diff --git a/git_pull/CHANGELOG.md b/git_pull/CHANGELOG.md
index 8f9a97baa..b74c589fb 100644
--- a/git_pull/CHANGELOG.md
+++ b/git_pull/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 9.0.3
+
+- Fix `git-clone`'s restore-after-clone step copying a stale/corrupt `.git`
+  directory from the pre-clone backup into the freshly cloned repository,
+  which could corrupt the new clone's git metadata. `.git` is now excluded
+  from that restore step, same as `*.yaml`/`*.yml`.
+
+## 9.0.2
+
+- Fix `.storage/` and other hidden files/directories being silently dropped from
+  the pre-clone backup (they were never restored after the initial clone into
+  an existing `/config`, because `cp -rf /config/*` does **not** match dotfiles).
+  Use `cp -rf /config/.` instead, which copies directory contents including
+  hidden entries.
+
 ## 9.0.1
 
 - Replace eval+extglob with find for restoring non-YAML files after clone
diff --git a/git_pull/config.yaml b/git_pull/config.yaml
index 44021d12a..278b68266 100644
--- a/git_pull/config.yaml
+++ b/git_pull/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 9.0.1
+version: 9.0.3
 slug: git_pull
 name: Git pull
 description: Simple git pull to update the local configuration
diff --git a/git_pull/data/run.sh b/git_pull/data/run.sh
index e5e1bd2cc..681540af3 100755
--- a/git_pull/data/run.sh
+++ b/git_pull/data/run.sh
@@ -47,7 +47,7 @@ function git-clone {
     bashio::log.info "[Info] Backup configuration to $BACKUP_LOCATION"
 
     mkdir "${BACKUP_LOCATION}" || bashio::exit.nok "[Error] Creation of backup directory failed"
-    cp -rf /config/* "${BACKUP_LOCATION}" || bashio::exit.nok "[Error] Copy files to backup directory failed"
+    cp -rf /config/. "${BACKUP_LOCATION}/" || bashio::exit.nok "[Error] Copy files to backup directory failed"
 
     # remove config folder content
     rm -rf /config/{,.[!.],..?}* || bashio::exit.nok "[Error] Clearing /config failed"
@@ -56,8 +56,8 @@ function git-clone {
     bashio::log.info "[Info] Start git clone"
     git clone "$REPOSITORY" /config || bashio::exit.nok "[Error] Git clone failed"
 
-    # try to copy non-yaml files back
-    find "${BACKUP_LOCATION}" -maxdepth 1 -mindepth 1 ! -name "*.yaml" ! -name "*.yml" -exec cp -r {} /config/ \; 2>/dev/null || true
+    # try to copy non-yaml files back (also excluding '.git' as it can corrupt the new repository)
+    find "${BACKUP_LOCATION}" -maxdepth 1 -mindepth 1 ! -name "*.yaml" ! -name "*.yml" ! -name ".git" -exec cp -r {} /config/ \; 2>/dev/null || true
 
     # try to copy secrets file back
     cp "${BACKUP_LOCATION}/secrets.yaml" /config 2>/dev/null || true
diff --git a/speech_to_phrase/CHANGELOG.md b/speech_to_phrase/CHANGELOG.md
index 4faf49928..4e1aec6f6 100644
--- a/speech_to_phrase/CHANGELOG.md
+++ b/speech_to_phrase/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.4.4
+
+- Upgrade base image to trixie
+- Update speech recognition components to their latest versions
+- Disable ONNX Runtime telemetry: newer versions send usage data to a
+  Microsoft server by default, this app keeps it turned off
+
 ## 1.4.3
 
 - Fix for empty names in HA 2026.4
diff --git a/speech_to_phrase/Dockerfile b/speech_to_phrase/Dockerfile
index 7e7d7db34..522646eed 100644
--- a/speech_to_phrase/Dockerfile
+++ b/speech_to_phrase/Dockerfile
@@ -6,7 +6,10 @@ ARG BUILD_ARCH
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install speech-to-phrase
-ARG SPEECH_TO_PHRASE_VERSION
+ARG \
+    SPEECH_TO_PHRASE_VERSION \
+    ONNXRUNTIME_VERSION \
+    PYSILERO_VAD_VERSION
 WORKDIR /usr/src
 
 RUN mkdir -p ./tools
@@ -31,11 +34,15 @@ RUN \
     && python3 -m venv .venv \
     && .venv/bin/pip3 install --no-cache-dir \
         "speech-to-phrase @ https://github.com/OHF-Voice/speech-to-phrase/archive/refs/tags/v${SPEECH_TO_PHRASE_VERSION}.tar.gz" \
+        "onnxruntime==${ONNXRUNTIME_VERSION}" \
+        "pysilero-vad==${PYSILERO_VAD_VERSION}" \
     && apt-get remove --yes build-essential \
     && apt-get autoclean \
     && apt-get purge \
     && rm -rf /var/lib/apt/lists/*
 
