqvs7x1dn6rp64y0ckly4m7ywf3qk3qkgqfzs3nh85wh";
         authors = [
           "Nika Layzell <nika@thelayzells.com>"
         ];
@@ -11429,7 +11501,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.119";
+            packageId = "syn 3.0.6";
             usesDefaultFeatures = false;
             features = [ "derive" "parsing" "printing" "clone-impls" "visit" "extra-traits" ];
           }
@@ -11456,18 +11528,18 @@ rec {
         ];
 
       };
-      "thiserror 2.0.20" = rec {
+      "thiserror 2.0.21" = rec {
         crateName = "thiserror";
-        version = "2.0.20";
+        version = "2.0.21";
         edition = "2021";
-        sha256 = "0kxs6p295jffxhzaxpxv1dwaaf5iqlm6sx8h0djp6ancbxgj71pc";
+        sha256 = "17hq1lh5dyr3bkc7zzjrbrp4qgkvhc48kgq1n5fdxkindaw2rr89";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
         dependencies = [
           {
             name = "thiserror-impl";
-            packageId = "thiserror-impl 2.0.20";
+            packageId = "thiserror-impl 2.0.21";
           }
         ];
         features = {
@@ -11501,11 +11573,11 @@ rec {
         ];
 
       };
-      "thiserror-impl 2.0.20" = rec {
+      "thiserror-impl 2.0.21" = rec {
         crateName = "thiserror-impl";
-        version = "2.0.20";
+        version = "2.0.21";
         edition = "2021";
-        sha256 = "1bwjc94gi0xn5jz26h1a8bjj1wdkvvr6jifamyc4mp9n28zcs15w";
+        sha256 = "0945n8agp7kg6n6b35yyjb4g5xv2q22vrw15h6jj1nw76a99flgy";
         procMacro = true;
         libName = "thiserror_impl";
         authors = [
@@ -11522,7 +11594,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
           }
         ];
 
@@ -11746,9 +11818,9 @@ rec {
       };
       "tokio" = rec {
         crateName = "tokio";
-        version = "1.53.1";
+        version = "1.53.2";
         edition = "2021";
-        sha256 = "1v8b3b45pkpbibls75yniqbvx5dlks2708141ljni5mnf6lawb10";
+        sha256 = "0i202ksji8q2asvii0adzgi8m0z93z3j7apn62qfh8d6qzy92pz9";
         authors = [
           "Tokio Contributors <team@tokio.rs>"
         ];
@@ -11886,7 +11958,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "full" ];
           }
         ];
@@ -11894,9 +11966,9 @@ rec {
       };
       "tokio-rustls" = rec {
         crateName = "tokio-rustls";
-        version = "0.26.4";
+        version = "0.26.6";
         edition = "2021";
-        sha256 = "0qggwknz9w4bbsv1z158hlnpkm97j3w8v31586jipn99byaala8p";
+        sha256 = "1nq5s413p6hkwrgjrpag1gi2mnjajpbszqhmhbpnkmfdq9w2dk69";
         libName = "tokio_rustls";
         dependencies = [
           {
@@ -12067,9 +12139,9 @@ rec {
       };
       "toml_edit" = rec {
         crateName = "toml_edit";
-        version = "0.25.13+spec-1.1.0";
+        version = "0.25.15+spec-1.1.0";
         edition = "2024";
-        sha256 = "16xgmjdnxssdpj7rjyimsk4fqbv29g8zl7zhdbc6dxrf9mz3cxb9";
+        sha256 = "0556lgzcvgfy16b8sxskr391s6cbfwnb0r4h5i4k6qw5lnaflh0k";
         dependencies = [
           {
             name = "indexmap";
@@ -12437,7 +12509,7 @@ rec {
           }
           {
             name = "bitflags";
-            packageId = "bitflags 2.13.1";
+            packageId = "bitflags 2.13.2";
           }
           {
             name = "bytes";
@@ -12550,11 +12622,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "auth" "base64" "default" "follow-redirect" "futures-util" "map-response-body" "mime" "tower" "trace" "tracing" "util" "validate-request" ];
       };
-      "tower-http 0.7.0" = rec {
+      "tower-http 0.7.1" = rec {
         crateName = "tower-http";
-        version = "0.7.0";
+        version = "0.7.1";
         edition = "2018";
-        sha256 = "0cz2k1a6gj54lcqx9cxb6k7rfgwcgc2zi31xnq0vxhmh2blpa7xi";
+        sha256 = "172v4iw852pzl0v0k0nlklavlsnaw3zmbmx1w2xirmpxlik5m808";
         libName = "tower_http";
         authors = [
           "Tower Maintainers <team@tower-rs.com>"
@@ -12562,7 +12634,7 @@ rec {
         dependencies = [
           {
             name = "bitflags";
-            packageId = "bitflags 2.13.1";
+            packageId = "bitflags 2.13.2";
           }
           {
             name = "bytes";
@@ -12737,7 +12809,7 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 2.0.20";
+            packageId = "thiserror 2.0.21";
           }
           {
             name = "time";
@@ -13113,9 +13185,9 @@ rec {
       };
       "unicode-ident" = rec {
         crateName = "unicode-ident";
-        version = "1.0.24";
+        version = "1.0.26";
         edition = "2021";
-        sha256 = "0xfs8y1g7syl2iykji8zk5hgfi5jw819f5zsrbaxmlzwsly33r76";
+        sha256 = "0m3915ipi4zz7isncf5k1dz47ys0nq9j7l4l2n2rm03zaxwg8ifj";
         libName = "unicode_ident";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
@@ -13272,9 +13344,9 @@ rec {
       };
       "uuid" = rec {
         crateName = "uuid";
-        version = "1.24.1";
+        version = "1.27.0";
         edition = "2021";
-        sha256 = "1n8b7fg7dbx6ws64387l2i0qq900rw9b7qax63acdh37sczw1vrc";
+        sha256 = "16h5h6bf5ybh1lj97lcdl41g7fqbiczpavpsb0zf3b63p4v7s9wp";
         authors = [
           "Ashley Mannix<ashleymannix@live.com.au>"
           "Dylan DPC<dylan.dpc@gmail.com>"
@@ -13386,9 +13458,9 @@ rec {
       };
       "want" = rec {
         crateName = "want";
-        version = "0.3.1";
+        version = "0.3.2";
         edition = "2018";
-        sha256 = "03hbfrnvqqdchb5kgxyavb9jabwza0dmh2vw5kg0dq8rxl57d9xz";
+        sha256 = "02zdlaqarwm9x3z1l0vm61mv8f6mv0kp4izgnxlfibqhv46xsk7c";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
         ];
@@ -13438,9 +13510,9 @@ rec {
       };
       "wasm-bindgen" = rec {
         crateName = "wasm-bindgen";
-        version = "0.2.127";
+        version = "0.2.129";
         edition = "2021";
-        sha256 = "0w6fa1mkbb6qlkffgy4qaz0hdf496zbjkyiyvs4lvmpd8xbr6w0v";
+        sha256 = "02flhqld01jqb6vbfyx1gb8s78g1pnq2164daxad93y6mhrlzdcv";
         libName = "wasm_bindgen";
         authors = [
           "The wasm-bindgen Developers"
@@ -13471,12 +13543,6 @@ rec {
             rename = "rustversion-compat";
           }
         ];
-        devDependencies = [
-          {
-            name = "once_cell";
-            packageId = "once_cell";
-          }
-        ];
         features = {
           "default" = [ "std" ];
           "enable-interning" = [ "std" ];
@@ -13489,9 +13555,9 @@ rec {
       };
       "wasm-bindgen-futures" = rec {
         crateName = "wasm-bindgen-futures";
-        version = "0.4.77";
+        version = "0.4.79";
         edition = "2021";
-        sha256 = "0l3r8m335kb2p8yj65kb0biwlypcx3ay4g750hafkl13rkapfxvb";
+        sha256 = "03k1wcg5j3wqk6vgy6gzcq868vsa9k81dlhqissfk0nrw96v7fiw";
         libName = "wasm_bindgen_futures";
         authors = [
           "The wasm-bindgen Developers"
@@ -13502,6 +13568,13 @@ rec {
             packageId = "js-sys";
             usesDefaultFeatures = false;
           }
+          {
+            name = "tokio";
+            packageId = "tokio";
+            usesDefaultFeatures = false;
+            target = { target, features }: (("emscripten" == target."os" or null) && (target."wasm_bindgen_unstable_tokio" or false));
+            features = [ "rt" "time" ];
+          }
           {
             name = "wasm-bindgen";
             packageId = "wasm-bindgen";
@@ -13517,9 +13590,9 @@ rec {
       };
       "wasm-bindgen-macro" = rec {
         crateName = "wasm-bindgen-macro";
-        version = "0.2.127";
+        version = "0.2.129";
         edition = "2021";
-        sha256 = "1hcvlb6bv771fvgifd367wd0cm4giyar8fq5i4h705vj7y7myxvp";
+        sha256 = "0dc5xq09sy1v9ns1fhb0cnyqz5p1wcjjvkdmxskj9qhnbg1x0a9f";
         procMacro = true;
         libName = "wasm_bindgen_macro";
         authors = [
@@ -13541,9 +13614,9 @@ rec {
       };
       "wasm-bindgen-macro-support" = rec {
         crateName = "wasm-bindgen-macro-support";
-        version = "0.2.127";
+        version = "0.2.129";
         edition = "2021";
-        sha256 = "112j4d7dv8y2sk9yy9czrl9fpjx9388ywnn7icdv2bywazw367g1";
+        sha256 = "1dx6w90f14avmhri7ss9lyz03060g6475r4axy3bm7biqf5ill3g";
         libName = "wasm_bindgen_macro_support";
         authors = [
           "The wasm-bindgen Developers"
@@ -13563,7 +13636,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.119";
+            packageId = "syn 3.0.6";
             features = [ "visit" "visit-mut" "full" "extra-traits" ];
           }
           {
@@ -13577,10 +13650,10 @@ rec {
       };
       "wasm-bindgen-shared" = rec {
         crateName = "wasm-bindgen-shared";
-        version = "0.2.127";
+        version = "0.2.129";
         edition = "2021";
         links = "wasm_bindgen";
-        sha256 = "1gywp6xv8a27fvm3ga9xby93xyic3hc2s626b9z9rw2xqny4vxky";
+        sha256 = "1ilmp5d3sl8lrq9djhcs90gk66yvk8mgwk4sfrvpvkd75b2wkw13";
         libName = "wasm_bindgen_shared";
         authors = [
           "The wasm-bindgen Developers"
@@ -13595,9 +13668,9 @@ rec {
       };
       "web-sys" = rec {
         crateName = "web-sys";
-        version = "0.3.104";
+        version = "0.3.106";
         edition = "2021";
-        sha256 = "0c0acbvaqzqf21q5vdff2g74fvb7afi91xjplmclybq4d24k6df4";
+        sha256 = "195bd1m14w3hsw5fg3sr938mh7y4cb260d0sq6a6brffxjfin9l8";
         libName = "web_sys";
         authors = [
           "The wasm-bindgen Developers"
@@ -14092,7 +14165,7 @@ rec {
           "default" = [ "std" ];
           "std" = [ "wasm-bindgen/std" "js-sys/std" ];
         };
-        resolvedDefaultFeatures = [ "AbortController" "AbortSignal" "Blob" "BlobPropertyBag" "EventTarget" "File" "FormData" "Headers" "ReadableStream" "Request" "RequestCache" "RequestCredentials" "RequestInit" "RequestMode" "Response" "ServiceWorkerGlobalScope" "Window" "WorkerGlobalScope" "default" "std" ];
+        resolvedDefaultFeatures = [ "AbortController" "AbortSignal" "Blob" "BlobPropertyBag" "EventTarget" "File" "FormData" "Headers" "ReadableStream" "ReferrerPolicy" "Request" "RequestCache" "RequestCredentials" "RequestInit" "RequestMode" "Response" "ServiceWorkerGlobalScope" "Window" "WorkerGlobalScope" "default" "std" ];
       };
       "web-time" = rec {
         crateName = "web-time";
@@ -15094,9 +15167,9 @@ rec {
       };
       "yoke-derive" = rec {
         crateName = "yoke-derive";
-        version = "0.8.2";
+        version = "0.8.4";
         edition = "2021";
-        sha256 = "13l5y5sz4lqm7rmyakjbh6vwgikxiql51xfff9hq2j485hk4r16y";
+        sha256 = "0wbdvvdv9birwxrr9ynxj0k7as0f0ci7ihhck34yi09nvgibv3pc";
         procMacro = true;
         libName = "yoke_derive";
         authors = [
@@ -15113,8 +15186,8 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.119";
-            features = [ "fold" ];
+            packageId = "syn 3.0.6";
+            features = [ "fold" "visit" ];
           }
           {
             name = "synstructure";
@@ -15125,9 +15198,9 @@ rec {
       };
       "zerocopy" = rec {
         crateName = "zerocopy";
-        version = "0.8.56";
+        version = "0.8.60";
         edition = "2021";
-        sha256 = "1svmifchgdk0sm7v24lfwhhxis57gwa2lg21ingmmd5dhgjn8rsm";
+        sha256 = "1ghxkd4fv4ka88v2rg9260p6465v49hmc1zvqfm6yvs2nx5zq034";
         dependencies = [
           {
             name = "zerocopy-derive";
@@ -15157,9 +15230,9 @@ rec {
       };
       "zerocopy-derive" = rec {
         crateName = "zerocopy-derive";
-        version = "0.8.56";
+        version = "0.8.60";
         edition = "2021";
-        sha256 = "1hfz1hfxj86y1sgyia8gbisny9bl9bwlbahg4jypjmsp43y45azj";
+        sha256 = "1nrlkb37wm1sq962725mxwhahaicbg277q25kbslvbavab3prhlr";
         procMacro = true;
         libName = "zerocopy_derive";
         dependencies = [
@@ -15210,9 +15283,9 @@ rec {
       };
       "zerofrom-derive" = rec {
         crateName = "zerofrom-derive";
-        version = "0.1.7";
+        version = "0.1.8";
         edition = "2021";
-        sha256 = "18c4wsnznhdxx6m80piil1lbyszdiwsshgjrybqcm4b6qic22lqi";
+        sha256 = "0jhdy4p9c6ja3dynsdck14g2iilq8ai5ch6nsi455x67ys1lcnzp";
         procMacro = true;
         libName = "zerofrom_derive";
         authors = [
@@ -15229,8 +15302,8 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.119";
-            features = [ "fold" ];
+            packageId = "syn 3.0.6";
+            features = [ "fold" "visit" ];
           }
           {
             name = "synstructure";
@@ -15377,9 +15450,9 @@ rec {
       };
       "zerovec-derive" = rec {
         crateName = "zerovec-derive";
-        version = "0.11.5";
+        version = "0.11.6";
         edition = "2021";
-        sha256 = "1a8pz516ddcgxvxq3j1xgprac5wnprlrbyzsgzarj0423la2l8cz";
+        sha256 = "1ni5j8v99x3fcf3l8kp64b7aq4vf8y22jshfq74xs9mxkp1nzprl";
         procMacro = true;
         libName = "zerovec_derive";
         authors = [
@@ -15396,12 +15469,29 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 3.0.3";
+            packageId = "syn 3.0.6";
             features = [ "extra-traits" ];
           }
         ];
 
