diff --git a/Cargo.lock b/Cargo.lock
index 54749ceb1..188851306 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -47,9 +47,9 @@ dependencies = [
 
 [[package]]
 name = "annotate-snippets"
-version = "0.12.16"
+version = "0.12.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1"
+checksum = "b2a5b0a5ab8561c603f16c3b78c24a386b1f70e7fc1b1b1e8c15738828e4a176"
 dependencies = [
  "anstyle",
  "memchr",
@@ -114,9 +114,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arc-swap"
-version = "1.9.2"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+checksum = "380962b3d93b99642e50b9febf72c071e97e8b32d86eae9cf4ef582bb960ae6e"
 dependencies = [
  "rustversion",
 ]
@@ -249,9 +249,9 @@ dependencies = [
 
 [[package]]
 name = "base16ct"
-version = "0.2.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
 
 [[package]]
 name = "base64"
@@ -285,11 +285,11 @@ checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "block-buffer"
-version = "0.10.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -316,9 +316,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838"
+checksum = "877bf67ac8e52449eb2f9e98a344ea163beb70dd1f9eebe3cc5357dcfeaee4df"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -339,7 +339,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.1",
+ "cpufeatures",
  "rand_core 0.10.1",
 ]
 
@@ -394,6 +394,12 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -402,9 +408,9 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "combine"
-version = "4.6.8"
+version = "4.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+checksum = "4356eba6976435498d05a311ee9fc486da3bc81c200d3f0d7dd9703b41913f92"
 dependencies = [
  "bytes",
  "memchr",
@@ -412,15 +418,15 @@ dependencies = [
 
 [[package]]
 name = "const-oid"
-version = "0.9.6"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
 name = "const_format"
-version = "0.2.36"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
+checksum = "a3decb4d6965448659923544a634a0571ba44cede4e11ef15a5a317126840454"
 dependencies = [
  "const_format_proc_macros",
  "konst",
@@ -428,9 +434,9 @@ dependencies = [
 
 [[package]]
 name = "const_format_proc_macros"
-version = "0.2.34"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744"
+checksum = "941b570269a642506f08cb5b688c04bfa6cfd41a26f8bcdc49db8fd00c0ab659"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -469,13 +475,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
 
 [[package]]
-name = "cpufeatures"
-version = "0.2.17"
+name = "cpubits"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
 
 [[package]]
 name = "cpufeatures"
@@ -488,9 +491,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.2"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
 dependencies = [
  "cfg-if",
 ]
@@ -512,24 +515,50 @@ checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.5.5"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
 dependencies = [
- "generic-array",
- "rand_core 0.6.4",
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "serdect",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "generic-array",
- "typenum",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "crypto-primes"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
+dependencies = [
+ "crypto-bigint",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
+dependencies = [
+ "cmov",
+ "subtle",
 ]
 
 [[package]]
@@ -602,9 +631,9 @@ dependencies = [
 
 [[package]]
 name = "defmt"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+checksum = "e4a0795ac740cb54d7b3775c9c17345f6aaecf884c01733b39d6017738e0e3e1"
 dependencies = [
  "bitflags 1.3.2",
  "defmt-macros",
@@ -612,21 +641,21 @@ dependencies = [
 
 [[package]]
 name = "defmt-macros"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+checksum = "840bb056bd99c495c9188198a258ab787c79f306d864db3e6e8451442d6d8366"
 dependencies = [
  "defmt-parser",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "defmt-parser"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+checksum = "71958f69fb2de856c5dd51ac9377e986ca1aa5919f931bf5395a807277f889a0"
 dependencies = [
  "thiserror 2.0.21",
 ]
@@ -644,9 +673,9 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.7.10"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
 dependencies = [
  "const-oid",
  "der_derive",
@@ -657,9 +686,9 @@ dependencies = [
 
 [[package]]
 name = "der_derive"
-version = "0.7.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+checksum = "59600e2c2d636fde9b65e99cc6445ac770c63d3628195ff39932b8d6d7409903"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -695,14 +724,14 @@ dependencies = [
 
 [[package]]
 name = "digest"
-version = "0.10.7"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer",
  "const-oid",
  "crypto-common",
- "subtle",
+ "ctutils",
 ]
 
 [[package]]
@@ -744,9 +773,9 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ecdsa"
-version = "0.16.9"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
 dependencies = [
  "der",
  "digest",
@@ -754,6 +783,7 @@ dependencies = [
  "rfc6979",
  "signature",
  "spki",
+ "zeroize",
 ]
 
 [[package]]
@@ -788,19 +818,20 @@ checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 
 [[package]]
 name = "elliptic-curve"
-version = "0.13.8"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+checksum = "900f37e7e18d74a2347389af6cd69e3a30d5cc9e697f40004865679aa75e9c7c"
 dependencies = [
  "base16ct",
  "crypto-bigint",
+ "crypto-common",
  "digest",
  "ff",
- "generic-array",
  "group",
+ "hybrid-array",
  "pem-rfc7468",
  "pkcs8",
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
  "sec1",
  "subtle",
  "zeroize",
@@ -902,19 +933,19 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "ff"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
  "subtle",
 ]
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
 
 [[package]]
 name = "flagset"
@@ -1048,17 +1079,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
-dependencies = [
- "typenum",
- "version_check",
- "zeroize",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1138,12 +1158,12 @@ dependencies = [
 
 [[package]]
 name = "group"
-version = "0.13.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
 dependencies = [
  "ff",
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
  "subtle",
 ]
 
@@ -1191,9 +1211,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
  "digest",
 ]
@@ -1260,6 +1280,17 @@ version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "subtle",
+ "typenum",
+ "zeroize",
+]
+
 [[package]]
 name = "hyper"
 version = "1.12.0"
@@ -1712,7 +1743,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.4"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "darling 0.24.1",
  "regex",
@@ -1848,15 +1879,12 @@ name = "lazy_static"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
-dependencies = [
- "spin",
-]
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libgit2-sys"
@@ -1870,12 +1898,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "libyaml-rs"
 version = "0.3.0"
@@ -1984,47 +2006,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "num-bigint-dig"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
-dependencies = [
- "lazy_static",
- "libm",
- "num-integer",
- "num-iter",
- "num-traits",
- "rand 0.8.8",
- "smallvec",
- "zeroize",
-]
-
 [[package]]
 name = "num-conv"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
-[[package]]
-name = "num-integer"
-version = "0.1.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-iter"
-version = "0.1.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2032,7 +2019,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
- "libm",
 ]
 
 [[package]]
@@ -2160,12 +2146,13 @@ dependencies = [
 
 [[package]]
 name = "p256"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
 dependencies = [
  "ecdsa",
  "elliptic-curve",
+ "primefield",
  "primeorder",
  "sha2",
 ]
@@ -2211,9 +2198,9 @@ dependencies = [
 
 [[package]]
 name = "pem-rfc7468"
-version = "0.7.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
 dependencies = [
  "base64ct",
 ]
@@ -2226,9 +2213,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.9.3"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b568374ba38b33a6c627141f891faf16902b08d2db26b8ede1bcb0a15b1919fa"
+checksum = "fd47a460a9cbc3b3429c7e22bf0d76653e779319bae45a499ca010c9a990bb23"
 dependencies = [
  "memchr",
  "psm",
@@ -2238,9 +2225,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.9.3"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66e184b924cebaaff20ab2256ca52f12332d528a39aa76553b5d96f92aacf7f"
+checksum = "203e46697708f7519ab1608393cf89239cafb46b8e6d08a8ffe359359b11ef44"
 dependencies = [
  "pest",
  "pest_generator",
@@ -2248,9 +2235,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.9.3"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a87478d267e4de54a626af9754f2f0f58e927aac6ed0575fe89bc05ad6851694"
+checksum = "e84ae6340a458d3d6cfc73cf328cf3cfe90b2484cd0de25eb66aa954615ed4d5"
 dependencies = [
  "pest",
  "pest_meta",
@@ -2261,9 +2248,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.9.3"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f986f248b4241ac359b831f6139aaa34e03b08a37b6caf7e201a33f95c869e1"
+checksum = "b57f92f32b3dbce6598fd8f5cdf1f06a6072570b8103fa21728fa9036923e710"
 dependencies = [
  "pest",
 ]
@@ -2296,20 +2283,19 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkcs1"
-version = "0.7.5"
+version = "0.8.0-rc.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+checksum = "f485dbafe293ea6ccaa7d82bc591651a796eb8a9aec3df040b057b706073dbc3"
 dependencies = [
  "der",
- "pkcs8",
  "spki",
 ]
 
 [[package]]
 name = "pkcs8"
-version = "0.10.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
  "der",
  "spki",
@@ -2360,13 +2346,31 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "primefield"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
+dependencies = [
+ "crypto-bigint",
+ "crypto-common",
+ "ff",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "primeorder"
-version = "0.13.6"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
 dependencies = [
  "elliptic-curve",
+ "once_cell",
+ "primefield",
+ "serdect",
+ "wnaf",
 ]
 
 [[package]]
@@ -2449,23 +2453,13 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
-[[package]]
-name = "rand"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
-dependencies = [
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
- "rand_chacha 0.9.0",
+ "rand_chacha",
  "rand_core 0.9.5",
 ]
 
@@ -2480,16 +2474,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.9.0"
@@ -2500,15 +2484,6 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
-]
-
 [[package]]
 name = "rand_core"
 version = "0.9.5"
@@ -2621,12 +2596,12 @@ dependencies = [
 
 [[package]]
 name = "rfc6979"
-version = "0.4.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
 dependencies = [
+ "crypto-bigint",
  "hmac",
- "subtle",
 ]
 