+ENV ORT_DISABLE_TELEMETRY=1
+
 WORKDIR /
 COPY rootfs /
 
diff --git a/speech_to_phrase/build.yaml b/speech_to_phrase/build.yaml
index 32642f89b..ced84d7fd 100644
--- a/speech_to_phrase/build.yaml
+++ b/speech_to_phrase/build.yaml
@@ -1,6 +1,8 @@
 ---
 build_from:
-  amd64: ghcr.io/home-assistant/amd64-base-debian:bookworm
-  aarch64: ghcr.io/home-assistant/aarch64-base-debian:bookworm
+  amd64: ghcr.io/home-assistant/amd64-base-debian:trixie
+  aarch64: ghcr.io/home-assistant/aarch64-base-debian:trixie
 args:
   SPEECH_TO_PHRASE_VERSION: 1.4.3
+  ONNXRUNTIME_VERSION: 1.29.0
+  PYSILERO_VAD_VERSION: 2.1.1
diff --git a/speech_to_phrase/config.yaml b/speech_to_phrase/config.yaml
index e31aa22c5..8a04ffa03 100644
--- a/speech_to_phrase/config.yaml
+++ b/speech_to_phrase/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 1.4.3
+version: 1.4.4
 slug: speech-to-phrase
 name: Speech-to-Phrase
 description: Fast and personalized local speech-to-text
diff --git a/whisper/CHANGELOG.md b/whisper/CHANGELOG.md
index 1970b2d9e..c2182f0a8 100644
--- a/whisper/CHANGELOG.md
+++ b/whisper/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 3.5.2
+
+- Update speech recognition components to their latest versions
+- Disable ONNX Runtime telemetry: newer versions send usage data to a
+  Microsoft server by default, this app keeps it turned off
+
 ## 3.5.1.
 
 - Upgrade base image to trixie
diff --git a/whisper/Dockerfile b/whisper/Dockerfile
index 0e0f69d42..7ed3a0f85 100644
--- a/whisper/Dockerfile
+++ b/whisper/Dockerfile
@@ -3,7 +3,17 @@ FROM ${BUILD_FROM}
 
 # Install Whisper
 WORKDIR /usr/src
-ARG WYOMING_WHISPER_VERSION
+ARG \
+    WYOMING_WHISPER_VERSION \
+    WYOMING_VERSION \
+    TRANSFORMERS_VERSION \
+    ONNX_ASR_VERSION \
+    FUNASR_VERSION \
+    ONNXRUNTIME_VERSION \
+    FASTER_WHISPER_VERSION \
+    CTRANSLATE2_VERSION \
+    SHERPA_ONNX_VERSION \
+    TORCH_VERSION
 
 RUN \
     apt-get update \
@@ -21,16 +31,20 @@ RUN \
         setuptools \
         wheel \
     && .venv/bin/pip3 install --no-cache-dir \
-        "wyoming[zeroconf]==1.9.0" \
+        "wyoming[zeroconf]==${WYOMING_VERSION}" \
         "wyoming-faster-whisper[sherpa] @ https://github.com/rhasspy/wyoming-faster-whisper/archive/refs/tags/v${WYOMING_WHISPER_VERSION}.tar.gz" \
-        'transformers==4.52.4' \
-        'onnx-asr[cpu,hub]==0.11.0' \
-        'funasr>=1.1.0,<2' \
+        "transformers==${TRANSFORMERS_VERSION}" \
+        "onnx-asr[cpu,hub]==${ONNX_ASR_VERSION}" \
+        "funasr==${FUNASR_VERSION}" \
+        "onnxruntime==${ONNXRUNTIME_VERSION}" \
+        "faster-whisper==${FASTER_WHISPER_VERSION}" \
+        "ctranslate2==${CTRANSLATE2_VERSION}" \
+        "sherpa-onnx==${SHERPA_ONNX_VERSION}" \
     \
     && .venv/bin/pip3 install --no-cache-dir \
         --index-url 'https://download.pytorch.org/whl/cpu' \
-        'torch==2.7.1' \
-        'torchaudio==2.7.1' \
+        "torch==${TORCH_VERSION}" \
+        "torchaudio==${TORCH_VERSION}" \
     \
     && apt-get purge -y --auto-remove \
         build-essential \
@@ -38,6 +52,8 @@ RUN \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/usr/src/.venv/bin:$PATH"
+
+ENV ORT_DISABLE_TELEMETRY=1
 WORKDIR /
 COPY rootfs /
 
diff --git a/whisper/build.yaml b/whisper/build.yaml
index 7bb294e1a..5c6191faf 100644
--- a/whisper/build.yaml
+++ b/whisper/build.yaml
@@ -4,3 +4,13 @@ build_from:
   aarch64: ghcr.io/home-assistant/aarch64-base-debian:trixie
 args:
   WYOMING_WHISPER_VERSION: 3.5.0
+  WYOMING_VERSION: 1.9.0
+  # Must match the exact pins of wyoming-faster-whisper
+  TRANSFORMERS_VERSION: 4.52.4
+  ONNX_ASR_VERSION: 0.11.0
+  FUNASR_VERSION: 1.4.3
+  ONNXRUNTIME_VERSION: 1.29.0
+  FASTER_WHISPER_VERSION: 1.2.1
+  CTRANSLATE2_VERSION: 4.8.1
+  SHERPA_ONNX_VERSION: 1.13.6
+  TORCH_VERSION: 2.7.1
diff --git a/whisper/config.yaml b/whisper/config.yaml
index 7986bc4c7..2cf0c9229 100644
--- a/whisper/config.yaml
+++ b/whisper/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 3.5.1
+version: 3.5.2
 slug: whisper
 name: Whisper
 description: Speech-to-text with Whisper