       };
+      "zlib-rs" = rec {
+        crateName = "zlib-rs";
+        version = "0.6.8";
+        edition = "2021";
+        sha256 = "04j158293bx73kv5pj1i89ai411q7fxc9zwk3wkpqgb9gj7fas5j";
+        libName = "zlib_rs";
+        features = {
+          "__internal-fuzz" = [ "arbitrary" ];
+          "__internal-test" = [ "quickcheck" ];
+          "arbitrary" = [ "dep:arbitrary" ];
+          "avx512" = [ "vpclmulqdq" ];
+          "default" = [ "std" "c-allocator" ];
+          "quickcheck" = [ "dep:quickcheck" ];
+          "std" = [ "rust-allocator" ];
+        };
+        resolvedDefaultFeatures = [ "rust-allocator" "std" ];
+      };
       "zmij" = rec {
         crateName = "zmij";
         version = "1.0.23";
diff --git a/Cargo.toml b/Cargo.toml
index 525f2e4a..0e452019 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,9 @@ edition = "2024"
 repository = "https://github.com/stackabletech/trino-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.119.0", features = ["webhook"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.119.0", features = [
+  "webhook",
+] }
 
 anyhow = "1.0"
 async-trait = "0.1"
@@ -30,5 +32,9 @@ tokio = { version = "1.53", features = ["full"] }
 tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
+# TODO: Switch back to a release tag once operator-rs#1250 (the `crd::openlineage`
+# module) has merged and a new stackable-operator release has been published.
+# See <https://github.com/stackabletech/operator-rs/pull/1250>.
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
 # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main"}
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
diff --git a/crate-hashes.json b/crate-hashes.json
index 2046087d..98d1e9fa 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,11 +1,11 @@
 {
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#k8s-version@0.1.3": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-certs@0.4.1": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-operator-derive@0.3.1": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-operator@0.119.0": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-shared@0.1.2": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-telemetry@0.6.5": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-versioned-macros@0.11.1": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-versioned@0.11.1": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.119.0#stackable-webhook@0.10.0": "1ra6n0mi633sipsgrli7hhxv64khhs00l448mqg61gxsjc4y02r0"
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#k8s-version@0.1.3": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-certs@0.4.1": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator-derive@0.3.1": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator@0.119.0": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-shared@0.1.2": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-telemetry@0.6.5": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned-macros@0.11.1": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned@0.11.1": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-webhook@0.10.0": "1djagzx3gjr0a3wjpsj84zlbwaxg15kq5nbivacyg0l8jqj1jnrb"
 }
\ No newline at end of file
diff --git a/deploy/helm/trino-operator/templates/clusterrole-operator.yaml b/deploy/helm/trino-operator/templates/clusterrole-operator.yaml
index a8b08535..a6813bab 100644
--- a/deploy/helm/trino-operator/templates/clusterrole-operator.yaml
+++ b/deploy/helm/trino-operator/templates/clusterrole-operator.yaml
@@ -171,3 +171,12 @@ rules:
       - get
       - list
       - watch
+  # Read OpenLineage connection configuration referenced in the TrinoCluster spec.
+  - apiGroups:
+      - lineage.stackable.tech
+    resources:
+      - openlineageconnections
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/docs/modules/trino/pages/usage-guide/openlineage.adoc b/docs/modules/trino/pages/usage-guide/openlineage.adoc
new file mode 100644
index 00000000..4902c80d
--- /dev/null
+++ b/docs/modules/trino/pages/usage-guide/openlineage.adoc
@@ -0,0 +1,126 @@
+= OpenLineage
+:description: Emit OpenLineage data lineage events from Trino queries to an OpenLineage-compatible backend such as Marquez.
+:keywords: OpenLineage, data lineage, event listener, Marquez, Trino
+
+https://openlineage.io/[OpenLineage] is an open standard for data lineage collection.
+Trino ships an https://trino.io/docs/current/admin/event-listeners-openlineage.html[OpenLineage event listener] as a core plugin, which emits a lineage event for every executed query.
+The Trino operator can configure this listener automatically, so lineage from all queries run on the cluster is sent to an OpenLineage-compatible backend such as https://marquezproject.github.io/marquez/[Marquez], without any manual configuration.
+
+When configured, the operator:
+
+* writes an `event-listener.properties` file on the *coordinator* selecting the OpenLineage plugin and its HTTP transport,
+* points the transport at the backend endpoint (`<scheme>://<host>:<port>`),
+* records this cluster's `trino.uri` and a lineage namespace, and
+* (optionally) imports a backend CA certificate into the coordinator trust store and injects a bearer token for authenticated backends.
+
+The event listener runs on the coordinator only; workers are not affected.
+
+NOTE: The Trino OpenLineage plugin only emits events for data-modifying query types (`INSERT`, `DELETE`, `MERGE`, `UPDATE`, `ALTER_TABLE_EXECUTE` and `DATA_DEFINITION`) by default; plain `SELECT` queries are filtered out. Adjust `openlineage-event-listener.trino.include-query-types` via config overrides (see below) to change this.
+
+== Enabling OpenLineage
+
+OpenLineage is configured through `clusterConfig.lineage.connection`, which either inlines an OpenLineage connection or references a standalone `OpenLineageConnection` resource by name:
+
+[source,yaml]
+----
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCluster
+metadata:
+  name: trino
+spec:
+  clusterConfig:
+    lineage: # <1>
+      connection: # <2>
+        inline:
+          http:
+            host: marquez
+            port: 5000
+            # path: /api/v1/lineage # <4>
+            # tls:
+            #   verification:
+            #     server:
+            #       caCert:
+            #         secretClass: marquez-ca
+      # namespace: trino-lineage # <3>
+      # jobNameFormat: "$QUERY_ID" # <5>
+  ...
+----
+<1> Adding the `lineage` block enables OpenLineage event emission. Omit it entirely to leave OpenLineage off (the default).
+<2> The OpenLineage backend connection. Use `inline` (shown here) to define the connection directly, or `reference: <name>` to point at an `OpenLineageConnection` resource in the same namespace. Required. The connection selects a transport; `http` is currently the only one supported.
+<3> Optional. The OpenLineage namespace events are reported under. Defaults to `default`.
+<4> Optional. URL path of the endpoint events are POSTed to, mapped onto `openlineage-event-listener.transport.endpoint`. Defaults to `/api/v1/lineage`.
+<5> Optional. Sets the OpenLineage job name format (`openlineage-event-listener.job.name-format`). Accepts an arbitrary string with optional `$QUERY_ID`, `$USER`, `$SOURCE` and `$CLIENT_IP` substitution variables. Defaults to `$QUERY_ID`. See the link:https://trino.io/docs/current/admin/event-listeners-openlineage.html[Trino OpenLineage event listener documentation {external-link-icon}^].
+
+The `OpenLineageConnection` resource (`lineage.stackable.tech`) is a reusable definition of a connection to an OpenLineage backend, provided by the Stackable operator library.
+Reference it to share one backend definition across multiple clusters:
+
+[source,yaml]
+----
+apiVersion: lineage.stackable.tech/v1alpha1
+kind: OpenLineageConnection
+metadata:
+  name: marquez
+spec:
+  http:
+    host: marquez
+    port: 5000
+----
+
+The transport scheme is `https` when `tls` is configured, otherwise `http`.
+When the connection verifies the server against a `secretClass` CA (as in the commented `tls` block above), the operator mounts that SecretClass certificate into the coordinator and adds it to the trust store, so the OpenLineage listener trusts the backend's certificate.
+
+IMPORTANT: With TLS server verification, the `host` must match a Subject Alternative Name in the backend's certificate. Use the exact hostname the certificate was issued for (for an in-cluster backend, typically its full service FQDN such as `marquez.<namespace>.svc.cluster.local`), otherwise the TLS handshake fails and no events are delivered.
+
+[#authentication]
+== Authentication
+
+Backends that require authentication (for example DataHub, or a Marquez instance behind a gateway) expect a bearer token on each request.
+Configure this by setting `credentialsSecretName` on the connection to the name of a Secret holding the token:
+
+[source,yaml]
+----
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCluster
+metadata:
+  name: trino
+spec:
+  clusterConfig:
+    lineage:
+      connection:
+        inline:
+          http:
+            host: marquez
+            port: 5000
+            credentialsSecretName: openlineage-token # <1>
+  ...
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openlineage-token
+  namespace: default # <2>
+stringData:
+  apiKey: "s3cr3t-bearer-token" # <3>
+----
+<1> Name of the Secret holding the token. If omitted, no authentication is used. The Secret must exist in the same namespace as the `TrinoCluster`.
+<2> The Secret must be in the cluster's namespace so it can be projected into the coordinator.
+<3> The token must be stored under the fixed key `apiKey`. The token is mounted as a file into the coordinator and resolved into the event listener configuration at startup, so it never appears in the ConfigMap or the pod's environment.
+
+The operator translates this into the OpenLineage HTTP transport's `api-key` (bearer) authentication.
+Combine it with the `tls` block above when the backend also needs TLS server verification.
+
+== Overriding the generated configuration
+
+The generated `event-listener.properties` can be extended or overridden per role group through xref:usage-guide/overrides.adoc[config overrides], using the `event-listener.properties` file name.
+Overrides are merged last and therefore take precedence over the operator-generated values:
+
+[source,yaml]
+----
+spec:
+  coordinators:
+    configOverrides:
+      event-listener.properties:
+        openlineage-event-listener.trino.uri: "https://trino.example.com:8443"
+----
+
+Event listeners run on the coordinator, so `event-listener.properties` overrides only take effect on the coordinator role.
diff --git a/docs/modules/trino/partials/nav.adoc b/docs/modules/trino/partials/nav.adoc
index d90607af..35c80472 100644
--- a/docs/modules/trino/partials/nav.adoc
+++ b/docs/modules/trino/partials/nav.adoc
@@ -11,6 +11,7 @@
 ** xref:trino:usage-guide/s3.adoc[]
 ** xref:trino:usage-guide/security.adoc[]
 ** xref:trino:usage-guide/monitoring.adoc[]
+** xref:trino:usage-guide/openlineage.adoc[]
 ** xref:trino:usage-guide/log_aggregation.adoc[]
 ** xref:trino:usage-guide/OpenTelemetry.adoc[]
 ** xref:trino:usage-guide/query.adoc[]
diff --git a/extra/crds.yaml b/extra/crds.yaml
index 901063b6..8675810b 100644
--- a/extra/crds.yaml
+++ b/extra/crds.yaml
@@ -889,6 +889,120 @@ spec:
                         - exchangeManager
                         type: object
                     type: object
+                  lineage:
+                    description: |-
+                      Emit [OpenLineage](https://openlineage.io/) lineage events for the queries run on this
+                      Trino cluster.
+                    nullable: true
+                    properties:
+                      connection:
+                        description: |-
+                          The OpenLineage backend connection, either inlined or referencing an
+                          `OpenLineageConnection` resource by name.
+                        oneOf:
+                        - required:
+                          - inline
+                        - required:
+                          - reference
+                        properties:
+                          inline:
+                            description: |-
+                              OpenLineage connection definition as a resource.
+                              Learn more about [OpenLineage](https://openlineage.io/).
+                            oneOf:
+                            - required:
+                              - http
+                            properties:
+                              http:
+                                description: Publish events over HTTP(S) to an OpenLineage backend such as Marquez.
+                                properties:
+                                  credentialsSecretName:
+                                    description: |-
+                                      Name of a Secret containing the API key used to authenticate against the OpenLineage
+                                      backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                                      the same namespace as the workload using this connection. If not specified, no
+                                      authentication is used.
+                                    nullable: true
+                                    type: string
+                                  host:
+                                    description: 'Hostname or IP address of the OpenLineage backend without any protocol or port. For example: `marquez`.'
+                                    type: string
+                                  path:
+                                    default: /api/v1/lineage
+                                    description: URL path of the endpoint lineage events are sent to.
+                                    type: string
+                                  port:
+                                    description: 'Port the OpenLineage backend listens on. For example: `5000`.'
+                                    format: uint16
+                                    maximum: 65535.0
+                                    minimum: 0.0
+                                    type: integer
+                                  tls:
+                                    description: Use a TLS connection. If not specified no TLS will be used.
+                                    nullable: true
+                                    properties:
+                                      verification:
+                                        description: The verification method used to verify the certificates of the server and/or the client.
+                                        oneOf:
+                                        - required:
+                                          - none
+                                        - required:
+                                          - server
+                                        properties:
+                                          none:
+                                            description: Use TLS but don't verify certificates.
+                                            type: object
+                                          server:
+                                            description: Use TLS and a CA certificate to verify the server.
+                                            properties:
+                                              caCert:
+                                                description: CA cert to verify the server.
+                                                oneOf:
+                                                - required:
+                                                  - webPki
+                                                - required:
+                                                  - secretClass
+                                                properties:
+                                                  secretClass:
+                                                    description: |-
+                                                      Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
+                                                      Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
+                                                      so if you got provided with a CA cert but don't have access to the key you can still use this method.
+                                                    type: string
+                                                  webPki:
+                                                    description: |-
+                                                      Use TLS and the CA certificates trusted by the common web browsers to verify the server.
+                                                      This can be useful when you e.g. use public AWS S3 or other public available services.