 [[package]]
@@ -2645,22 +2620,20 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.10"
+version = "0.10.0-rc.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+checksum = "33405e321e16ef941ca66e254f6904c3aafd3c7ff001fb88bf11c73eb75c2b85"
 dependencies = [
  "const-oid",
+ "crypto-bigint",
+ "crypto-primes",
  "digest",
- "num-bigint-dig",
- "num-integer",
- "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
  "sha2",
  "signature",
  "spki",
- "subtle",
  "zeroize",
 ]
 
@@ -2767,9 +2740,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2799,9 +2772,9 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
 dependencies = [
  "windows-sys 0.61.2",
 ]
@@ -2840,14 +2813,14 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sec1"
-version = "0.7.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
 dependencies = [
  "base16ct",
+ "ctutils",
  "der",
- "generic-array",
- "pkcs8",
+ "hybrid-array",
  "subtle",
  "zeroize",
 ]
@@ -3000,25 +2973,35 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "sha1"
-version = "0.10.7"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
@@ -3049,12 +3032,12 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "2.2.0"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 dependencies = [
  "digest",
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3143,17 +3126,11 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
 [[package]]
 name = "spki"
-version = "0.7.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
 dependencies = [
  "base64ct",
  "der",
@@ -3165,10 +3142,22 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "stackable-agent"
+version = "0.1.0"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
+dependencies = [
+ "k8s-openapi",
+ "schemars",
+ "serde",
+ "stackable-versioned",
+ "strum",
+]
+
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -3176,7 +3165,7 @@ dependencies = [
  "kube",
  "p256",
  "rand 0.10.3",
- "rand_core 0.6.4",
+ "rand_core 0.10.1",
  "rsa",
  "sha2",
  "signature",
@@ -3189,6 +3178,18 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "stackable-kafka-agent"
+version = "0.0.0-dev"
+dependencies = [
+ "anyhow",
+ "built",
+ "clap",
+ "stackable-operator",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "stackable-kafka-operator"
 version = "0.0.0-dev"
@@ -3204,17 +3205,28 @@ dependencies = [
  "serde",
  "serde_json",
  "snafu 0.9.2",
+ "stackable-kafka-shared",
  "stackable-operator",
  "strum",
  "tokio",
  "tracing",
 ]
 
+[[package]]
+name = "stackable-kafka-shared"
+version = "0.0.0-dev"
+dependencies = [
+ "rstest",
+ "stackable-operator",
+ "strum",
+]
+
 [[package]]
 name = "stackable-operator"
 version = "0.121.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
+ "base16ct",
  "base64 0.23.1",
  "clap",
  "const_format",
@@ -3238,6 +3250,7 @@ dependencies = [
  "serde_json",
  "sha2",
  "snafu 0.9.2",
+ "stackable-agent",
  "stackable-operator-derive",
  "stackable-shared",
  "stackable-telemetry",
@@ -3257,7 +3270,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "darling 0.24.1",
  "proc-macro2",
@@ -3268,7 +3281,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.2.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3285,7 +3298,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "axum",
  "clap",
@@ -3309,7 +3322,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.13.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "kube",
  "schemars",
@@ -3317,13 +3330,12 @@ dependencies = [
  "serde_json",
  "snafu 0.9.2",
  "stackable-versioned-macros",
- "yaml_serde",
 ]
 
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.13.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "convert_case",
  "darling 0.24.1",
@@ -3340,7 +3352,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#433ac4fe45418d39631e683fac74cb49e11911f6"
+source = "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#46a18a9a4899976b702ca87f73430c6f12d17c56"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -3586,9 +3598,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.53.3"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -3975,9 +3987,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.28.0"
+version = "1.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606"
+checksum = "4a0e2d11620c50695fe12bbbfde96b3477fe606e7284c22d505c12ce51214514"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -4113,9 +4125,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -4285,6 +4297,18 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wnaf"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
+dependencies = [
+ "ff",
+ "group",
+ "hybrid-array",
+ "primefield",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
@@ -4293,9 +4317,9 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "x509-cert"
-version = "0.2.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
+checksum = "105ef4642d9cb137ef83d623d0e4bf08b8adf69e9918ca904a174adb6d3d038b"
 dependencies = [
  "const-oid",
  "der",
diff --git a/Cargo.nix b/Cargo.nix
index 4e13cdbae..9dd9a010d 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -38,29 +38,37 @@ rec {
   # "public" attributes that we attempt to keep stable with new versions of crate2nix.
   #
 
-  rootCrate = rec {
-    packageId = "stackable-kafka-operator";
 
-    # Use this attribute to refer to the derivation building your root crate package.
-    # You can override the features with rootCrate.build.override { features = [ "default" "feature1" ... ]; }.
-    build = internal.buildRustCrateWithFeatures {
-      inherit packageId;
-    };
-
-    # Debug support which might change between releases.
-    # File a bug if you depend on any for non-debug work!
-    debug = internal.debugCrate { inherit packageId; };
-  };
   # Refer your crate build derivation by name here.
   # You can override the features with
   # workspaceMembers."${crateName}".build.override { features = [ "default" "feature1" ... ]; }.
   workspaceMembers = {
+    "stackable-kafka-agent" = rec {
+      packageId = "stackable-kafka-agent";
+      build = internal.buildRustCrateWithFeatures {
+        packageId = "stackable-kafka-agent";
+      };
+
+      # Debug support which might change between releases.
+      # File a bug if you depend on any for non-debug work!
+      debug = internal.debugCrate { inherit packageId; };
+    };
     "stackable-kafka-operator" = rec {
       packageId = "stackable-kafka-operator";
       build = internal.buildRustCrateWithFeatures {
         packageId = "stackable-kafka-operator";
       };
 
+      # Debug support which might change between releases.
+      # File a bug if you depend on any for non-debug work!
+      debug = internal.debugCrate { inherit packageId; };
+    };
+    "stackable-kafka-shared" = rec {
+      packageId = "stackable-kafka-shared";
+      build = internal.buildRustCrateWithFeatures {
+        packageId = "stackable-kafka-shared";
+      };
+
       # Debug support which might change between releases.
       # File a bug if you depend on any for non-debug work!
       debug = internal.debugCrate { inherit packageId; };
@@ -216,9 +224,9 @@ rec {
       };
       "annotate-snippets" = rec {
         crateName = "annotate-snippets";
-        version = "0.12.16";
+        version = "0.12.17";
         edition = "2024";
-        sha256 = "1w8kdyj2fh4n666wvd1krj2zcyjls9vlqrmpslx1yr5w0lcaa4gj";
+        sha256 = "0xm1whl8hwqmihg1n6zwwxq1ysrq9b17hfvcy41wcqc5mfjv19dj";
         libName = "annotate_snippets";
         dependencies = [
           {
@@ -375,9 +383,9 @@ rec {
       };
       "arc-swap" = rec {
         crateName = "arc-swap";
-        version = "1.9.2";
+        version = "1.9.3";
         edition = "2018";
-        sha256 = "02w1n3kiz02ml6is3biqia4bgxcf7dml2m9mrd2v3w5f9nzc0jf0";
+        sha256 = "0vmfc2wjnn7gyjfawvnq6a5pxsbiq1rbzzmra0p6969vv6rn429q";
         libName = "arc_swap";
         authors = [
           "Michal 'vorner' Vaner <vorner@vorner.cz>"
@@ -389,6 +397,7 @@ rec {
           }
         ];
         features = {
+          "internal-test-strategies" = [ "rwlock-strategy" ];
           "serde" = [ "dep:serde" ];
         };
       };
@@ -824,14 +833,13 @@ rec {
       };
       "base16ct" = rec {
         crateName = "base16ct";
-        version = "0.2.0";
-        edition = "2021";
-        sha256 = "1kylrjhdzk7qpknrvlphw8ywdnvvg39dizw9622w3wk5xba04zsc";
+        version = "1.0.0";
+        edition = "2024";
+        sha256 = "1xi6jy6y08hbxfy14pxjlxcggl9kfsvsn3jbyyk7lii4ss878c7x";
         authors = [
           "RustCrypto Developers"
         ];
         features = {
-          "std" = [ "alloc" ];
         };
         resolvedDefaultFeatures = [ "alloc" ];
       };
@@ -908,20 +916,22 @@ rec {
       };
       "block-buffer" = rec {
         crateName = "block-buffer";
-        version = "0.10.4";
-        edition = "2018";
-        sha256 = "0w9sa2ypmrsqqvc20nhwr75wbb5cjr4kkyhpjm1z1lv2kdicfy1h";
+        version = "0.12.1";
+        edition = "2024";
+        sha256 = "1ak0cvmxz3yifqmzv6aba9606brsz7d5g3piv5xdcvjsx7dwgxnj";
         libName = "block_buffer";
         authors = [
           "RustCrypto Developers"
         ];
         dependencies = [
           {
-            name = "generic-array";
-            packageId = "generic-array";
+            name = "hybrid-array";
+            packageId = "hybrid-array";
           }
         ];
-
+        features = {
+          "zeroize" = [ "dep:zeroize" ];
+        };
       };
       "built" = rec {
         crateName = "built";
@@ -989,9 +999,9 @@ rec {
       };
       "cc" = rec {
         crateName = "cc";
-        version = "1.8.0";
+        version = "1.9.0";
         edition = "2021";
-        sha256 = "0f6q6vc8fj6xn4j1wd4yakiza6lhgwai49gp1zdwgzggh3nwjlb6";
+        sha256 = "1pz4mvzdqmskrkiyp7hzvmqfnfqnx92a764y5zmlj975r1xgcyw7";
         dependencies = [
           {
             name = "find-msvc-tools";
@@ -1049,7 +1059,7 @@ rec {
           }
           {
             name = "cpufeatures";
-            packageId = "cpufeatures 0.3.1";
+            packageId = "cpufeatures";
             target = { target, features }: (("x86_64" == target."arch" or null) || ("x86" == target."arch" or null));
           }
           {
@@ -1237,6 +1247,16 @@ rec {
         edition = "2024";
         sha256 = "11k4m4ngn39iz39lnq6nn6kyxzp62mnm1d86qfad3q0vlk33n4qw";
 
