diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2480828..5ed09f9 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -68,10 +68,10 @@ jobs:
     needs: changes
     steps:
       - uses: actions/checkout@v7
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -105,10 +105,10 @@ jobs:
     needs: changes
     steps:
       - uses: actions/checkout@v7
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -130,10 +130,10 @@ jobs:
     needs: changes
     steps:
       - uses: actions/checkout@v7
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.docker == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -177,10 +177,10 @@ jobs:
     needs: changes
     steps:
       - uses: actions/checkout@v7
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: needs.changes.outputs.docs == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           policy_allow: "true"
       - name: Cache Go + aqua tools
         if: needs.changes.outputs.docs == 'true'
@@ -212,10 +212,10 @@ jobs:
       - uses: actions/checkout@v7
       # helm is pinned in aqua.yaml (v4 line) and resolved from $PATH; the
       # helm-unittest plugin is installed into it below.
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: needs.changes.outputs.chart == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 6d07710..06342a2 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -78,10 +78,10 @@ jobs:
       # first use. The warmup step below fetches just the e2e tools up front
       # (fail-fast + clear logs) without building the unrelated
       # gopls/golangci-lint/setup-envtest/terraform packages.
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         if: steps.changes.outputs.run == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml
index 78d9daa..a1c7a62 100644
--- a/.github/workflows/pages.yaml
+++ b/.github/workflows/pages.yaml
@@ -37,9 +37,9 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           policy_allow: "true"
       - name: Cache Go + aqua tools
         uses: actions/cache@v6
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4ddc15e..e945ea2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -132,9 +132,9 @@ jobs:
       attestations: write  # actions/attest-build-provenance
     steps:
       - uses: actions/checkout@v7
-      - uses: aquaproj/aqua-installer@v4.0.5
+      - uses: aquaproj/aqua-installer@v4.1.1
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.65.2
           policy_allow: "true"
       - name: Package chart
         run: helm package "${CHART_DIR}" --destination dist