+                                                    type: object
+                                                type: object
+                                            required:
+                                            - caCert
+                                            type: object
+                                        type: object
+                                    required:
+                                    - verification
+                                    type: object
+                                required:
+                                - host
+                                - port
+                                type: object
+                            type: object
+                          reference:
+                            type: string
+                        type: object
+                      jobNameFormat:
+                        default: $QUERY_ID
+                        description: |-
+                          Format of the OpenLineage job name emitted for each query. Accepts an arbitrary string
+                          with optional `$QUERY_ID`, `$USER`, `$SOURCE` and `$CLIENT_IP` substitution variables.
+                        type: string
+                      namespace:
+                        default: default
+                        description: The OpenLineage namespace lineage is reported under.
+                        type: string
+                    required:
+                    - connection
+                    type: object
                   tls:
                     default:
                       internalSecretClass: tls
@@ -1447,6 +1561,12 @@ spec:
                         default: {}
                         description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
                         type: object
+                      event-listener.properties:
+                        additionalProperties:
+                          type: string
+                        default: {}
+                        description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
+                        type: object
                       exchange-manager.properties:
                         additionalProperties:
                           type: string
@@ -2056,6 +2176,12 @@ spec:
                               default: {}
                               description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
                               type: object
+                            event-listener.properties:
+                              additionalProperties:
+                                type: string
+                              default: {}
+                              description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
+                              type: object
                             exchange-manager.properties:
                               additionalProperties:
                                 type: string
@@ -2764,6 +2890,12 @@ spec:
                         default: {}
                         description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
                         type: object
+                      event-listener.properties:
+                        additionalProperties:
+                          type: string
+                        default: {}
+                        description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
+                        type: object
                       exchange-manager.properties:
                         additionalProperties:
                           type: string
@@ -3365,6 +3497,12 @@ spec:
                               default: {}
                               description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
                               type: object
+                            event-listener.properties:
+                              additionalProperties:
+                                type: string
+                              default: {}
+                              description: Flat key-value overrides for `*.properties`, Hadoop XML, etc.
+                              type: object
                             exchange-manager.properties:
                               additionalProperties:
                                 type: string
diff --git a/rust/operator-binary/src/config/lineage.rs b/rust/operator-binary/src/config/lineage.rs
new file mode 100644
index 00000000..8846f020
--- /dev/null
+++ b/rust/operator-binary/src/config/lineage.rs
@@ -0,0 +1,264 @@
+//! Resolves `spec.clusterConfig.lineage` into everything the coordinator needs to run the
+//! Trino [OpenLineage](https://openlineage.io/) event listener.
+//!
+//! Trino ships the OpenLineage event listener as a **core** plugin, so nothing needs to be added
+//! to the image; the listener runs on the **coordinator only**. This module produces:
+//!
+//! * the connection-derived `event-listener.properties` settings (transport type/URL, namespace,
+//!   job name format and, when authentication is configured, the bearer-token reference),
+//! * the Kubernetes [`Volume`]s/[`VolumeMount`]s for the backend CA certificate and the token
+//!   Secret, and
+//! * the init-container commands that import a `SecretClass` CA into the client truststore.
+//!
+//! The reusable OpenLineage CRD types (`OpenLineageConnectionSpec`, `InlineConnectionOrReference`,
+//! `OpenLineageConfig`) live in [`stackable_operator::crd::openlineage`]; this module only holds the
+//! Trino-specific wiring around them.
+
+use std::collections::BTreeMap;
+
+use snafu::{ResultExt, Snafu};
+use stackable_operator::{
+    client::Client,
+    commons::tls_verification::{
+        CaCert, TlsClientDetails, TlsClientDetailsError, TlsServerVerification, TlsVerification,
+    },
+    crd::openlineage::{self, v1alpha1::OpenLineageTransport},
+    k8s_openapi::api::core::v1::{SecretVolumeSource, Volume, VolumeMount},
+};
+
+use crate::{
+    controller::build::command,
+    crd::{OPENLINEAGE_AUTH_SECRET_KEY, STACKABLE_CLIENT_TLS_DIR, v1alpha1::TrinoLineageConfig},
+};
+
+/// Directory the OpenLineage bearer-token Secret is mounted at on the coordinator. Referenced from
+/// the `api-key` property via Trino's `${file:...}` secret placeholder (resolved at startup by
+/// `config-utils template`, see [`crate::controller::build::command::container_trino_args`]).
+const STACKABLE_OPENLINEAGE_AUTH_DIR: &str = "/stackable/openlineage_auth";
+
+/// Name of the token Secret volume mounted on the coordinator.
+const OPENLINEAGE_AUTH_VOLUME_NAME: &str = "openlineage-auth";
+
+// --- `event-listener.properties` keys, see the OpenLineage usage guide ---
+// The Trino OpenLineage event listener uses the fixed `openlineage-event-listener.` property prefix
+// regardless of the file name. `event-listener.name=openlineage` selects the plugin.
+
+/// Selects the event listener plugin.
+pub const EVENT_LISTENER_NAME_KEY: &str = "event-listener.name";
+/// The value selecting the OpenLineage event listener plugin.
+pub const EVENT_LISTENER_NAME_OPENLINEAGE: &str = "openlineage";
+/// OpenLineage transport type key (we always use the HTTP transport).
+pub const OPENLINEAGE_TRANSPORT_TYPE_KEY: &str = "openlineage-event-listener.transport.type";
+/// The OpenLineage HTTP transport type value.
+pub const OPENLINEAGE_TRANSPORT_TYPE_HTTP: &str = "HTTP";
+/// OpenLineage HTTP transport base URL key (scheme/host/port of the backend).
+pub const OPENLINEAGE_TRANSPORT_URL_KEY: &str = "openlineage-event-listener.transport.url";
+/// OpenLineage HTTP transport endpoint path key, set from the connection's `path`.
+pub const OPENLINEAGE_TRANSPORT_ENDPOINT_KEY: &str =
+    "openlineage-event-listener.transport.endpoint";
+/// OpenLineage HTTP transport bearer-token (API key) key. Only set when authentication is
+/// configured; the value is a `${file:...}` reference so the token never enters the ConfigMap.
+pub const OPENLINEAGE_TRANSPORT_API_KEY_KEY: &str = "openlineage-event-listener.transport.api-key";
+/// The OpenLineage namespace lineage is reported under.
+pub const OPENLINEAGE_NAMESPACE_KEY: &str = "openlineage-event-listener.namespace";
+/// Format for the emitted OpenLineage job name. Set from
+/// `spec.clusterConfig.lineage.jobNameFormat`, which defaults to `$QUERY_ID`.
+pub const OPENLINEAGE_JOB_NAME_FORMAT_KEY: &str = "openlineage-event-listener.job.name-format";
+/// The URI identifying this Trino cluster in emitted lineage. Computed from the coordinator service
+/// at ConfigMap-build time (see [`crate::controller::build::properties::event_listener_properties`]).
+pub const OPENLINEAGE_TRINO_URI_KEY: &str = "openlineage-event-listener.trino.uri";
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to resolve the OpenLineage connection"))]
+    ResolveConnection {
+        source: openlineage::v1alpha1::OpenLineageError,
+    },
+
+    #[snafu(display("failed to build the OpenLineage HTTP transport URL"))]
+    TransportUrl {
+        source: openlineage::v1alpha1::OpenLineageError,
+    },
+
+    #[snafu(display(
+        "failed to build volumes and mounts for the OpenLineage backend TLS CA certificate"
+    ))]
+    TlsVolumesAndMounts { source: TlsClientDetailsError },
+}
+
+/// Everything the coordinator needs to run the OpenLineage event listener, resolved from
+/// `spec.clusterConfig.lineage` during the dereference step.
+#[derive(Clone, Debug)]
+pub struct ResolvedLineageConfig {
+    /// Connection-derived `event-listener.properties` entries. The cluster-dependent `trino.uri`
+    /// is added later by the properties builder.
+    pub properties: BTreeMap<String, String>,
+
+    /// Volumes for the backend CA certificate and (when authenticated) the token Secret.
+    pub volumes: Vec<Volume>,
+
+    /// Volume mounts matching [`Self::volumes`], to be added to the coordinator container.
+    pub volume_mounts: Vec<VolumeMount>,
+
+    /// Commands run in the coordinator prepare container to import a `SecretClass` CA into the
+    /// client truststore.
+    pub init_container_extra_start_commands: Vec<String>,
+}
+
+impl ResolvedLineageConfig {
+    /// Resolves the OpenLineage connection (inline or referenced), backend TLS trust and (optional)
+    /// authentication into the coordinator-side configuration.
+    pub async fn from_config(
+        lineage: &TrinoLineageConfig,
+        client: &Client,
+        namespace: &str,
+    ) -> Result<Self, Error> {
+        let mut properties = BTreeMap::new();
+        let mut volumes = Vec::new();
+        let mut volume_mounts = Vec::new();
+        let mut init_container_extra_start_commands = Vec::new();
+
+        let connection = lineage
+            .open_lineage
+            .connection
+            .clone()
+            .resolve(client, namespace)
+            .await
+            .context(ResolveConnectionSnafu)?;
+
+        let OpenLineageTransport::Http(http) = &connection.transport;
+
+        properties.insert(
+            EVENT_LISTENER_NAME_KEY.to_string(),
+            EVENT_LISTENER_NAME_OPENLINEAGE.to_string(),
+        );
+        properties.insert(
+            OPENLINEAGE_TRANSPORT_TYPE_KEY.to_string(),
+            OPENLINEAGE_TRANSPORT_TYPE_HTTP.to_string(),
+        );
+        // Trino takes the backend origin and the endpoint path as separate properties.
+        let transport_url = http.url().context(TransportUrlSnafu)?;
+        properties.insert(
+            OPENLINEAGE_TRANSPORT_URL_KEY.to_string(),
+            transport_url.origin().ascii_serialization(),
+        );
+        properties.insert(
+            OPENLINEAGE_TRANSPORT_ENDPOINT_KEY.to_string(),
+            http.path.clone(),
+        );
+        properties.insert(
+            OPENLINEAGE_NAMESPACE_KEY.to_string(),
+            lineage.open_lineage.namespace.clone(),
+        );
+        properties.insert(
+            OPENLINEAGE_JOB_NAME_FORMAT_KEY.to_string(),
+            lineage.job_name_format.clone(),
+        );
+
+        // Backend TLS: mount and import a `SecretClass` CA into the client truststore. WebPKI and
+        // no verification need nothing (WebPKI is trusted via the system bundle already seeded into
+        // the truststore; without server verification there is no CA to trust).
+        let (tls_volumes, tls_mounts) = http
+            .tls
+            .volumes_and_mounts()
+            .context(TlsVolumesAndMountsSnafu)?;
+        volumes.extend(tls_volumes);
+        volume_mounts.extend(tls_mounts);
+        init_container_extra_start_commands.extend(openlineage_tls_truststore_commands(&http.tls));
+
+        // Authentication: when the connection sets `credentialsSecretName`, mount that Secret and
+        // reference the token via a `${file:...}` placeholder so it is resolved at startup and never
+        // lands in the ConfigMap. The token must be stored under the `apiKey` Secret key.
+        if let Some(secret_name) = &http.credentials_secret_name {
+            volumes.push(Volume {
+                name: OPENLINEAGE_AUTH_VOLUME_NAME.to_string(),
+                secret: Some(SecretVolumeSource {
+                    secret_name: Some(secret_name.clone()),
+                    ..SecretVolumeSource::default()
+                }),
+                ..Volume::default()
+            });
+            volume_mounts.push(VolumeMount {
+                name: OPENLINEAGE_AUTH_VOLUME_NAME.to_string(),
+                mount_path: STACKABLE_OPENLINEAGE_AUTH_DIR.to_string(),
+                read_only: Some(true),
+                ..VolumeMount::default()
+            });
+            properties.insert(
+                OPENLINEAGE_TRANSPORT_API_KEY_KEY.to_string(),
+                format!(
+                    "${{file:UTF-8:{STACKABLE_OPENLINEAGE_AUTH_DIR}/{OPENLINEAGE_AUTH_SECRET_KEY}}}"
+                ),
+            );
+        }
+
+        Ok(Self {
+            properties,
+            volumes,
+            volume_mounts,
+            init_container_extra_start_commands,
+        })
+    }
+}
+
+/// Init-container commands that add the backend's `SecretClass` CA certificate to the client
+/// truststore (which is the JVM default truststore, see `config::jvm`). Returns an empty list when
+/// no import is needed: no TLS, `verification.none` (plain `http`), or WebPKI verification (trusted
+/// via the seeded system bundle).
+fn openlineage_tls_truststore_commands(tls: &TlsClientDetails) -> Vec<String> {
+    match tls.tls.as_ref().map(|tls| &tls.verification) {
+        Some(TlsVerification::Server(TlsServerVerification {
+            ca_cert: CaCert::SecretClass(_),
+        })) => tls
+            .tls_ca_cert_mount_path()
+            .map(|ca_cert| command::add_cert_to_truststore(&ca_cert, STACKABLE_CLIENT_TLS_DIR))
+            .unwrap_or_default(),
+        _ => Vec::new(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::commons::tls_verification::Tls;
+
+    use super::*;
+
+    fn tls_details(verification: Option<TlsVerification>) -> TlsClientDetails {
+        TlsClientDetails {
+            tls: verification.map(|verification| Tls { verification }),
+        }
+    }
+
+    #[test]
+    fn no_tls_yields_no_truststore_commands() {
+        assert!(
+            openlineage_tls_truststore_commands(&tls_details(None)).is_empty(),
+            "plain http needs no truststore setup"
+        );
+    }
+
+    #[test]
+    fn verification_none_yields_no_truststore_commands() {
+        // `verification.none` still uses https, but there is no CA to import.
+        assert!(
+            openlineage_tls_truststore_commands(&tls_details(Some(TlsVerification::None {})))
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn webpki_verification_yields_no_truststore_commands() {
+        let details = tls_details(Some(TlsVerification::Server(TlsServerVerification {
+            ca_cert: CaCert::WebPki {},
+        })));
+        assert!(openlineage_tls_truststore_commands(&details).is_empty());
+    }
+
+    #[test]
+    fn secret_class_verification_yields_truststore_commands() {
+        let details = tls_details(Some(TlsVerification::Server(TlsServerVerification {
+            ca_cert: CaCert::SecretClass("openlineage-tls".to_string()),
+        })));
+        assert!(!openlineage_tls_truststore_commands(&details).is_empty());
+    }
+}
diff --git a/rust/operator-binary/src/config/mod.rs b/rust/operator-binary/src/config/mod.rs
index 152d5080..f3a70f9d 100644
--- a/rust/operator-binary/src/config/mod.rs
+++ b/rust/operator-binary/src/config/mod.rs
@@ -1,4 +1,5 @@
 pub mod client_protocol;
 pub mod fault_tolerant_execution;
 pub mod jvm;
+pub mod lineage;
 pub mod s3;
diff --git a/rust/operator-binary/src/controller/build/command.rs b/rust/operator-binary/src/controller/build/command.rs
index cb667ae2..9a77029b 100644
--- a/rust/operator-binary/src/controller/build/command.rs
+++ b/rust/operator-binary/src/controller/build/command.rs
@@ -132,6 +132,17 @@ pub fn container_trino_args(
         )
     ));
 