+      };
+      "cmov" = rec {
+        crateName = "cmov";
+        version = "0.5.4";
+        edition = "2024";
+        sha256 = "0yh22sqdvcdrfbhvnja4kaq5dyklpb4s70w5r6rplfdw4jna17hc";
+        authors = [
+          "RustCrypto Developers"
+        ];
+
       };
       "colorchoice" = rec {
         crateName = "colorchoice";
@@ -1247,9 +1267,9 @@ rec {
       };
       "combine" = rec {
         crateName = "combine";
-        version = "4.6.8";
+        version = "4.6.9";
         edition = "2018";
-        sha256 = "0ppwzwdmszpan9ybx1myc6ldg5zih2sazf9idckdxrh9gn9j1hyg";
+        sha256 = "14izj50knw6rgl6ky3903k43pnl6qjgyw4d30n6ljdb4jykfnmj3";
         authors = [
           "Markus Westerlind <marwes91@gmail.com>"
         ];
@@ -1294,9 +1314,9 @@ rec {
       };
       "const-oid" = rec {
         crateName = "const-oid";
-        version = "0.9.6";
-        edition = "2021";
-        sha256 = "1y0jnqaq7p2wvspnx7qj76m7hjcqpz73qzvr9l2p9n2s51vr6if2";
+        version = "0.10.2";
+        edition = "2024";
+        sha256 = "0p7m286mp8aai4sa72g7ji6qm0d4ns8wg4i4b2hj9p9615zm3vx6";
         libName = "const_oid";
         authors = [
           "RustCrypto Developers"
@@ -1304,13 +1324,13 @@ rec {
         features = {
           "arbitrary" = [ "dep:arbitrary" ];
         };
-        resolvedDefaultFeatures = [ "db" "std" ];
+        resolvedDefaultFeatures = [ "db" ];
       };
       "const_format" = rec {
         crateName = "const_format";
-        version = "0.2.36";
+        version = "0.2.37";
         edition = "2021";
-        sha256 = "07ncczs8yndga2f8p4386c827l4fxwzl0pbwp7ijnhcsmlbsd0a4";
+        sha256 = "0m04hhk72casbbqixqg4xm6a86spl0saci1mj9cqci35d56wppm3";
         authors = [
           "rodrimati1992 <rodrimatt1985@gmail.com>"
         ];
@@ -1347,9 +1367,9 @@ rec {
       };
       "const_format_proc_macros" = rec {
         crateName = "const_format_proc_macros";
-        version = "0.2.34";
+        version = "0.2.37";
         edition = "2021";
-        sha256 = "0i3pxxcl4xvwq4mlfg3csb4j0n6v0mhj07p6yk0vlvdirznc4mqx";
+        sha256 = "0ndn186d13yv97fbry163bacz9mz0j66hnyb11pm0hm6d415f6wl";
         procMacro = true;
         authors = [
           "rodrimati1992 <rodrimatt1985@gmail.com>"
@@ -1447,43 +1467,17 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" ];
       };
-      "cpufeatures 0.2.17" = rec {
-        crateName = "cpufeatures";
-        version = "0.2.17";
-        edition = "2018";
-        sha256 = "10023dnnaghhdl70xcds12fsx2b966sxbxjq5sxs49mvxqw5ivar";
+      "cpubits" = rec {
+        crateName = "cpubits";
+        version = "0.1.1";
+        edition = "2024";
+        sha256 = "1bh6rvanxm00myf1rmnh44hq2jdxn69971c92s4klz0k76f5zf0m";
         authors = [
           "RustCrypto Developers"
         ];
-        dependencies = [
-          {
-            name = "libc";
-            packageId = "libc";
-            usesDefaultFeatures = false;
-            target = { target, features }: (target.name == "aarch64-linux-android");
-          }
-          {
-            name = "libc";
-            packageId = "libc";
-            usesDefaultFeatures = false;
-            target = { target, features }: (("aarch64" == target."arch" or null) && ("linux" == target."os" or null));
-          }
-          {
-            name = "libc";
-            packageId = "libc";
-            usesDefaultFeatures = false;
-            target = { target, features }: (("aarch64" == target."arch" or null) && ("apple" == target."vendor" or null));
-          }
-          {
-            name = "libc";
-            packageId = "libc";
-            usesDefaultFeatures = false;
-            target = { target, features }: (("loongarch64" == target."arch" or null) && ("linux" == target."os" or null));
-          }
-        ];
 