+    // Resolve the OpenLineage bearer token (if any) in the coordinator's event listener config.
+    // The file only exists on the coordinator; `${file:...}` placeholders are not resolved by Trino
+    // for `event-listener.properties` (trinodb/trino#8245), so we template it here at startup.
+    args.push(format!(
+        "test -f {rw_event_listener_config_file} && config-utils template {rw_event_listener_config_file}",
+        rw_event_listener_config_file = format!(
+            "{RW_CONFIG_DIR_NAME}/{event_listener}",
+            event_listener = ConfigFileName::EventListener
+        )
+    ));
+
     args.push("set -x".to_string());
 
     // Start command
diff --git a/rust/operator-binary/src/controller/build/properties/config_properties.rs b/rust/operator-binary/src/controller/build/properties/config_properties.rs
index e2b6e3ed..9ce08bf5 100644
--- a/rust/operator-binary/src/controller/build/properties/config_properties.rs
+++ b/rust/operator-binary/src/controller/build/properties/config_properties.rs
@@ -6,11 +6,11 @@ use snafu::Snafu;
 use stackable_operator::{memory::BinaryMultiple, utils::cluster_info::KubernetesClusterInfo};
 
 use crate::{
-    controller::{TrinoRoleGroupConfig, ValidatedCluster},
+    controller::{TrinoRoleGroupConfig, ValidatedCluster, build::properties::ConfigFileName},
     crd::{
         Container, ENV_INTERNAL_SECRET, HTTP_PORT, HTTPS_PORT, MAX_TRINO_LOG_FILES_SIZE,
-        STACKABLE_INTERNAL_TLS_DIR, STACKABLE_LOG_DIR, STACKABLE_SERVER_TLS_DIR,
-        STACKABLE_TLS_STORE_PASSWORD, TrinoRole,
+        RW_CONFIG_DIR_NAME, STACKABLE_INTERNAL_TLS_DIR, STACKABLE_LOG_DIR,
+        STACKABLE_SERVER_TLS_DIR, STACKABLE_TLS_STORE_PASSWORD, TrinoRole,
         discovery::{TrinoDiscovery, TrinoDiscoveryProtocol},
     },
 };
@@ -21,6 +21,9 @@ const HTTP_SERVER_LOG_ENABLED: &str = "http-server.log.enabled";
 // config.properties
 const COORDINATOR: &str = "coordinator";
 const DISCOVERY_URI: &str = "discovery.uri";
+// Registers event listener config files. Trino does not load `event-listener.properties` from
+// `--etc-dir`; the file must be listed here explicitly (see trinodb/trino `EventListenerManager`).
+const EVENT_LISTENER_CONFIG_FILES: &str = "event-listener.config-files";
 const HTTP_SERVER_HTTP_PORT: &str = "http-server.http.port";
 const QUERY_MAX_MEMORY: &str = "query.max-memory";
 const QUERY_MAX_MEMORY_PER_NODE: &str = "query.max-memory-per-node";
@@ -96,6 +99,19 @@ pub fn build(
         (role == TrinoRole::Coordinator).to_string(),
     );
 