       };
-      "cpufeatures 0.3.1" = rec {
+      "cpufeatures" = rec {
         crateName = "cpufeatures";
         version = "0.3.1";
         edition = "2024";
@@ -1521,9 +1515,9 @@ rec {
       };
       "crc32fast" = rec {
         crateName = "crc32fast";
-        version = "1.5.2";
+        version = "1.5.3";
         edition = "2021";
-        sha256 = "0y0f955n2hr5a8rd9nw9sr23nhjc42ddx3bjc47dnlmqssgpk9q1";
+        sha256 = "0m907hccpnpmr4x87ggcq8n5zd3w1d5sqs07q81dqp848kl0d88b";
         authors = [
           "Sam Rijs <srijs@airpost.net>"
           "Alex Crichton <alex@alexcrichton.com>"
@@ -1572,27 +1566,54 @@ rec {
       };
       "crypto-bigint" = rec {
         crateName = "crypto-bigint";
-        version = "0.5.5";
-        edition = "2021";
-        sha256 = "0xmbdff3g6ii5sbxjxc31xfkv9lrmyril4arh3dzckd4gjsjzj8d";
+        version = "0.7.10";
+        edition = "2024";
+        sha256 = "04dyl8pzc00l7bmsa3br86dczs45hwhkw7wjzg9dl0xs9jv5q0ww";
         libName = "crypto_bigint";
         authors = [
           "RustCrypto Developers"
         ];
         dependencies = [
           {
-            name = "generic-array";
-            packageId = "generic-array";
+            name = "cpubits";
+            packageId = "cpubits";
+          }
+          {
+            name = "ctutils";
+            packageId = "ctutils";
+          }
+          {
+            name = "getrandom";
+            packageId = "getrandom 0.4.3";
+            optional = true;
+            features = [ "sys_rng" ];
+          }
+          {
+            name = "hybrid-array";
+            packageId = "hybrid-array";
             optional = true;
           }
+          {
+            name = "num-traits";
+            packageId = "num-traits";
+            usesDefaultFeatures = false;
+          }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             optional = true;
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "serdect";
+            packageId = "serdect";
+            optional = true;
+            usesDefaultFeatures = false;
           }
           {
             name = "subtle";
             packageId = "subtle";
+            optional = true;
             usesDefaultFeatures = false;
           }
           {
@@ -1605,48 +1626,120 @@ rec {
         devDependencies = [
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
-            features = [ "std" ];
+            packageId = "rand_core 0.10.1";
           }
         ];
         features = {
           "alloc" = [ "serdect?/alloc" ];
-          "default" = [ "rand" ];
-          "der" = [ "dep:der" ];
-          "generic-array" = [ "dep:generic-array" ];
-          "rand" = [ "rand_core/std" ];
+          "default" = [ "rand_core" ];
+          "der" = [ "dep:der" "hybrid-array" ];
+          "getrandom" = [ "dep:getrandom" "rand_core" ];
+          "hybrid-array" = [ "dep:hybrid-array" ];
           "rand_core" = [ "dep:rand_core" ];
           "rlp" = [ "dep:rlp" ];
           "serde" = [ "dep:serdect" ];
+          "subtle" = [ "dep:subtle" "ctutils/subtle" "hybrid-array?/subtle" ];
           "zeroize" = [ "dep:zeroize" ];
         };
-        resolvedDefaultFeatures = [ "generic-array" "rand_core" "zeroize" ];
+        resolvedDefaultFeatures = [ "alloc" "getrandom" "hybrid-array" "rand_core" "subtle" "zeroize" ];
       };
       "crypto-common" = rec {
         crateName = "crypto-common";
-        version = "0.1.6";
-        edition = "2018";
-        sha256 = "1cvby95a6xg7kxdz5ln3rl9xh66nz66w46mm3g56ri1z5x815yqv";
+        version = "0.2.2";
+        edition = "2024";
+        sha256 = "0lql5wjlrjkd3r0w32rwbgqfmgg84ms3h65ldnlckmkc3nb4qvnf";
         libName = "crypto_common";
         authors = [
           "RustCrypto Developers"
         ];
         dependencies = [
           {
-            name = "generic-array";
-            packageId = "generic-array";
-            features = [ "more_lengths" ];
+            name = "getrandom";
+            packageId = "getrandom 0.4.3";
+            optional = true;
+            features = [ "sys_rng" ];
+          }
+          {
+            name = "hybrid-array";
+            packageId = "hybrid-array";
           }
           {
-            name = "typenum";
-            packageId = "typenum";
+            name = "rand_core";
+            packageId = "rand_core 0.10.1";
+            optional = true;
           }
         ];
         features = {
-          "getrandom" = [ "rand_core/getrandom" ];
+          "getrandom" = [ "rand_core" "dep:getrandom" ];
           "rand_core" = [ "dep:rand_core" ];
+          "zeroize" = [ "hybrid-array/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "std" ];
+        resolvedDefaultFeatures = [ "getrandom" "rand_core" ];
+      };
+      "crypto-primes" = rec {
+        crateName = "crypto-primes";
+        version = "0.7.2";
+        edition = "2024";
+        sha256 = "13ygy2rrp7dicc4lmj01744y8hfjhfyr99pa9ymbp7n674daacrn";
+        libName = "crypto_primes";
+        dependencies = [
+          {
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
+            usesDefaultFeatures = false;
+            features = [ "rand_core" ];
+          }
+          {
+            name = "rand_core";
+            packageId = "rand_core 0.10.1";
+            usesDefaultFeatures = false;
+          }
+        ];
+        devDependencies = [
+          {
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
+            usesDefaultFeatures = false;
+            features = [ "alloc" ];
+          }
+        ];
+        features = {
+          "default" = [ "alloc" ];
+          "glass_pumpkin" = [ "dep:glass_pumpkin" ];
+          "multicore" = [ "rayon" ];
+          "openssl" = [ "dep:openssl" ];
+          "rayon" = [ "dep:rayon" ];
+          "rug" = [ "dep:rug" ];
+          "tests-all" = [ "tests-openssl" "tests-gmp" "tests-exhaustive" "tests-glass-pumpkin" ];
+          "tests-glass-pumpkin" = [ "glass_pumpkin" ];
+          "tests-gmp" = [ "rug/std" ];
+          "tests-openssl" = [ "openssl" ];
+        };
+      };
+      "ctutils" = rec {
+        crateName = "ctutils";
+        version = "0.4.7";
+        edition = "2024";
+        sha256 = "12l2ck796m702jbjfr5gbc5r1mip09mlnnw7b7dskn4ndzynydx2";
+        authors = [
+          "RustCrypto Developers"
+        ];
+        dependencies = [
+          {
+            name = "cmov";
+            packageId = "cmov";
+          }
+          {
+            name = "subtle";
+            packageId = "subtle";
+            optional = true;
+            usesDefaultFeatures = false;
+          }
+        ];
+        features = {
+          "subtle" = [ "dep:subtle" ];
+        };
+        resolvedDefaultFeatures = [ "subtle" ];
       };
       "darling 0.23.0" = rec {
         crateName = "darling";
@@ -1830,10 +1923,10 @@ rec {
       };
       "defmt" = rec {
         crateName = "defmt";
-        version = "1.1.1";
+        version = "1.2.0";
         edition = "2021";
         links = "defmt";
-        sha256 = "1lc8xlfj700xqjmvp7n9hhc1czgpaqkq960iqw6d5fwk9zz3p5g2";
+        sha256 = "1qg3w0w7f0fn74xp60aci37swsjz6hbrqp3pngbm9js0qxd7k874";
         authors = [
           "The Knurling-rs developers"
         ];
@@ -1854,9 +1947,9 @@ rec {
       };
       "defmt-macros" = rec {
         crateName = "defmt-macros";
-        version = "1.1.1";
+        version = "1.2.0";
         edition = "2021";
-        sha256 = "1s2zkcbaj1l306ph1n1gsfm6vzc2sah4acl1qc6pw4x2ghpcgnds";
+        sha256 = "0rl3dlnl8lc4dqzdnr6q0vrpjz3qmdca5641334rbi4rpmbb02w4";
         procMacro = true;
         libName = "defmt_macros";
         authors = [
@@ -1877,7 +1970,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.119";
+            packageId = "syn 3.0.9";
             features = [ "full" "extra-traits" ];
           }
         ];
@@ -1886,9 +1979,9 @@ rec {
       };
       "defmt-parser" = rec {
         crateName = "defmt-parser";
-        version = "1.0.0";
+        version = "1.1.0";
         edition = "2021";
-        sha256 = "0gpfky9sssil5qfaix5wxcwiqk7snszhl5gq3vcwkrxjncs07mhh";
+        sha256 = "1849z1vp502s77sip4wzj6jimjl6x5vr7b2ivp2mds1dzdlqz5bi";
         libName = "defmt_parser";
         authors = [
           "The Knurling-rs developers"
@@ -1931,9 +2024,9 @@ rec {
       };
       "der" = rec {
         crateName = "der";
-        version = "0.7.10";
-        edition = "2021";
-        sha256 = "1jyxacyxdx6mxbkfw99jz59dzvcd9k17rq01a7xvn1dr6wl87hg7";
+        version = "0.8.3";
+        edition = "2024";
+        sha256 = "01703q9nh4vlswvm7hbjknvhjd589apzdz0jdrx452zbiw86m6ba";
         authors = [
           "RustCrypto Developers"
         ];
@@ -1968,10 +2061,11 @@ rec {
         ];
         features = {
           "alloc" = [ "zeroize?/alloc" ];
-          "arbitrary" = [ "dep:arbitrary" "const-oid?/arbitrary" "std" ];
+          "arbitrary" = [ "dep:arbitrary" "dep:derive_arbitrary" "const-oid?/arbitrary" "std" ];
           "bytes" = [ "dep:bytes" "alloc" ];
           "derive" = [ "dep:der_derive" ];
           "flagset" = [ "dep:flagset" ];
+          "heapless" = [ "dep:heapless" ];
           "oid" = [ "dep:const-oid" ];
           "pem" = [ "dep:pem-rfc7468" "alloc" "zeroize" ];
           "std" = [ "alloc" ];
@@ -1982,9 +2076,9 @@ rec {
       };
       "der_derive" = rec {
         crateName = "der_derive";
-        version = "0.7.3";
-        edition = "2021";
-        sha256 = "065d2wy7zd0dank99hh58l5x7lv50hxnr7j6f3sphlb7i4ihjd40";
+        version = "0.8.0";
+        edition = "2024";
+        sha256 = "00wr83bxdf1jk7rmy6986qywcw67b92cd779cndxwvv35ln0wq2r";
         procMacro = true;
         authors = [
           "RustCrypto Developers"
@@ -2128,9 +2222,9 @@ rec {
       };
       "digest" = rec {
         crateName = "digest";
-        version = "0.10.7";
-        edition = "2018";
-        sha256 = "14p2n6ih29x81akj097lvz7wi9b6b9hvls0lwrv7b6xwyy0s5ncy";
+        version = "0.11.3";
+        edition = "2024";
+        sha256 = "1hnmhd4rkybr11292w42pz9ppzx1h49glrhqg107k4s1b2xnvpgi";
         authors = [
           "RustCrypto Developers"
         ];
@@ -2148,28 +2242,26 @@ rec {
           {
             name = "crypto-common";
             packageId = "crypto-common";
+            rename = "common";
           }
           {
-            name = "subtle";
-            packageId = "subtle";
+            name = "ctutils";
+            packageId = "ctutils";
             optional = true;
-            usesDefaultFeatures = false;
           }
         ];
         features = {
           "blobby" = [ "dep:blobby" ];
-          "block-buffer" = [ "dep:block-buffer" ];
-          "const-oid" = [ "dep:const-oid" ];
-          "core-api" = [ "block-buffer" ];
-          "default" = [ "core-api" ];
+          "block-api" = [ "dep:block-buffer" ];
+          "default" = [ "block-api" ];
           "dev" = [ "blobby" ];
-          "mac" = [ "subtle" ];
-          "oid" = [ "const-oid" ];
-          "rand_core" = [ "crypto-common/rand_core" ];
-          "std" = [ "alloc" "crypto-common/std" ];
-          "subtle" = [ "dep:subtle" ];
+          "getrandom" = [ "common/getrandom" "rand_core" ];
+          "mac" = [ "dep:ctutils" ];
+          "oid" = [ "dep:const-oid" ];
+          "rand_core" = [ "common/rand_core" ];
+          "zeroize" = [ "dep:zeroize" "block-buffer?/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "block-buffer" "const-oid" "core-api" "default" "mac" "oid" "std" "subtle" ];
+        resolvedDefaultFeatures = [ "alloc" "block-api" "default" "mac" "oid" ];
       };
       "displaydoc" = rec {
         crateName = "displaydoc";
@@ -2260,9 +2352,9 @@ rec {
       };
       "ecdsa" = rec {
         crateName = "ecdsa";
-        version = "0.16.9";
-        edition = "2021";
-        sha256 = "1jhb0bcbkaz4001sdmfyv8ajrv8a1cg7z7aa5myrd4jjbhmz69zf";
+        version = "0.17.0";
+        edition = "2024";
+        sha256 = "1q3alixk3kpqlk610ima509gk6lmpbgxha4p6a2p0xjcq97ils60";
         authors = [
           "RustCrypto Developers"
         ];
@@ -2283,7 +2375,7 @@ rec {
             name = "elliptic-curve";
             packageId = "elliptic-curve";
             usesDefaultFeatures = false;
-            features = [ "digest" "sec1" ];
+            features = [ "sec1" ];
           }
           {
             name = "rfc6979";
@@ -2302,6 +2394,11 @@ rec {
             optional = true;
             usesDefaultFeatures = false;
           }
+          {
+            name = "zeroize";
+            packageId = "zeroize";
+            usesDefaultFeatures = false;
+          }
         ];
         devDependencies = [
           {
@@ -2312,24 +2409,21 @@ rec {
           }
         ];
         features = {
+          "algorithm" = [ "dep:rfc6979" "digest" "elliptic-curve/arithmetic" ];
           "alloc" = [ "elliptic-curve/alloc" "signature/alloc" "spki/alloc" ];
-          "arithmetic" = [ "elliptic-curve/arithmetic" ];
           "default" = [ "digest" ];
           "der" = [ "dep:der" ];
-          "dev" = [ "arithmetic" "digest" "elliptic-curve/dev" "hazmat" ];
-          "digest" = [ "dep:digest" "signature/digest" ];
+          "dev" = [ "algorithm" "digest/dev" "elliptic-curve/dev" ];
+          "digest" = [ "dep:digest" "elliptic-curve/digest" "signature/digest" ];
+          "getrandom" = [ "elliptic-curve/getrandom" ];
           "pem" = [ "elliptic-curve/pem" "pkcs8" ];
-          "pkcs8" = [ "digest" "elliptic-curve/pkcs8" "der" ];
-          "rfc6979" = [ "dep:rfc6979" ];
-          "serde" = [ "elliptic-curve/serde" "serdect" ];
-          "serdect" = [ "dep:serdect" ];
+          "pkcs8" = [ "der" "digest" "elliptic-curve/pkcs8" ];
+          "serde" = [ "dep:serdect" "elliptic-curve/serde" "pkcs8" ];
           "sha2" = [ "dep:sha2" ];
-          "signing" = [ "arithmetic" "digest" "hazmat" "rfc6979" ];
           "spki" = [ "dep:spki" ];
-          "std" = [ "alloc" "elliptic-curve/std" "signature/std" ];
-          "verifying" = [ "arithmetic" "digest" "hazmat" ];
+          "std" = [ "alloc" "elliptic-curve/std" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "arithmetic" "default" "der" "digest" "hazmat" "pem" "pkcs8" "rfc6979" "signing" "spki" "std" "verifying" ];
+        resolvedDefaultFeatures = [ "algorithm" "alloc" "default" "der" "digest" "pem" "pkcs8" "spki" "std" ];
       };
       "educe 0.6.0" = rec {
         crateName = "educe";
@@ -2423,9 +2517,9 @@ rec {
       };
       "elliptic-curve" = rec {
         crateName = "elliptic-curve";
-        version = "0.13.8";
-        edition = "2021";
-        sha256 = "0ixx4brgnzi61z29r3g1606nh2za88hzyz8c5r3p6ydzhqq09rmm";
+        version = "0.14.3";
+        edition = "2024";
+        sha256 = "0z4wbskrlrv590040zv9kv6dac1skvb6rbw9fcsa4x4dw7kkf3wh";
         libName = "elliptic_curve";
         authors = [
           "RustCrypto Developers"
@@ -2438,8 +2532,15 @@ rec {
           {
             name = "crypto-bigint";
             packageId = "crypto-bigint";
+            rename = "bigint";
             usesDefaultFeatures = false;
-            features = [ "rand_core" "generic-array" "zeroize" ];
+            features = [ "hybrid-array" "rand_core" "subtle" "zeroize" ];
+          }
+          {
+            name = "crypto-common";
+            packageId = "crypto-common";
+            rename = "common";
+            features = [ "rand_core" ];
           }
           {
             name = "digest";
@@ -2452,18 +2553,19 @@ rec {
             optional = true;
             usesDefaultFeatures = false;
           }
-          {
-            name = "generic-array";
-            packageId = "generic-array";
-            usesDefaultFeatures = false;
-            features = [ "zeroize" ];
-          }
           {
             name = "group";
             packageId = "group";
             optional = true;
             usesDefaultFeatures = false;
           }
+          {
+            name = "hybrid-array";
+            packageId = "hybrid-array";
+            rename = "array";
+            usesDefaultFeatures = false;
+            features = [ "zeroize" ];
+          }
           {
             name = "pem-rfc7468";
             packageId = "pem-rfc7468";
@@ -2478,14 +2580,14 @@ rec {
           }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             usesDefaultFeatures = false;
           }
           {
             name = "sec1";
             packageId = "sec1";
             optional = true;
-            features = [ "subtle" "zeroize" ];
+            features = [ "ctutils" "subtle" "zeroize" ];
           }
           {
             name = "subtle";
@@ -2499,25 +2601,22 @@ rec {
           }
         ];
         features = {
-          "alloc" = [ "base16ct/alloc" "ff?/alloc" "group?/alloc" "pkcs8?/alloc" "sec1?/alloc" "zeroize/alloc" ];
+          "alloc" = [ "base16ct/alloc" "ff?/alloc" "group?/alloc" "array/alloc" "pkcs8?/alloc" "sec1?/alloc" "zeroize/alloc" ];
           "arithmetic" = [ "group" ];
-          "bits" = [ "arithmetic" "ff/bits" "dep:tap" ];
           "default" = [ "arithmetic" ];
           "dev" = [ "arithmetic" "dep:hex-literal" "pem" "pkcs8" ];
           "digest" = [ "dep:digest" ];
           "ecdh" = [ "arithmetic" "digest" "dep:hkdf" ];
           "ff" = [ "dep:ff" ];
+          "getrandom" = [ "arithmetic" "bigint/getrandom" "common/getrandom" ];
           "group" = [ "dep:group" "ff" ];
-          "hash2curve" = [ "arithmetic" "digest" ];
-          "jwk" = [ "dep:base64ct" "dep:serde_json" "alloc" "serde" "zeroize/alloc" ];
-          "pem" = [ "dep:pem-rfc7468" "alloc" "arithmetic" "pkcs8" "sec1/pem" ];
+          "pem" = [ "dep:pem-rfc7468" "alloc" "arithmetic" "pkcs8/pem" "sec1/pem" ];
           "pkcs8" = [ "dep:pkcs8" "sec1" ];
           "sec1" = [ "dep:sec1" ];
           "serde" = [ "dep:serdect" "alloc" "pkcs8" "sec1/serde" ];
-          "std" = [ "alloc" "rand_core/std" "pkcs8?/std" "sec1?/std" ];
-          "voprf" = [ "digest" ];
+          "std" = [ "alloc" "pkcs8?/std" "sec1?/std" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "arithmetic" "digest" "ff" "group" "hazmat" "pem" "pkcs8" "sec1" "std" ];
+        resolvedDefaultFeatures = [ "alloc" "arithmetic" "digest" "ff" "getrandom" "group" "pem" "pkcs8" "sec1" "std" ];
       };
       "encoding_rs" = rec {
         crateName = "encoding_rs";
@@ -2781,9 +2880,9 @@ rec {
       };
       "ff" = rec {
         crateName = "ff";
-        version = "0.13.1";
+        version = "0.14.0";
         edition = "2021";
-        sha256 = "14v3bc6q24gbcjnxjfbq2dddgf4as2z2gd4mj35gjlrncpxhpdf0";
+        sha256 = "17s889wpzi2dp924bnxhznkbm44lp23nqv4g32phxyx9jamqdxm1";
         authors = [
           "Sean Bowe <ewillbefull@gmail.com>"
           "Jack Grigg <thestr4d@gmail.com>"
@@ -2791,7 +2890,7 @@ rec {
         dependencies = [
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             usesDefaultFeatures = false;
           }
           {
@@ -2802,12 +2901,11 @@ rec {
           }
         ];
         features = {
-          "bits" = [ "bitvec" ];
+          "bits" = [ "bitvec" "ff_derive?/bits" ];
           "bitvec" = [ "dep:bitvec" ];
           "byteorder" = [ "dep:byteorder" ];
           "default" = [ "bits" "std" ];
           "derive" = [ "byteorder" "ff_derive" ];
-          "derive_bits" = [ "bits" "ff_derive/bits" ];
           "ff_derive" = [ "dep:ff_derive" ];
           "std" = [ "alloc" ];
         };
@@ -2815,9 +2913,9 @@ rec {
       };
       "find-msvc-tools" = rec {
         crateName = "find-msvc-tools";
-        version = "0.1.14";
+        version = "0.1.15";
         edition = "2021";
-        sha256 = "112ljldlv150fpl8xr2jl5czg51k3kdfn6cy5fqdsvkl14sgpp5f";
+        sha256 = "0j5sh4lb7g8xh6kd67s0vz037ah5hlp9f2rbgbg9f41rqmf92rhw";
         libName = "find_msvc_tools";
 