+    // Register the OpenLineage event listener (coordinator only). The `event-listener.properties`
+    // file itself is built by `event_listener_properties` and lands in the read-write config dir;
+    // without this registration Trino would never load it (it does not scan `--etc-dir`).
+    if role == TrinoRole::Coordinator && cluster.cluster_config.lineage.is_some() {
+        props.insert(
+            EVENT_LISTENER_CONFIG_FILES.to_string(),
+            format!(
+                "{RW_CONFIG_DIR_NAME}/{event_listener}",
+                event_listener = ConfigFileName::EventListener
+            ),
+        );
+    }
+
     // Trino's own JSON logging output.
     props.insert(LOG_FORMAT.to_string(), "json".to_string());
     props.insert(
@@ -249,9 +265,12 @@ pub fn build(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{
-        MINIMAL_TRINO_YAML, file_auth_class, validated_cluster_from_yaml,
-        validated_cluster_from_yaml_with_auth,
+    use crate::{
+        config::lineage::ResolvedLineageConfig,
+        controller::build::properties::test_support::{
+            MINIMAL_TRINO_YAML, empty_derefs, file_auth_class, validated_cluster_from_yaml,
+            validated_cluster_from_yaml_with_auth, validated_cluster_from_yaml_with_derefs,
+        },
     };
 
     const SERVER_TLS_ONLY_YAML: &str = r#"
@@ -394,6 +413,60 @@ mod tests {
         );
     }
 
+    fn cluster_with_lineage() -> ValidatedCluster {
+        let mut derefs = empty_derefs();
+        derefs.resolved_lineage_config = Some(ResolvedLineageConfig {
+            properties: BTreeMap::new(),
+            volumes: Vec::new(),
+            volume_mounts: Vec::new(),
+            init_container_extra_start_commands: Vec::new(),
+        });
+        validated_cluster_from_yaml_with_derefs(MINIMAL_TRINO_YAML, derefs)
+    }
+
+    #[test]
+    fn coordinator_registers_openlineage_event_listener_config_file() {
+        let cluster = cluster_with_lineage();
+        let props = build(
+            &cluster,
+            TrinoRole::Coordinator,
+            &rg(&cluster, &TrinoRole::Coordinator),
+            &cluster_info(),
+        )
+        .unwrap();
+        // Trino only loads the event listener when it is registered here.
+        assert_eq!(
+            props.get(EVENT_LISTENER_CONFIG_FILES).map(String::as_str),
+            Some("/stackable/rwconfig/event-listener.properties")
+        );
+    }
+
+    #[test]
+    fn worker_does_not_register_event_listener_config_file() {
+        let cluster = cluster_with_lineage();
+        let props = build(
+            &cluster,
+            TrinoRole::Worker,
+            &rg(&cluster, &TrinoRole::Worker),
+            &cluster_info(),
+        )
+        .unwrap();
+        assert!(!props.contains_key(EVENT_LISTENER_CONFIG_FILES));
+    }
+
+    #[test]
+    fn no_event_listener_config_file_without_lineage() {
+        let cluster = validated_cluster_from_yaml(MINIMAL_TRINO_YAML);
+        let props = build(
+            &cluster,
+            TrinoRole::Coordinator,
+            &rg(&cluster, &TrinoRole::Coordinator),
+            &cluster_info(),
+        )
+        .unwrap();
+        assert!(!props.contains_key(EVENT_LISTENER_CONFIG_FILES));
+    }
+
     #[test]
     fn server_tls_only_uses_server_keystore_dir_and_http_discovery() {
         let cluster = validated_cluster_from_yaml(SERVER_TLS_ONLY_YAML);
diff --git a/rust/operator-binary/src/controller/build/properties/event_listener_properties.rs b/rust/operator-binary/src/controller/build/properties/event_listener_properties.rs
new file mode 100644
index 00000000..b36c4ce9
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/event_listener_properties.rs
@@ -0,0 +1,200 @@
+//! Builder for the coordinator's `event-listener.properties` (the Trino OpenLineage event listener).
+//!
+//! The OpenLineage event listener runs on the **coordinator only**, so this builder returns an
+//! empty map for every other role and the caller omits the file from those ConfigMaps. For the
+//! coordinator it emits the connection-derived settings resolved in [`crate::config::lineage`],
+//! adds the cluster-facing `trino.uri`, and finally merges any user `event-listener.properties`
+//! overrides (highest precedence).
+
+use std::collections::BTreeMap;
+
+use stackable_operator::utils::cluster_info::KubernetesClusterInfo;
+
+use crate::{
+    config::lineage::OPENLINEAGE_TRINO_URI_KEY,
+    controller::{TrinoRoleGroupConfig, ValidatedCluster},
+    crd::{
+        TrinoRole,
+        discovery::{TrinoDiscovery, TrinoDiscoveryProtocol},
+    },
+};
+
+/// Build the `event-listener.properties` key/value pairs.
+///
+/// Returns an empty map when OpenLineage is not configured and no user overrides are provided (and
+/// always for non-coordinator roles). Callers should omit the file from the ConfigMap in that case.
+pub fn build(
+    cluster: &ValidatedCluster,
+    role: TrinoRole,
+    rg: &TrinoRoleGroupConfig,
+    cluster_info: &KubernetesClusterInfo,
+) -> BTreeMap<String, String> {
+    let mut props = BTreeMap::new();
+
+    // Event listeners only run on the coordinator.
+    if role != TrinoRole::Coordinator {
+        return props;
+    }
+
+    if let Some(lineage) = &cluster.cluster_config.lineage {
+        // Connection-derived settings (transport type/URL, namespace and optional api-key).
+        props.extend(lineage.properties.clone());
+
+        // The URI identifying this Trino cluster in emitted lineage. Uses the same coordinator
+        // address as `discovery.uri`; the scheme follows the client-facing TLS setting.
+        if let Some(coordinator_ref) = cluster.cluster_config.coordinator_pod_refs.first() {
+            let protocol = if cluster.tls_enabled() {
+                TrinoDiscoveryProtocol::Https
+            } else {
+                TrinoDiscoveryProtocol::Http
+            };
+            let discovery = TrinoDiscovery::new(coordinator_ref, protocol);
+            props.insert(
+                OPENLINEAGE_TRINO_URI_KEY.to_string(),
+                discovery.discovery_uri(cluster_info),
+            );
+        }
+    }
+
+    // User overrides (highest precedence).
+    props.extend(rg.config_overrides.event_listener_properties.clone());
+
+    props
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use stackable_operator::utils::cluster_info::KubernetesClusterInfo;
+
+    use super::*;
+    use crate::{
+        config::lineage::{
+            EVENT_LISTENER_NAME_KEY, OPENLINEAGE_NAMESPACE_KEY, OPENLINEAGE_TRANSPORT_API_KEY_KEY,
+            OPENLINEAGE_TRANSPORT_TYPE_KEY, OPENLINEAGE_TRANSPORT_URL_KEY, ResolvedLineageConfig,
+        },
+        controller::{
+            ValidatedCluster,
+            build::properties::test_support::{MINIMAL_TRINO_YAML, empty_derefs},
+        },
+        crd::TrinoRole,
+    };
+
+    fn cluster_info() -> KubernetesClusterInfo {
+        KubernetesClusterInfo {
+            cluster_domain: "cluster.local".parse().unwrap(),
+        }
+    }
+
+    /// A resolved OpenLineage config as `config::lineage` would produce it for an inline
+    /// `http://marquez:5000` connection, optionally with a bearer-token api-key reference.
+    fn resolved_lineage(with_auth: bool) -> ResolvedLineageConfig {
+        let mut properties = BTreeMap::from([
+            (
+                EVENT_LISTENER_NAME_KEY.to_string(),
+                "openlineage".to_string(),
+            ),
+            (
+                OPENLINEAGE_TRANSPORT_TYPE_KEY.to_string(),
+                "HTTP".to_string(),
+            ),
+            (
+                OPENLINEAGE_TRANSPORT_URL_KEY.to_string(),
+                "http://marquez:5000".to_string(),
+            ),
+            (OPENLINEAGE_NAMESPACE_KEY.to_string(), "default".to_string()),
+        ]);
+        if with_auth {
+            properties.insert(
+                OPENLINEAGE_TRANSPORT_API_KEY_KEY.to_string(),
+                "${file:UTF-8:/stackable/openlineage_auth/apiKey}".to_string(),
+            );
+        }
+        ResolvedLineageConfig {
+            properties,
+            volumes: Vec::new(),
+            volume_mounts: Vec::new(),
+            init_container_extra_start_commands: Vec::new(),
+        }
+    }
+
+    fn cluster_with_lineage(with_auth: bool) -> ValidatedCluster {
+        let mut derefs = empty_derefs();
+        derefs.resolved_lineage_config = Some(resolved_lineage(with_auth));
+        crate::controller::build::properties::test_support::validated_cluster_from_yaml_with_derefs(
+            MINIMAL_TRINO_YAML,
+            derefs,
+        )
+    }
+
+    fn coordinator_rg(cluster: &ValidatedCluster) -> TrinoRoleGroupConfig {
+        cluster
+            .role_group_configs(&TrinoRole::Coordinator)
+            .values()
+            .next()
+            .unwrap()
+            .clone()
+    }
+
+    #[test]
+    fn worker_role_renders_empty() {
+        let cluster = cluster_with_lineage(false);
+        // Reuse the coordinator role group config; the role argument alone must gate emission.
+        let rg = coordinator_rg(&cluster);
+        let props = build(&cluster, TrinoRole::Worker, &rg, &cluster_info());
+        assert!(
+            props.is_empty(),
+            "event listeners must not be configured on workers"
+        );
+    }
+
+    #[test]
+    fn coordinator_without_lineage_renders_empty() {
+        let cluster =
+            crate::controller::build::properties::test_support::validated_cluster_from_yaml(
+                MINIMAL_TRINO_YAML,
+            );
+        let rg = coordinator_rg(&cluster);
+        let props = build(&cluster, TrinoRole::Coordinator, &rg, &cluster_info());
+        assert!(props.is_empty());
+    }
+
+    #[test]
+    fn coordinator_emits_listener_transport_and_trino_uri() {
+        let cluster = cluster_with_lineage(false);
+        let rg = coordinator_rg(&cluster);
+        let props = build(&cluster, TrinoRole::Coordinator, &rg, &cluster_info());
+
+        assert_eq!(props.get(EVENT_LISTENER_NAME_KEY).unwrap(), "openlineage");
+        assert_eq!(props.get(OPENLINEAGE_TRANSPORT_TYPE_KEY).unwrap(), "HTTP");
+        assert_eq!(
+            props.get(OPENLINEAGE_TRANSPORT_URL_KEY).unwrap(),
+            "http://marquez:5000"
+        );
+        assert_eq!(props.get(OPENLINEAGE_NAMESPACE_KEY).unwrap(), "default");
+        // The default Trino cluster enables server TLS, so the recorded Trino URI is https.
+        let trino_uri = props
+            .get(OPENLINEAGE_TRINO_URI_KEY)
+            .expect("trino.uri is set");
+        assert!(
+            trino_uri.starts_with("https://") && trino_uri.contains("coordinator"),
+            "trino.uri should be the coordinator address, got: {trino_uri}"
+        );
+        // No auth configured -> no api-key.
+        assert!(!props.contains_key(OPENLINEAGE_TRANSPORT_API_KEY_KEY));
+    }
+
+    #[test]
+    fn coordinator_with_auth_emits_api_key_file_reference() {
+        let cluster = cluster_with_lineage(true);
+        let rg = coordinator_rg(&cluster);
+        let props = build(&cluster, TrinoRole::Coordinator, &rg, &cluster_info());
+
+        let api_key = props.get(OPENLINEAGE_TRANSPORT_API_KEY_KEY).unwrap();
+        assert!(
+            api_key.starts_with("${file:UTF-8:"),
+            "the token must be referenced from a file, never inlined: {api_key}"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
index e461f02f..e0840da7 100644
--- a/rust/operator-binary/src/controller/build/properties/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -6,6 +6,7 @@
 
 pub mod access_control_properties;
 pub mod config_properties;
+pub mod event_listener_properties;
 pub mod exchange_manager_properties;
 pub mod log_properties;
 pub mod logging;
@@ -31,6 +32,8 @@ pub enum ConfigFileName {
     ExchangeManager,
     #[strum(serialize = "spooling-manager.properties")]
     SpoolingManager,
+    #[strum(serialize = "event-listener.properties")]
+    EventListener,
 }
 
 #[cfg(test)]
@@ -51,6 +54,7 @@ pub(crate) mod test_support {
             trino_opa_config: None,
             resolved_fte_config: None,
             resolved_client_protocol_config: None,
+            resolved_lineage_config: None,
         }
     }
 
diff --git a/rust/operator-binary/src/controller/build/resource/config_map.rs b/rust/operator-binary/src/controller/build/resource/config_map.rs
index 1a2863a5..717b4c25 100644
--- a/rust/operator-binary/src/controller/build/resource/config_map.rs
+++ b/rust/operator-binary/src/controller/build/resource/config_map.rs
@@ -17,8 +17,8 @@ use crate::{
             object_meta,
             properties::{
                 ConfigFileName, access_control_properties, config_properties,
-                exchange_manager_properties, log_properties, node_properties, product_logging,
-                security_properties, spooling_manager_properties,
+                event_listener_properties, exchange_manager_properties, log_properties,
+                node_properties, product_logging, security_properties, spooling_manager_properties,
             },
             recommended_labels_for_role_group_resources,
         },
@@ -157,7 +157,18 @@ pub fn build_rolegroup_config_map(
         );
     }
 
-    // 8. jvm.config. The role + role-group `jvmArgumentOverrides` were already merged in the
+    // 8. event-listener.properties (optional, coordinator only — the OpenLineage event listener).
+    let el = event_listener_properties::build(cluster, role.clone(), rg, cluster_info);
+    if !el.is_empty() {
+        data.insert(
+            ConfigFileName::EventListener.to_string(),
+            to_java_properties_string(el.iter()).with_context(|_| WritePropertiesSnafu {
+                file: ConfigFileName::EventListener.to_string(),
+            })?,
+        );
+    }
+
+    // 9. jvm.config. The role + role-group `jvmArgumentOverrides` were already merged in the
     // validate step and are carried by `product_specific_common_config`.
     let jvm_config = jvm::jvm_config(
         cluster.numeric_product_version,
@@ -167,7 +178,7 @@ pub fn build_rolegroup_config_map(
     .context(BuildJvmConfigSnafu)?;
     data.insert(JVM_CONFIG.to_string(), jvm_config);
 
-    // 9. Vector agent config (`vector.yaml`) if the Vector agent is enabled. The file is templated
+    // 10. Vector agent config (`vector.yaml`) if the Vector agent is enabled. The file is templated
     // with environment variables injected by the Vector container at runtime.
     if rg.config.logging.enable_vector_agent {
         data.insert(
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
index 6cd36c48..a12bc55f 100644
--- a/rust/operator-binary/src/controller/build/resource/statefulset.rs
+++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -312,7 +312,13 @@ pub fn build_rolegroup_statefulset(
             &mut cb_trino,
         )
         .context(InvalidAuthenticationConfigSnafu)?;
-    add_derived_volumes_and_mounts(cluster, &mut pod_builder, &mut cb_prepare, &mut cb_trino)?;
+    add_derived_volumes_and_mounts(
+        cluster,
+        trino_role,
+        &mut pod_builder,
+        &mut cb_prepare,
+        &mut cb_trino,
+    )?;
 
     let mut prepare_args = vec![];
     if let ValidatedContainerLogConfigChoice::Automatic(log_config) =
@@ -347,6 +353,13 @@ pub fn build_rolegroup_statefulset(
         ));
     }
 
+    // Add the OpenLineage backend CA certificate to the truststore if configured (coordinator only).
+    if trino_role == &TrinoRole::Coordinator
+        && let Some(resolved_lineage) = &cluster.cluster_config.lineage
+    {
+        prepare_args.extend(resolved_lineage.init_container_extra_start_commands.clone());
+    }
+
     let container_prepare = cb_prepare
         .image_from_product_image(resolved_product_image)
         .command(vec![
@@ -742,10 +755,11 @@ fn add_tls_volumes_and_mounts(
 }
 
 /// Adds the volumes and volume mounts whose names derive from user-supplied resources: the
-/// catalogs, fault-tolerant execution and client spooling. They may collide with each other or
-/// with the operator's own volumes, so the adds stay fallible.
+/// catalogs, fault-tolerant execution, client spooling and OpenLineage. They may collide with each
+/// other or with the operator's own volumes, so the adds stay fallible.
 fn add_derived_volumes_and_mounts(
     cluster: &ValidatedCluster,
+    trino_role: &TrinoRole,
     pod_builder: &mut PodBuilder,
     cb_prepare: &mut ContainerBuilder,
     cb_trino: &mut ContainerBuilder,
@@ -788,6 +802,22 @@ fn add_derived_volumes_and_mounts(
             .context(AddVolumeSnafu)?;
     }
 
+    // OpenLineage backend CA certificate and (when authenticated) the bearer-token Secret. The
+    // event listener runs on the coordinator only, so these are mounted there only.
+    if trino_role == &TrinoRole::Coordinator
+        && let Some(resolved_lineage) = &cluster.cluster_config.lineage
+    {
+        cb_prepare
+            .add_volume_mounts(resolved_lineage.volume_mounts.clone())
+            .context(AddVolumeMountSnafu)?;
+        cb_trino
+            .add_volume_mounts(resolved_lineage.volume_mounts.clone())
+            .context(AddVolumeMountSnafu)?;
+        pod_builder
+            .add_volumes(resolved_lineage.volumes.clone())
+            .context(AddVolumeSnafu)?;
+    }
+
     Ok(())
 }
 
diff --git a/rust/operator-binary/src/controller/dereference.rs b/rust/operator-binary/src/controller/dereference.rs
index fe7af645..8a51a40b 100644
--- a/rust/operator-binary/src/controller/dereference.rs
+++ b/rust/operator-binary/src/controller/dereference.rs
@@ -18,6 +18,7 @@ use crate::{
     config::{
         client_protocol::{self, ResolvedClientProtocolConfig},
         fault_tolerant_execution::{self, ResolvedFaultTolerantExecutionConfig},
+        lineage::{self, ResolvedLineageConfig},
     },
     crd::{
         authentication::{ResolvedAuthenticationClassRef, resolve_authentication_classes},
@@ -60,6 +61,9 @@ pub enum Error {
     #[snafu(display("failed to resolve client protocol configuration"))]
     ClientProtocolConfiguration { source: client_protocol::Error },
 
+    #[snafu(display("failed to resolve OpenLineage configuration"))]
+    OpenLineageConfiguration { source: lineage::Error },
+
     #[snafu(display("invalid OpaConfig"))]
     InvalidOpaConfig {
         source: stackable_operator::commons::opa::Error,
@@ -82,6 +86,7 @@ pub struct DereferencedObjects {
     pub trino_opa_config: Option<TrinoOpaConfig>,
     pub resolved_fte_config: Option<ResolvedFaultTolerantExecutionConfig>,
     pub resolved_client_protocol_config: Option<ResolvedClientProtocolConfig>,
+    pub resolved_lineage_config: Option<ResolvedLineageConfig>,
 }
 
 /// Fetches all Kubernetes objects referenced from the [`v1alpha1::TrinoCluster`] spec.
@@ -155,6 +160,15 @@ pub async fn dereference(
         None => None,
     };
 
+    let resolved_lineage_config = match trino.spec.cluster_config.lineage.as_ref() {
+        Some(lineage) => Some(
+            ResolvedLineageConfig::from_config(lineage, client, namespace.as_ref())
+                .await
+                .context(OpenLineageConfigurationSnafu)?,
+        ),
+        None => None,
+    };
+
     Ok(DereferencedObjects {
         resolved_authentication_classes,
         catalog_definitions,
@@ -162,6 +176,7 @@ pub async fn dereference(
         trino_opa_config,
         resolved_fte_config,
         resolved_client_protocol_config,
+        resolved_lineage_config,
     })
 }
 
diff --git a/rust/operator-binary/src/controller/mod.rs b/rust/operator-binary/src/controller/mod.rs
index 84f5645f..55cc756a 100644
--- a/rust/operator-binary/src/controller/mod.rs
+++ b/rust/operator-binary/src/controller/mod.rs
@@ -34,6 +34,7 @@ use crate::{
     config::{
         client_protocol::ResolvedClientProtocolConfig,
         fault_tolerant_execution::ResolvedFaultTolerantExecutionConfig,
+        lineage::ResolvedLineageConfig,
     },
     crd::{TrinoRole, catalog::TrinoCatalogName, discovery::TrinoPodRef, v1alpha1},
     trino_controller::PRODUCT_NAME,
@@ -116,6 +117,7 @@ pub struct ValidatedClusterConfig {
     pub authorization: Option<TrinoOpaConfig>,
     pub fault_tolerant_execution: Option<ResolvedFaultTolerantExecutionConfig>,
     pub client_protocol: Option<ResolvedClientProtocolConfig>,
+    pub lineage: Option<ResolvedLineageConfig>,
     pub coordinator_pod_refs: Vec<TrinoPodRef>,
     pub catalogs: BTreeMap<TrinoCatalogName, CatalogConfig>,
 }
@@ -472,6 +474,7 @@ pub(crate) fn validated_cluster() -> ValidatedCluster {
         trino_opa_config: None,
         resolved_fte_config: None,
         resolved_client_protocol_config: None,
+        resolved_lineage_config: None,
     };
     let operator_env = OperatorEnvironmentOptions {
         operator_namespace: "stackable-operators".to_string(),
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index f6dc77dd..0a674116 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -268,6 +268,7 @@ pub fn validate(
         authorization: dereferenced_objects.trino_opa_config.clone(),
         fault_tolerant_execution: dereferenced_objects.resolved_fte_config.clone(),
         client_protocol: dereferenced_objects.resolved_client_protocol_config.clone(),
+        lineage: dereferenced_objects.resolved_lineage_config.clone(),
         coordinator_pod_refs: trino.coordinator_pods(&namespace).collect(),
         catalogs,
     };
@@ -386,6 +387,7 @@ pub(crate) fn merged_role_group_config(
         trino_opa_config: None,
         resolved_fte_config: None,
         resolved_client_protocol_config: None,
+        resolved_lineage_config: None,
     };
     let role_groups = match trino_role {
         TrinoRole::Coordinator => {
@@ -427,6 +429,7 @@ mod tests {
             trino_opa_config: None,
             resolved_fte_config: None,
             resolved_client_protocol_config: None,
+            resolved_lineage_config: None,
         }
     }
 
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index c567fd42..97d6de29 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -22,7 +22,7 @@ use stackable_operator::{
     },
     config::{fragment::Fragment, merge::Merge},
     constant,
-    crd::authentication::core,
+    crd::{authentication::core, openlineage},
     deep_merger::ObjectOverrides,
     k8s_openapi::apimachinery::pkg::{api::resource::Quantity, apis::meta::v1::LabelSelector},
     kube::{CustomResource, ResourceExt},
@@ -93,6 +93,10 @@ constant!(pub ENV_INTERNAL_SECRET: EnvVarName = "INTERNAL_SECRET");
 constant!(pub INTERNAL_SECRET_SECRET_KEY: SecretKey = "INTERNAL_SECRET");
 constant!(pub ENV_SPOOLING_SECRET: EnvVarName = "SPOOLING_SECRET");
 constant!(pub SPOOLING_SECRET_SECRET_KEY: SecretKey = "SPOOLING_SECRET");
+// OpenLineage
+/// Fixed key that must hold the OpenLineage HTTP transport bearer token inside the Secret named by
+/// `credentialsSecretName` on the connection used in `spec.clusterConfig.lineage`.
+pub const OPENLINEAGE_AUTH_SECRET_KEY: &str = "apiKey";
 // TLS
 constant!(TLS_DEFAULT_SECRET_CLASS: SecretClassName = "tls");
 // Listener
@@ -205,6 +209,10 @@ pub mod versioned {
         // File name defined in [`crate::controller::build::properties::ConfigFileName`]
         #[serde(default, rename = "spooling-manager.properties")]
         pub spooling_manager_properties: KeyValueConfigOverrides,
+
+        // File name defined in [`crate::controller::build::properties::ConfigFileName`]
+        #[serde(default, rename = "event-listener.properties")]
+        pub event_listener_properties: KeyValueConfigOverrides,
     }
 