       };
@@ -3226,40 +3324,6 @@ rec {
         };
         resolvedDefaultFeatures = [ "alloc" "async-await" "async-await-macro" "channel" "default" "futures-channel" "futures-io" "futures-macro" "futures-sink" "io" "memchr" "sink" "slab" "std" ];
       };
-      "generic-array" = rec {
-        crateName = "generic-array";
-        version = "0.14.9";
-        edition = "2015";
-        sha256 = "1wpdn5ngpqkkyyibbg7wa4cfg0y8zjc57spaia2h47jkk0qp9djb";
-        libName = "generic_array";
-        authors = [
-          "Bartłomiej Kamiński <fizyk20@gmail.com>"
-          "Aaron Trent <novacrazy@gmail.com>"
-        ];
-        dependencies = [
-          {
-            name = "typenum";
-            packageId = "typenum";
-          }
-          {
-            name = "zeroize";
-            packageId = "zeroize";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
-        ];
-        buildDependencies = [
-          {
-            name = "version_check";
-            packageId = "version_check";
-          }
-        ];
-        features = {
-          "serde" = [ "dep:serde" ];
-          "zeroize" = [ "dep:zeroize" ];
-        };
-        resolvedDefaultFeatures = [ "more_lengths" "zeroize" ];
-      };
       "getrandom 0.2.17" = rec {
         crateName = "getrandom";
         version = "0.2.17";
@@ -3294,7 +3358,6 @@ rec {
           "rustc-dep-of-std" = [ "compiler_builtins" "core" "libc/rustc-dep-of-std" "wasi/rustc-dep-of-std" ];
           "wasm-bindgen" = [ "dep:wasm-bindgen" ];
         };
-        resolvedDefaultFeatures = [ "std" ];
       };
       "getrandom 0.3.4" = rec {
         crateName = "getrandom";
@@ -3582,9 +3645,9 @@ rec {
       };
       "group" = rec {
         crateName = "group";
-        version = "0.13.0";
+        version = "0.14.0";
         edition = "2021";
-        sha256 = "0qqs2p5vqnv3zvq9mfjkmw3qlvgqb0c3cm6p33srkh7pc9sfzygh";
+        sha256 = "1x7m980b0m82d012mmika67hqpgq7z6pq3as7xx5nv10lp3s3lbz";
         authors = [
           "Sean Bowe <ewillbefull@gmail.com>"
           "Jack Grigg <jack@z.cash>"
@@ -3597,7 +3660,7 @@ rec {
           }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             usesDefaultFeatures = false;
           }
           {
@@ -3758,9 +3821,9 @@ rec {
       };
       "hmac" = rec {
         crateName = "hmac";
-        version = "0.12.1";
-        edition = "2018";
-        sha256 = "0pmbr069sfg76z7wsssfk5ddcqd9ncp79fyz6zcm6yn115yc6jbc";
+        version = "0.13.0";
+        edition = "2024";
+        sha256 = "0gw6avmix6ah63lf70dapxhml4dlcakl9f2lnm6b0hdf6abvq0v3";
         authors = [
           "RustCrypto Developers"
         ];
@@ -3779,9 +3842,8 @@ rec {
           }
         ];
         features = {
-          "std" = [ "digest/std" ];
+          "zeroize" = [ "digest/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "reset" ];
       };
       "hostname" = rec {
         crateName = "hostname";
@@ -3927,18 +3989,58 @@ rec {
         features = {
         };
       };
-      "hyper" = rec {
-        crateName = "hyper";
-        version = "1.12.0";
-        edition = "2021";
-        sha256 = "173wg6msakx4lha6hxm9z0i1h3bw34q8fk0x57b7flf9li6k4gic";
+      "hybrid-array" = rec {
+        crateName = "hybrid-array";
+        version = "0.4.15";
+        edition = "2024";
+        sha256 = "05wsyp2n5gyf49qk51mblj9qyb15aay74m6fwmf74mpv1pqn9y17";
+        libName = "hybrid_array";
         authors = [
-          "Sean McArthur <sean@seanmonstar.com>"
+          "RustCrypto Developers"
         ];
         dependencies = [
           {
-            name = "atomic-waker";
-            packageId = "atomic-waker";
+            name = "subtle";
+            packageId = "subtle";
+            optional = true;
+            usesDefaultFeatures = false;
+            features = [ "const-generics" ];
+          }
+          {
+            name = "typenum";
+            packageId = "typenum";
+            features = [ "const-generics" ];
+          }
+          {
+            name = "zeroize";
+            packageId = "zeroize";
+            optional = true;
+            usesDefaultFeatures = false;
+          }
+        ];
+        features = {
+          "arbitrary" = [ "dep:arbitrary" ];
+          "bytemuck" = [ "dep:bytemuck" ];
+          "ctutils" = [ "dep:ctutils" ];
+          "serde" = [ "dep:serde" ];
+          "subtle" = [ "dep:subtle" ];
+          "zerocopy" = [ "dep:zerocopy" ];
+          "zeroize" = [ "dep:zeroize" ];
+        };
+        resolvedDefaultFeatures = [ "alloc" "subtle" "zeroize" ];
+      };
+      "hyper" = rec {
+        crateName = "hyper";
+        version = "1.12.0";
+        edition = "2021";
+        sha256 = "173wg6msakx4lha6hxm9z0i1h3bw34q8fk0x57b7flf9li6k4gic";
+        authors = [
+          "Sean McArthur <sean@seanmonstar.com>"
+        ];
+        dependencies = [
+          {
+            name = "atomic-waker";
+            packageId = "atomic-waker";
             optional = true;
           }
           {
@@ -5446,8 +5548,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "k8s_version";
         authors = [
@@ -6089,26 +6191,16 @@ rec {
         authors = [
           "Marvin Löbel <loebel.marvin@gmail.com>"
         ];
-        dependencies = [
-          {
-            name = "spin";
-            packageId = "spin";
-            optional = true;
-            usesDefaultFeatures = false;
-            features = [ "once" ];
-          }
-        ];
         features = {
           "spin" = [ "dep:spin" ];
           "spin_no_std" = [ "spin" ];
         };
-        resolvedDefaultFeatures = [ "spin" "spin_no_std" ];
       };
       "libc" = rec {
         crateName = "libc";
-        version = "0.2.190";
+        version = "0.2.191";
         edition = "2021";
-        sha256 = "0y5yap4bfp7rfsldcbk9pb5alcgygca5xn1n2pmh181zdpf3spff";
+        sha256 = "02i4j7pjh129y92rijaia4576131fa2xjsii1dc3c1fnlv4qgkb5";
         features = {
           "default" = [ "std" ];
           "rustc-dep-of-std" = [ "align" "rustc-std-workspace-core" ];
@@ -6161,23 +6253,6 @@ rec {
           "zlib-ng-compat" = [ "libz-sys/zlib-ng" "libssh2-sys?/zlib-ng-compat" ];
         };
       };
-      "libm" = rec {
-        crateName = "libm";
-        version = "0.2.16";
-        edition = "2021";
-        sha256 = "10brh0a3qjmbzkr5mf5xqi887nhs5y9layvnki89ykz9xb1wxlmn";
-        authors = [
-          "Alex Crichton <alex@alexcrichton.com>"
-          "Amanieu d'Antras <amanieu@gmail.com>"
-          "Jorge Aparicio <japaricious@gmail.com>"
-          "Trevor Gross <tg@trevorgross.com>"
-        ];
-        features = {
-          "default" = [ "arch" ];
-          "unstable" = [ "unstable-intrinsics" "unstable-float" ];
-        };
-        resolvedDefaultFeatures = [ "arch" "default" ];
-      };
       "libyaml-rs" = rec {
         crateName = "libyaml-rs";
         version = "0.3.0";
@@ -6480,81 +6555,6 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" "std" ];
       };
-      "num-bigint-dig" = rec {
-        crateName = "num-bigint-dig";
-        version = "0.8.6";
-        edition = "2021";
-        sha256 = "1dxh3d8pzjc5k0kpy8gy2qhhhqs7zw8a7m564zl3ib8gcjkdsqg6";
-        libName = "num_bigint_dig";
-        authors = [
-          "dignifiedquire <dignifiedquire@gmail.com>"
-          "The Rust Project Developers"
-        ];
-        dependencies = [
-          {
-            name = "lazy_static";
-            packageId = "lazy_static";
-            usesDefaultFeatures = false;
-            features = [ "spin_no_std" ];
-          }
-          {
-            name = "libm";
-            packageId = "libm";
-          }
-          {
-            name = "num-integer";
-            packageId = "num-integer";
-            usesDefaultFeatures = false;
-            features = [ "i128" ];
-          }
-          {
-            name = "num-iter";
-            packageId = "num-iter";
-            usesDefaultFeatures = false;
-          }
-          {
-            name = "num-traits";
-            packageId = "num-traits";
-            usesDefaultFeatures = false;
-            features = [ "i128" ];
-          }
-          {
-            name = "rand";
-            packageId = "rand 0.8.8";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
-          {
-            name = "smallvec";
-            packageId = "smallvec";
-            usesDefaultFeatures = false;
-          }
-          {
-            name = "zeroize";
-            packageId = "zeroize";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
-        ];
-        devDependencies = [
-          {
-            name = "rand";
-            packageId = "rand 0.8.8";
-            features = [ "small_rng" ];
-          }
-        ];
-        features = {
-          "arbitrary" = [ "dep:arbitrary" ];
-          "default" = [ "std" "u64_digit" ];
-          "fuzz" = [ "arbitrary" "smallvec/arbitrary" ];
-          "prime" = [ "rand/std_rng" ];
-          "rand" = [ "dep:rand" ];
-          "serde" = [ "dep:serde" ];
-          "std" = [ "num-integer/std" "num-traits/std" "smallvec/write" "rand/std" "serde/std" ];
-          "zeroize" = [ "dep:zeroize" ];
-        };
-        resolvedDefaultFeatures = [ "i128" "prime" "rand" "u64_digit" "zeroize" ];
-      };
       "num-conv" = rec {
         crateName = "num-conv";
         version = "0.2.2";
@@ -6566,57 +6566,6 @@ rec {
         ];
 