     #[derive(Clone, Debug, Default, Fragment, JsonSchema, PartialEq)]
@@ -285,6 +293,11 @@ pub mod versioned {
         #[serde(skip_serializing_if = "Option::is_none")]
         pub client_protocol: Option<client_protocol::ClientProtocolConfig>,
 
+        /// Emit [OpenLineage](https://openlineage.io/) lineage events for the queries run on this
+        /// Trino cluster.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub lineage: Option<TrinoLineageConfig>,
+
         /// Name of the Vector aggregator [discovery ConfigMap](DOCS_BASE_URL_PLACEHOLDER/concepts/service_discovery).
         /// It must contain the key `ADDRESS` with the address of the Vector aggregator.
         /// Follow the [logging tutorial](DOCS_BASE_URL_PLACEHOLDER/tutorials/logging-vector-aggregator)
@@ -293,6 +306,19 @@ pub mod versioned {
         pub vector_aggregator_config_map_name: Option<ConfigMapName>,
     }
 
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct TrinoLineageConfig {
+        // no doc - it's in the struct.
+        #[serde(flatten)]
+        pub open_lineage: openlineage::v1alpha1::OpenLineageConfig,
+
+        /// Format of the OpenLineage job name emitted for each query. Accepts an arbitrary string
+        /// with optional `$QUERY_ID`, `$USER`, `$SOURCE` and `$CLIENT_IP` substitution variables.
+        #[serde(default = "TrinoLineageConfig::default_job_name_format")]
+        pub job_name_format: String,
+    }
+
     #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub enum TrinoAuthorization {
@@ -362,6 +388,12 @@ pub mod versioned {
     }
 }
 
+impl v1alpha1::TrinoLineageConfig {
+    pub fn default_job_name_format() -> String {
+        "$QUERY_ID".to_string()
+    }
+}
+
 impl v1alpha1::TrinoAuthorizationOpaConfig {
     pub fn enabled_column_masking_default() -> bool {
         true
@@ -858,6 +890,53 @@ mod tests {
         assert_eq!(server_secret_class(&trino), Some("simple-trino-server-tls"));
     }
 
+    #[test]
+    fn lineage_config_is_flattened() {
+        let input = r#"
+        apiVersion: trino.stackable.tech/v1alpha1
+        kind: TrinoCluster
+        metadata:
+          name: simple-trino
+        spec:
+          image:
+            productVersion: "481"
+          coordinators:
+            roleGroups:
+              default:
+                replicas: 1
+          workers:
+            roleGroups:
+              default:
+                replicas: 1
+          clusterConfig:
+            catalogLabelSelector: {}
+            lineage:
+              connection:
+                reference: marquez
+              namespace: trino-lineage
+              jobNameFormat: trino-$QUERY_ID
+        "#;
+        let trino: v1alpha1::TrinoCluster =
+            serde_yaml::from_str(input).expect("illegal test input");
+        let lineage = trino
+            .spec
+            .cluster_config
+            .lineage
+            .expect("lineage is configured");
+        assert_eq!(lineage.open_lineage.namespace, "trino-lineage");
+        assert_eq!(lineage.job_name_format, "trino-$QUERY_ID");
+    }
+
+    #[test]
+    fn lineage_job_name_format_defaults_to_query_id() {
+        let lineage: v1alpha1::TrinoLineageConfig = serde_yaml::from_str(indoc::indoc! {"
+            connection:
+              reference: marquez
+        "})
+        .expect("illegal test input");
+        assert_eq!(lineage.job_name_format, "$QUERY_ID");
+    }
+
     impl RoundtripTestData for v1alpha1::TrinoClusterSpec {
         fn roundtrip_test_data() -> Vec<Self> {
             stackable_operator::utils::yaml_from_str_singleton_map(indoc::indoc! {r#"
@@ -901,6 +980,11 @@ mod tests {
                             - s3://exchange-bucket/
                           connection:
                             reference: minio
+                  lineage:
+                    connection:
+                      reference: marquez
+                    namespace: trino-lineage
+                    jobNameFormat: trino-$QUERY_ID
                   vectorAggregatorConfigMapName: vector-aggregator-discovery
                 coordinators:
                   config:
diff --git a/rust/operator-binary/src/trino_controller.rs b/rust/operator-binary/src/trino_controller.rs
index 9f8f92a7..be02a3e5 100644
--- a/rust/operator-binary/src/trino_controller.rs
+++ b/rust/operator-binary/src/trino_controller.rs
@@ -247,6 +247,7 @@ mod tests {
             trino_opa_config,
             resolved_fte_config,
             resolved_client_protocol_config,
+            resolved_lineage_config: None,
         };
 
         let operator_env = OperatorEnvironmentOptions {
@@ -476,6 +477,7 @@ mod tests {
             trino_opa_config: None,
             resolved_fte_config: None,
             resolved_client_protocol_config: None,
+            resolved_lineage_config: None,
         };
         let operator_env = OperatorEnvironmentOptions {
             operator_namespace: "stackable-operators".to_string(),
diff --git a/tests/templates/kuttl/openlineage/00-install-vector-aggregator-discovery-configmap.yaml.j2 b/tests/templates/kuttl/openlineage/00-install-vector-aggregator-discovery-configmap.yaml.j2
new file mode 100644
index 00000000..2d6a0df5
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/00-install-vector-aggregator-discovery-configmap.yaml.j2
@@ -0,0 +1,9 @@
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-aggregator-discovery
+data:
+  ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }}
+{% endif %}
diff --git a/tests/templates/kuttl/openlineage/00-patch-ns.yaml.j2 b/tests/templates/kuttl/openlineage/00-patch-ns.yaml.j2
new file mode 100644
index 00000000..67185acf
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/00-patch-ns.yaml.j2
@@ -0,0 +1,9 @@
+{% if test_scenario['values']['openshift'] == 'true' %}
+# see https://github.com/stackabletech/issues/issues/566
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: kubectl patch namespace $NAMESPACE -p '{"metadata":{"labels":{"pod-security.kubernetes.io/enforce":"privileged"}}}'
+    timeout: 120
+{% endif %}
diff --git a/tests/templates/kuttl/openlineage/00-rbac.yaml.j2 b/tests/templates/kuttl/openlineage/00-rbac.yaml.j2
new file mode 100644
index 00000000..9cbf0351
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/00-rbac.yaml.j2
@@ -0,0 +1,29 @@
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+rules:
+{% if test_scenario['values']['openshift'] == "true" %}
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["privileged"]
+    verbs: ["use"]
+{% endif %}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: integration-tests-sa
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+subjects:
+  - kind: ServiceAccount
+    name: integration-tests-sa
+roleRef:
+  kind: Role
+  name: use-integration-tests-scc
+  apiGroup: rbac.authorization.k8s.io
diff --git a/tests/templates/kuttl/openlineage/01-assert.yaml b/tests/templates/kuttl/openlineage/01-assert.yaml
new file mode 100644
index 00000000..8f5f9b3e
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/01-assert.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openlineage-receiver
+status:
+  readyReplicas: 1
+  replicas: 1
diff --git a/tests/templates/kuttl/openlineage/01-install-receiver.yaml.j2 b/tests/templates/kuttl/openlineage/01-install-receiver.yaml.j2
new file mode 100644
index 00000000..8ec0cc6b
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/01-install-receiver.yaml.j2
@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  # `envsubst` injects the kuttl-assigned $NAMESPACE (only $NAMESPACE, so the nginx config's own
+  # `$` tokens are left untouched) into the SecretClass name / cert scope.
+  - script: envsubst '$NAMESPACE' < 01_receiver.yaml | kubectl apply -n $NAMESPACE -f -
diff --git a/tests/templates/kuttl/openlineage/01_receiver.yaml.j2 b/tests/templates/kuttl/openlineage/01_receiver.yaml.j2
new file mode 100644
index 00000000..2bdb3ccd
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/01_receiver.yaml.j2
@@ -0,0 +1,163 @@
+# Lightweight OpenLineage receiver.
+#
+# Instead of a full Marquez, this is a plain nginx that accepts the OpenLineage HTTP transport's
+# `POST /api/v1/lineage` requests and persists each request body as a flat file. The assertion in
+# `05-assert.yaml` then greps those files to prove events were delivered (and, in the TLS scenario,
+# that the coordinator trusted the secret-operator-issued server cert end-to-end).
+#
+# nginx cannot write a request body to disk on a `return` (the body is discarded), so the receive
+# location sets `client_body_in_file_only on` and `proxy_pass`es to a local sink server; nginx then
+# buffers the full body to a file (kept, not cleaned) before forwarding. Bodies land in
+# `/tmp/lineage/`.
+#
+# `$NAMESPACE` is substituted by the `01-install-receiver` step via `envsubst` (kuttl assigns the
+# namespace at run time; beku leaves the literal in place).
+{% if test_scenario['values']['openlineage-use-tls'] == 'true' %}
+---
+# A genuine autoTls SecretClass: the secret operator generates the CA and issues the nginx server
+# cert. Suffixed with the (cluster-scoped) namespace to avoid collisions across parallel scenarios.
+apiVersion: secrets.stackable.tech/v1alpha1
+kind: SecretClass
+metadata:
+  name: openlineage-tls-$NAMESPACE
+spec:
+  backend:
+    autoTls:
+      ca:
+        autoGenerate: true
+        secret:
+          name: openlineage-tls-ca
+          namespace: $NAMESPACE
+{% endif %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: openlineage-receiver-config
+data:
+  nginx.conf: |
+    worker_processes  1;
+    error_log  /dev/stderr notice;
+    pid        /tmp/nginx.pid;
+    events { worker_connections 1024; }
+    http {
+      access_log            /dev/stdout;
+      client_body_temp_path /tmp/nginx-body;
+      proxy_temp_path       /tmp/nginx-proxy;
+      fastcgi_temp_path     /tmp/nginx-fastcgi;
+      uwsgi_temp_path       /tmp/nginx-uwsgi;
+      scgi_temp_path        /tmp/nginx-scgi;
+
+      # Internal sink: acknowledges the forwarded lineage event.
+      server {
+        listen 127.0.0.1:8080;
+        location / { return 201; }
+      }
+
+      server {
+        listen 5000{% if test_scenario['values']['openlineage-use-tls'] == 'true' %} ssl{% endif %};
+{% if test_scenario['values']['openlineage-use-tls'] == 'true' %}
+        ssl_certificate     /stackable/tls/tls.crt;
+        ssl_certificate_key /stackable/tls/tls.key;
+{% endif %}
+        client_max_body_size 16m;
+
+        # Persist each OpenLineage event body to /tmp/lineage/, then acknowledge via the sink.
+        location = /api/v1/lineage {
+{% if test_scenario['values']['openlineage-use-auth'] == 'true' %}
+          # Require the bearer token the operator wires in from the credentialsSecretName Secret.
+          # Without a valid token nginx returns 401 and never persists a body, so the 05-assert
+          # event checks only pass if the coordinator actually authenticated.
+          if ($http_authorization != "Bearer openlineage-test-token") { return 401; }
+{% endif %}
+          client_body_in_file_only on;
+          client_body_temp_path    /tmp/lineage;
+          proxy_pass http://127.0.0.1:8080;
+        }
+
+        location / { return 204; }
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openlineage-receiver
+  labels:
+    app: openlineage-receiver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: openlineage-receiver
+  template:
+    metadata:
+      labels:
+        app: openlineage-receiver
+    spec:
+{% if test_scenario['values']['openshift'] != 'true' %}
+      # On plain Kubernetes, make mounted emptyDirs writable by the nginx-unprivileged group (101).
+      # On OpenShift this is omitted so the restricted SCC can assign an fsGroup from the project range.
+      securityContext:
+        fsGroup: 101
+{% endif %}
+      containers:
+        - name: nginx
+          image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
+          ports:
+            - containerPort: 5000
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+            - name: tmp
+              mountPath: /tmp
+{% if test_scenario['values']['openlineage-use-tls'] == 'true' %}
+            - name: tls
+              mountPath: /stackable/tls
+{% endif %}
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 128Mi
+      volumes:
+        - name: config
+          configMap:
+            name: openlineage-receiver-config
+        - name: tmp
+          emptyDir: {}
+{% if test_scenario['values']['openlineage-use-tls'] == 'true' %}
+        - name: tls
+          ephemeral:
+            volumeClaimTemplate:
+              metadata:
+                annotations:
+                  secrets.stackable.tech/class: openlineage-tls-$NAMESPACE
+                  # `service` scope puts openlineage-receiver.<ns>.svc.cluster.local in the cert SANs,
+                  # which is exactly the host the Trino coordinator dials (see the TrinoCluster).
+                  secrets.stackable.tech/scope: service=openlineage-receiver
+                  secrets.stackable.tech/format: tls-pem
+              spec:
+                accessModes: ["ReadWriteOnce"]
+                resources:
+                  requests:
+                    storage: "1"
+                storageClassName: secrets.stackable.tech
+{% endif %}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openlineage-receiver
+  labels:
+    app: openlineage-receiver
+spec:
+  selector:
+    app: openlineage-receiver
+  ports:
+    - name: http
+      port: 5000
+      targetPort: 5000
diff --git a/tests/templates/kuttl/openlineage/02-assert.yaml b/tests/templates/kuttl/openlineage/02-assert.yaml
new file mode 100644
index 00000000..da1a5508
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/02-assert.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 600
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: trino-openlineage-coordinator-default
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: trino-openlineage-worker-default
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCatalog
+metadata:
+  name: tpch
diff --git a/tests/templates/kuttl/openlineage/02-install-trino.yaml.j2 b/tests/templates/kuttl/openlineage/02-install-trino.yaml.j2
new file mode 100644
index 00000000..ae1b71ce
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/02-install-trino.yaml.j2
@@ -0,0 +1,8 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  # `envsubst` injects the kuttl-assigned $NAMESPACE into the (cluster-scoped) SecretClass /
+  # references, so parallel scenarios do not collide.
+  - script: envsubst '$NAMESPACE' < 02_trino.yaml | kubectl apply -n $NAMESPACE -f -
+    timeout: 120
diff --git a/tests/templates/kuttl/openlineage/02_trino.yaml.j2 b/tests/templates/kuttl/openlineage/02_trino.yaml.j2
new file mode 100644
index 00000000..32cef43a
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/02_trino.yaml.j2
@@ -0,0 +1,92 @@
+{% if test_scenario['values']['openlineage-use-auth'] == 'true' %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openlineage-token
+stringData:
+  # The operator resolves this into the OpenLineage HTTP transport `api-key`; the nginx receiver
+  # requires exactly `Authorization: Bearer openlineage-test-token`.
+  apiKey: "openlineage-test-token"
+{% endif %}
+---
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCluster
+metadata:
+  name: trino-openlineage
+spec:
+  image:
+{% if test_scenario['values']['trino-latest'].find(",") > 0 %}
+    custom: "{{ test_scenario['values']['trino-latest'].split(',')[1] }}"
+    productVersion: "{{ test_scenario['values']['trino-latest'].split(',')[0] }}"
+{% else %}
+    productVersion: "{{ test_scenario['values']['trino-latest'] }}"
+{% endif %}
+    pullPolicy: IfNotPresent
+  clusterConfig:
+    catalogLabelSelector:
+      matchLabels:
+        trino: trino-openlineage
+    lineage:
+      connection:
+        inline:
+          http:
+            # Use the full service FQDN: with TLS the backend's secret-operator cert only carries the
+            # `openlineage-receiver.<ns>.svc.cluster.local` SAN, so a shorter host fails verification.
+            host: openlineage-receiver.$NAMESPACE.svc.cluster.local
+            port: 5000
+{% if test_scenario['values']['openlineage-use-tls'] == 'true' %}
+            tls:
+              verification:
+                server:
+                  caCert:
+                    secretClass: openlineage-tls-$NAMESPACE
+{% endif %}
+{% if test_scenario['values']['openlineage-use-auth'] == 'true' %}
+            credentialsSecretName: openlineage-token
+{% endif %}
+      # Sets openlineage-event-listener.job.name-format (asserted in 03-assert.yaml).
+      jobNameFormat: "trino-$QUERY_ID"
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+    vectorAggregatorConfigMapName: vector-aggregator-discovery
+{% endif %}
+  coordinators:
+    config:
+      logging:
+        enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+    roleGroups:
+      default:
+        replicas: 1
+        config: {}
+  workers:
+    config:
+      gracefulShutdownTimeout: 5s # Let the test run faster
+      logging:
+        enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+    roleGroups:
+      default:
+        replicas: 1
+        config: {}
+---
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCatalog
+metadata:
+  name: tpch
+  labels:
+    trino: trino-openlineage
+spec:
+  connector:
+    tpch: {}
+---
+# A writable target so the test can run a CREATE TABLE AS SELECT. The OpenLineage event listener
+# only emits for data-modifying query types (INSERT/DATA_DEFINITION/...); a plain SELECT is filtered
+# out by the plugin's default `include-query-types`.
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCatalog
+metadata:
+  name: blackhole
+  labels:
+    trino: trino-openlineage
+spec:
+  connector:
+    blackHole: {}
diff --git a/tests/templates/kuttl/openlineage/03-assert.yaml b/tests/templates/kuttl/openlineage/03-assert.yaml
new file mode 100644
index 00000000..aaceb97d
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/03-assert.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+commands:
+  # The coordinator ConfigMap must carry a generated event-listener.properties selecting the
+  # OpenLineage plugin and pointing at the receiver, and config.properties must register that file
+  # (Trino does not load it from --etc-dir otherwise).
+  - script: |
+      CM=$(kubectl get -n "$NAMESPACE" configmap trino-openlineage-coordinator-default -o yaml)
+      echo "$CM" | grep -q "event-listener.properties"
+      echo "$CM" | grep -q "event-listener.name=openlineage"
+      echo "$CM" | grep -q "openlineage-event-listener.transport.url"
+      echo "$CM" | grep -q "openlineage-event-listener.transport.endpoint=/api/v1/lineage"
+      echo "$CM" | grep -q "event-listener.config-files=/stackable/rwconfig/event-listener.properties"
+      # jobNameFormat maps to the OpenLineage job name format.
+      echo "$CM" | grep -q "openlineage-event-listener.job.name-format=trino-"
+  # Workers must NOT get an event listener configured.
+  - script: |
+      ! kubectl get -n "$NAMESPACE" configmap trino-openlineage-worker-default -o yaml | grep -q "event-listener.properties"
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: trino-test-helper
+status:
+  readyReplicas: 1
+  replicas: 1
diff --git a/tests/templates/kuttl/openlineage/03-install-test-helper.yaml b/tests/templates/kuttl/openlineage/03-install-test-helper.yaml
new file mode 100644
index 00000000..ff0d29e6
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/03-install-test-helper.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: trino-test-helper
+  labels:
+    app: trino-test-helper
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: trino-test-helper
+  template:
+    metadata:
+      labels:
+        app: trino-test-helper
+    spec:
+      serviceAccount: integration-tests-sa
+      containers:
+        - name: trino-test-helper
+          image: oci.stackable.tech/sdp/testing-tools/trino:0.3.0-stackable0.0.0-dev
+          command: ["sleep", "infinity"]
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "64Mi"
+            limits:
+              cpu: "250m"
+              memory: "64Mi"
diff --git a/tests/templates/kuttl/openlineage/04-run-query.yaml b/tests/templates/kuttl/openlineage/04-run-query.yaml
new file mode 100644
index 00000000..4d4b4d9f
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/04-run-query.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: kubectl cp -n $NAMESPACE 04_emit_lineage.py trino-test-helper-0:/tmp/
+  - script: kubectl exec -n $NAMESPACE trino-test-helper-0 -- python /tmp/04_emit_lineage.py -c trino-openlineage-coordinator
+    timeout: 120
diff --git a/tests/templates/kuttl/openlineage/04_emit_lineage.py b/tests/templates/kuttl/openlineage/04_emit_lineage.py
new file mode 100644
index 00000000..b6bd3a44
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/04_emit_lineage.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+"""Run a data-modifying query against Trino so the OpenLineage event listener emits lineage events.
+
+A plain SELECT is filtered out by the plugin's default `include-query-types`; a CREATE TABLE AS
+SELECT (INSERT / DATA_DEFINITION) is emitted, with `tpch.tiny.nation` as the input dataset and the
+blackhole table as the output dataset.
+"""
+
+import argparse
+
+import trino
+
+
+def get_connection(coordinator):
+    return trino.dbapi.connect(
+        host=coordinator,
+        port=8443,
+        user="test",
+        http_scheme="https",
+        verify=False,
+        session_properties={"query_max_execution_time": "60s"},
+    )
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "-c",
+        "--coordinator",
+        required=True,
+        help="Trino Coordinator Host to connect to",
+    )
+    args = vars(parser.parse_args())
+
+    conn = get_connection(args["coordinator"])
+    cursor = conn.cursor()
+
+    cursor.execute("CREATE SCHEMA IF NOT EXISTS blackhole.lineage_test")
+    cursor.fetchall()
+    cursor.execute("DROP TABLE IF EXISTS blackhole.lineage_test.nation_copy")
+    cursor.fetchall()
+    cursor.execute(
+        "CREATE TABLE blackhole.lineage_test.nation_copy AS SELECT * FROM tpch.tiny.nation"
+    )
+    result = cursor.fetchone()
+    assert result[0] == 25, f"unexpected CTAS row count: {result[0]}"
+    print("CTAS executed, OpenLineage events should have been emitted")
diff --git a/tests/templates/kuttl/openlineage/05-assert.yaml b/tests/templates/kuttl/openlineage/05-assert.yaml
new file mode 100644
index 00000000..2506144c
--- /dev/null
+++ b/tests/templates/kuttl/openlineage/05-assert.yaml
@@ -0,0 +1,15 @@
+---
+# Verify the OpenLineage events actually reached the receiver. In the TLS scenario this also proves
+# the coordinator trusted the secret-operator-issued cert end-to-end (a failed handshake would mean
+# no body files were written); in the auth scenario it proves the coordinator sent the bearer token
+# (without it nginx returns 401 and persists nothing).
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 180
+commands:
+  - script: |
+      POD=$(kubectl get -n "$NAMESPACE" pod -l app=openlineage-receiver -o jsonpath='{.items[0].metadata.name}')
+      # At least one lineage event body was persisted, referencing the CTAS output dataset ...
+      kubectl exec -n "$NAMESPACE" "$POD" -- sh -c 'cat /tmp/lineage/* 2>/dev/null | grep -q "nation_copy"'
+      # ... and a COMPLETE run event was received (the query finished and reported lineage).
+      kubectl exec -n "$NAMESPACE" "$POD" -- sh -c 'cat /tmp/lineage/* 2>/dev/null | grep -q "COMPLETE"'
diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml
index 4ad606fb..775de99e 100644
--- a/tests/test-definition.yaml
+++ b/tests/test-definition.yaml
@@ -71,6 +71,14 @@ dimensions:
     values:
       - "false"
       - "true"
+  - name: openlineage-use-tls
+    values:
+      - "false"
+      - "true"
+  - name: openlineage-use-auth
+    values:
+      - "false"
+      - "true"
   - name: openshift
     values:
       - "false"
@@ -128,6 +136,12 @@ tests:
       # Long term we should test all versions
       - trino-latest
       - openshift
+  - name: openlineage
+    dimensions:
+      - trino-latest
+      - openlineage-use-tls
+      - openlineage-use-auth
+      - openshift
   - name: listener
     dimensions:
       - trino