       };
-      "num-integer" = rec {
-        crateName = "num-integer";
-        version = "0.1.47";
-        edition = "2018";
-        sha256 = "02z1p3azy6p10n99skrab4a6hhfd4amf2i9gm8sxqd1p9dfxkqkw";
-        libName = "num_integer";
-        authors = [
-          "The Rust Project Developers"
-        ];
-        dependencies = [
-          {
-            name = "num-traits";
-            packageId = "num-traits";
-            usesDefaultFeatures = false;
-            features = [ "i128" ];
-          }
-        ];
-        features = {
-          "default" = [ "std" ];
-          "std" = [ "num-traits/std" ];
-        };
-        resolvedDefaultFeatures = [ "i128" ];
-      };
-      "num-iter" = rec {
-        crateName = "num-iter";
-        version = "0.1.46";
-        edition = "2018";
-        sha256 = "12q4x0lp9l6bvsak1p5q24lvfzl99ak9vzmwhqbwksm1d6yh0a69";
-        libName = "num_iter";
-        authors = [
-          "The Rust Project Developers"
-        ];
-        dependencies = [
-          {
-            name = "num-integer";
-            packageId = "num-integer";
-            usesDefaultFeatures = false;
-            features = [ "i128" ];
-          }
-          {
-            name = "num-traits";
-            packageId = "num-traits";
-            usesDefaultFeatures = false;
-            features = [ "i128" ];
-          }
-        ];
-        features = {
-          "default" = [ "std" ];
-          "std" = [ "num-integer/std" "num-traits/std" ];
-        };
-      };
       "num-traits" = rec {
         crateName = "num-traits";
         version = "0.2.19";
@@ -6626,13 +6575,6 @@ rec {
         authors = [
           "The Rust Project Developers"
         ];
-        dependencies = [
-          {
-            name = "libm";
-            packageId = "libm";
-            optional = true;
-          }
-        ];
         buildDependencies = [
           {
             name = "autocfg";
@@ -6643,7 +6585,7 @@ rec {
           "default" = [ "std" ];
           "libm" = [ "dep:libm" ];
         };
-        resolvedDefaultFeatures = [ "default" "i128" "libm" "std" ];
+        resolvedDefaultFeatures = [ "default" "std" ];
       };
       "once_cell" = rec {
         crateName = "once_cell";
@@ -7176,9 +7118,9 @@ rec {
       };
       "p256" = rec {
         crateName = "p256";
-        version = "0.13.2";
-        edition = "2021";
-        sha256 = "0jyd3c3k239ybs59ixpnl7dqkmm072fr1js8kh7ldx58bzc3m1n9";
+        version = "0.14.0";
+        edition = "2024";
+        sha256 = "0appw4ifrx2zwyw2rrmb18x0qid75vvqqzhlpvdpm05w5ndj7jfj";
         authors = [
           "RustCrypto Developers"
         ];
@@ -7195,7 +7137,12 @@ rec {
             name = "elliptic-curve";
             packageId = "elliptic-curve";
             usesDefaultFeatures = false;
-            features = [ "hazmat" "sec1" ];
+            features = [ "sec1" ];
+          }
+          {
+            name = "primefield";
+            packageId = "primefield";
+            optional = true;
           }
           {
             name = "primeorder";
@@ -7217,6 +7164,10 @@ rec {
             usesDefaultFeatures = false;
             features = [ "dev" ];
           }
+          {
+            name = "primefield";
+            packageId = "primefield";
+          }
           {
             name = "primeorder";
             packageId = "primeorder";
@@ -7224,28 +7175,28 @@ rec {
           }
         ];
         features = {
-          "alloc" = [ "ecdsa-core?/alloc" "elliptic-curve/alloc" ];
-          "arithmetic" = [ "dep:primeorder" "elliptic-curve/arithmetic" ];
-          "bits" = [ "arithmetic" "elliptic-curve/bits" ];
-          "default" = [ "arithmetic" "ecdsa" "pem" "std" ];
-          "digest" = [ "ecdsa-core/digest" "ecdsa-core/hazmat" ];
+          "alloc" = [ "ecdsa-core?/alloc" "elliptic-curve/alloc" "primeorder?/alloc" ];
+          "arithmetic" = [ "dep:primefield" "dep:primeorder" "elliptic-curve/arithmetic" ];
+          "default" = [ "arithmetic" "ecdsa" "pem" "precomputed-tables" "std" ];
+          "digest" = [ "ecdsa-core/digest" ];
           "ecdh" = [ "arithmetic" "elliptic-curve/ecdh" ];
-          "ecdsa" = [ "arithmetic" "ecdsa-core/signing" "ecdsa-core/verifying" "sha256" ];
+          "ecdsa" = [ "arithmetic" "ecdsa-core/algorithm" "sha256" ];
           "ecdsa-core" = [ "dep:ecdsa-core" ];
-          "expose-field" = [ "arithmetic" ];
-          "hash2curve" = [ "arithmetic" "elliptic-curve/hash2curve" ];
-          "jwk" = [ "elliptic-curve/jwk" ];
+          "getrandom" = [ "elliptic-curve/getrandom" ];
+          "group-digest" = [ "hash2curve" "sha2" ];
+          "hash2curve" = [ "arithmetic" "dep:hash2curve" "primeorder/hash2curve" ];
+          "oprf" = [ "group-digest" ];
           "pem" = [ "elliptic-curve/pem" "ecdsa-core/pem" "pkcs8" ];
           "pkcs8" = [ "ecdsa-core?/pkcs8" "elliptic-curve/pkcs8" ];
+          "precomputed-tables" = [ "arithmetic" "primeorder/basepoint-table" ];
           "serde" = [ "ecdsa-core?/serde" "elliptic-curve/serde" "primeorder?/serde" "serdect" ];
           "serdect" = [ "dep:serdect" ];
           "sha2" = [ "dep:sha2" ];
           "sha256" = [ "digest" "sha2" ];
-          "std" = [ "alloc" "ecdsa-core?/std" "elliptic-curve/std" ];
+          "std" = [ "alloc" "ecdsa-core?/std" "elliptic-curve/std" "getrandom" "primeorder?/std" ];
           "test-vectors" = [ "dep:hex-literal" ];
-          "voprf" = [ "elliptic-curve/voprf" "sha2" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "arithmetic" "default" "digest" "ecdsa" "ecdsa-core" "pem" "pkcs8" "sha2" "sha256" "std" ];
+        resolvedDefaultFeatures = [ "alloc" "arithmetic" "default" "digest" "ecdsa" "ecdsa-core" "getrandom" "pem" "pkcs8" "precomputed-tables" "sha2" "sha256" "std" ];
       };
       "parking" = rec {
         crateName = "parking";
@@ -7357,9 +7308,9 @@ rec {
       };
       "pem-rfc7468" = rec {
         crateName = "pem-rfc7468";
-        version = "0.7.0";
-        edition = "2021";
-        sha256 = "04l4852scl4zdva31c1z6jafbak0ni5pi0j38ml108zwzjdrrcw8";
+        version = "1.0.0";
+        edition = "2024";
+        sha256 = "1nck8ig71axy21lsick2f9vcw7329mlx2hs88d382wz7w0im8c56";
         libName = "pem_rfc7468";
         authors = [
           "RustCrypto Developers"
@@ -7393,9 +7344,9 @@ rec {
       };
       "pest" = rec {
         crateName = "pest";
-        version = "2.9.3";
+        version = "2.9.4";
         edition = "2021";
-        sha256 = "1yhr35ds3c5ww7nvh9nvs842p40nmwgqj7ql4z3accwbld5kfs5m";
+        sha256 = "08xvj2lwj450ki4mmr5s369pfgk5fq6vy8kyki1b7hybm5ha8izx";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7432,9 +7383,9 @@ rec {
       };
       "pest_derive" = rec {
         crateName = "pest_derive";
-        version = "2.9.3";
+        version = "2.9.4";
         edition = "2021";
-        sha256 = "0zygma96zndmadjsg6m353ak48ziab55c8mb43zsmsscj95ihvmn";
+        sha256 = "0i7g26dkang3zyl0hvcfdfsaz713i77r70v0n6d53xq8fxllcgi0";
         procMacro = true;
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
@@ -7460,9 +7411,9 @@ rec {
       };
       "pest_generator" = rec {
         crateName = "pest_generator";
-        version = "2.9.3";
+        version = "2.9.4";
         edition = "2021";
-        sha256 = "150nhpb5mh4vx1gmgl3fmix953pmy3r595xg4sk59pp4cz97hx58";
+        sha256 = "1mflbrhm9abanrgf43fdhhj0psfgyf635kvkzin3v3a518sfcjp8";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7498,9 +7449,9 @@ rec {
       };
       "pest_meta" = rec {
         crateName = "pest_meta";
-        version = "2.9.3";
+        version = "2.9.4";
         edition = "2021";
-        sha256 = "1qb9r2akz8q1wbvwmdipiaq06km3m8wn27w3kcssqha2icj6z62g";
+        sha256 = "04774dlh7acgf8hzl0w11dbp4q3ay3qwvxfqixcydg1x5grr4zxm";
         authors = [
           "Dragoș Tiselice <dragostiselice@gmail.com>"
         ];
@@ -7563,9 +7514,9 @@ rec {
       };
       "pkcs1" = rec {
         crateName = "pkcs1";
-        version = "0.7.5";
-        edition = "2021";
-        sha256 = "0zz4mil3nchnxljdfs2k5ab1cjqn7kq5lqp62n9qfix01zqvkzy8";
+        version = "0.8.0-rc.5";
+        edition = "2024";
+        sha256 = "1hyvfdh70yq51c2dzhxfm6w6wy8scn8waayqlz56rslkwapxp1gl";
         authors = [
           "RustCrypto Developers"
         ];
@@ -7575,31 +7526,24 @@ rec {
             packageId = "der";
             features = [ "oid" ];
           }
-          {
-            name = "pkcs8";
-            packageId = "pkcs8";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
           {
             name = "spki";
             packageId = "spki";
           }
         ];
         features = {
-          "alloc" = [ "der/alloc" "zeroize" "pkcs8?/alloc" ];
-          "pem" = [ "alloc" "der/pem" "pkcs8?/pem" ];
-          "pkcs8" = [ "dep:pkcs8" ];
+          "alloc" = [ "der/alloc" "spki/alloc" "zeroize" ];
+          "pem" = [ "alloc" "der/pem" ];
           "std" = [ "der/std" "alloc" ];
           "zeroize" = [ "der/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "pem" "pkcs8" "std" "zeroize" ];
+        resolvedDefaultFeatures = [ "alloc" "pem" "std" "zeroize" ];
       };
       "pkcs8" = rec {
         crateName = "pkcs8";
-        version = "0.10.2";
-        edition = "2021";
-        sha256 = "1dx7w21gvn07azszgqd3ryjhyphsrjrmq5mmz1fbxkj5g0vv4l7r";
+        version = "0.11.0";
+        edition = "2024";
+        sha256 = "1dqwyaj018cb0dyawgj42a799s3ys81r13ga6ihaaxf7d7d166a5";
         authors = [
           "RustCrypto Developers"
         ];
@@ -7617,15 +7561,14 @@ rec {
         features = {
           "3des" = [ "encryption" "pkcs5/3des" ];
           "alloc" = [ "der/alloc" "der/zeroize" "spki/alloc" ];
+          "ctutils" = [ "dep:ctutils" ];
           "des-insecure" = [ "encryption" "pkcs5/des-insecure" ];
-          "encryption" = [ "alloc" "pkcs5/alloc" "pkcs5/pbes2" "rand_core" ];
-          "getrandom" = [ "rand_core/getrandom" ];
+          "encryption" = [ "alloc" "pkcs5/alloc" "pkcs5/pbes2" "dep:rand_core" ];
+          "getrandom" = [ "encryption" "pkcs5/getrandom" "dep:getrandom" ];
           "pem" = [ "alloc" "der/pem" "spki/pem" ];
           "pkcs5" = [ "dep:pkcs5" ];
-          "rand_core" = [ "dep:rand_core" ];
           "sha1-insecure" = [ "encryption" "pkcs5/sha1-insecure" ];
           "std" = [ "alloc" "der/std" "spki/std" ];
-          "subtle" = [ "dep:subtle" ];
         };
         resolvedDefaultFeatures = [ "alloc" "pem" "std" ];
       };
@@ -7734,11 +7677,57 @@ rec {
         };
         resolvedDefaultFeatures = [ "simd" "std" ];
       };
+      "primefield" = rec {
+        crateName = "primefield";
+        version = "0.14.0";
+        edition = "2024";
+        sha256 = "1x4jnnysiy9f41mmr6r7vinj0hl67df87302rf7iakkxxgjacmf5";
+        authors = [
+          "RustCrypto Developers"
+        ];
+        dependencies = [
+          {
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
+            rename = "bigint";
+            usesDefaultFeatures = false;
+            features = [ "rand_core" "hybrid-array" "subtle" ];
+          }
+          {
+            name = "crypto-common";
+            packageId = "crypto-common";
+            rename = "common";
+            features = [ "rand_core" ];
+          }
+          {
+            name = "ff";
+            packageId = "ff";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "rand_core";
+            packageId = "rand_core 0.10.1";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "subtle";
+            packageId = "subtle";
+            usesDefaultFeatures = false;
+            features = [ "const-generics" ];
+          }
+          {
+            name = "zeroize";
+            packageId = "zeroize";
+            usesDefaultFeatures = false;
+          }
+        ];
+
+      };
       "primeorder" = rec {
         crateName = "primeorder";
-        version = "0.13.6";
-        edition = "2021";
-        sha256 = "1rp16710mxksagcjnxqjjq9r9wf5vf72fs8wxffnvhb6i6hiqgim";
+        version = "0.14.0";
+        edition = "2024";
+        sha256 = "01kvs3fgr25m9w50594xwsxdwd52awzc17znd0yhx83qijbl57sw";
         authors = [
           "RustCrypto Developers"
         ];
@@ -7749,13 +7738,37 @@ rec {
             usesDefaultFeatures = false;
             features = [ "arithmetic" "sec1" ];
           }
+          {
+            name = "once_cell";
+            packageId = "once_cell";
+            optional = true;
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "primefield";
+            packageId = "primefield";
+          }
+          {
+            name = "serdect";
+            packageId = "serdect";
+            optional = true;
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "wnaf";
+            packageId = "wnaf";
+            usesDefaultFeatures = false;
+          }
         ];
         features = {
-          "alloc" = [ "elliptic-curve/alloc" ];
+          "alloc" = [ "elliptic-curve/alloc" "serdect?/alloc" ];
+          "critical-section" = [ "basepoint-table" "once_cell/critical-section" ];
+          "once_cell" = [ "dep:once_cell" ];
           "serde" = [ "elliptic-curve/serde" "serdect" ];
           "serdect" = [ "dep:serdect" ];
-          "std" = [ "alloc" "elliptic-curve/std" ];
+          "std" = [ "alloc" "elliptic-curve/std" "once_cell?/std" ];
         };
+        resolvedDefaultFeatures = [ "alloc" "basepoint-table" "std" ];
       };
       "proc-macro-crate" = rec {
         crateName = "proc-macro-crate";
@@ -7991,40 +8004,6 @@ rec {
         };
         resolvedDefaultFeatures = [ "alloc" "default" "std" "std_rng" "sys_rng" "thread_rng" ];
       };
-      "rand 0.8.8" = rec {
-        crateName = "rand";
-        version = "0.8.8";
-        edition = "2018";
-        sha256 = "0k3d9psya5icpiylff1w1wjbnc3q4pb1953n1iw7gbr61ggcfn70";
-        authors = [
-          "The Rand Project Developers"
-          "The Rust Project Developers"
-        ];
-        dependencies = [
-          {
-            name = "rand_chacha";
-            packageId = "rand_chacha 0.3.1";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
-          {
-            name = "rand_core";
-            packageId = "rand_core 0.6.4";
-          }
-        ];
-        features = {
-          "alloc" = [ "rand_core/alloc" ];
-          "default" = [ "std" "std_rng" ];
-          "getrandom" = [ "rand_core/getrandom" ];
-          "libc" = [ "dep:libc" ];
-          "rand_chacha" = [ "dep:rand_chacha" ];
-          "serde" = [ "dep:serde" ];
-          "serde1" = [ "serde" "rand_core/serde1" ];
-          "std" = [ "rand_core/std" "rand_chacha/std" "alloc" "getrandom" "libc" ];
-          "std_rng" = [ "rand_chacha" ];
-        };
-        resolvedDefaultFeatures = [ "rand_chacha" "std_rng" ];
-      };
       "rand 0.9.5" = rec {
         crateName = "rand";
         version = "0.9.5";
@@ -8037,7 +8016,7 @@ rec {
         dependencies = [
           {
             name = "rand_chacha";
-            packageId = "rand_chacha 0.9.0";
+            packageId = "rand_chacha";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -8057,36 +8036,7 @@ rec {
         };
         resolvedDefaultFeatures = [ "alloc" "os_rng" "small_rng" "std" "std_rng" "thread_rng" ];
       };
-      "rand_chacha 0.3.1" = rec {
-        crateName = "rand_chacha";
-        version = "0.3.1";
-        edition = "2018";
-        sha256 = "123x2adin558xbhvqb8w4f6syjsdkmqff8cxwhmjacpsl1ihmhg6";
-        authors = [
-          "The Rand Project Developers"
-          "The Rust Project Developers"
-          "The CryptoCorrosion Contributors"
-        ];
-        dependencies = [
-          {
-            name = "ppv-lite86";
-            packageId = "ppv-lite86";
-            usesDefaultFeatures = false;
-            features = [ "simd" ];
-          }
-          {
-            name = "rand_core";
-            packageId = "rand_core 0.6.4";
-          }
-        ];
-        features = {
-          "default" = [ "std" ];
-          "serde" = [ "dep:serde" ];
-          "serde1" = [ "serde" ];
-          "std" = [ "ppv-lite86/std" ];
-        };
-      };
-      "rand_chacha 0.9.0" = rec {
+      "rand_chacha" = rec {
         crateName = "rand_chacha";
         version = "0.9.0";
         edition = "2021";
@@ -8133,30 +8083,6 @@ rec {
         ];
 
       };
-      "rand_core 0.6.4" = rec {
-        crateName = "rand_core";
-        version = "0.6.4";
-        edition = "2018";
-        sha256 = "0b4j2v4cb5krak1pv6kakv4sz6xcwbrmy2zckc32hsigbrwy82zc";
-        authors = [
-          "The Rand Project Developers"
-          "The Rust Project Developers"
-        ];
-        dependencies = [
-          {
-            name = "getrandom";
-            packageId = "getrandom 0.2.17";
-            optional = true;
-          }
-        ];
-        features = {
-          "getrandom" = [ "dep:getrandom" ];
-          "serde" = [ "dep:serde" ];
-          "serde1" = [ "serde" ];
-          "std" = [ "alloc" "getrandom" "getrandom/std" ];
-        };
-        resolvedDefaultFeatures = [ "alloc" "getrandom" "std" ];
-      };
       "rand_core 0.9.5" = rec {
         crateName = "rand_core";
         version = "0.9.5";
@@ -8603,23 +8529,32 @@ rec {
       };
       "rfc6979" = rec {
         crateName = "rfc6979";
-        version = "0.4.0";
-        edition = "2021";
-        sha256 = "1chw95jgcfrysyzsq6a10b1j5qb7bagkx8h0wda4lv25in02mpgq";
+        version = "0.6.0";
+        edition = "2024";
+        sha256 = "0aqpi1rynmj6np3lvdpy041w8rkm004133zx65myfgzvvb6mk95l";
         authors = [
           "RustCrypto Developers"
         ];
         dependencies = [
+          {
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
+            rename = "bigint";
+            usesDefaultFeatures = false;
+          }
           {
             name = "hmac";
             packageId = "hmac";
             usesDefaultFeatures = false;
-            features = [ "reset" ];
           }
+        ];
+        devDependencies = [
           {
-            name = "subtle";
-            packageId = "subtle";
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
+            rename = "bigint";
             usesDefaultFeatures = false;
+            features = [ "alloc" ];
           }
         ];
 
@@ -8687,9 +8622,9 @@ rec {
       };
       "rsa" = rec {
         crateName = "rsa";
-        version = "0.9.10";
+        version = "0.10.0-rc.19";
         edition = "2021";
-        sha256 = "0bdikdwhcvl1gfh4637m5rdw3fgcl752aiygvzmwlgc8yl1kymxq";
+        sha256 = "119bbjvkxiqipy4gn0ghgwygvan30illy9bflqf99vqn3qr5wh1k";
         authors = [
           "RustCrypto Developers"
           "dignifiedquire <dignifiedquire@gmail.com>"
@@ -8701,44 +8636,39 @@ rec {
             usesDefaultFeatures = false;
           }
           {
-            name = "digest";
-            packageId = "digest";
-            usesDefaultFeatures = false;
-            features = [ "alloc" "oid" ];
-          }
-          {
-            name = "num-bigint-dig";
-            packageId = "num-bigint-dig";
-            rename = "num-bigint";
+            name = "crypto-bigint";
+            packageId = "crypto-bigint";
             usesDefaultFeatures = false;
-            features = [ "i128" "prime" "zeroize" ];
+            features = [ "zeroize" "alloc" ];
           }
           {
-            name = "num-integer";
-            packageId = "num-integer";
+            name = "crypto-primes";
+            packageId = "crypto-primes";
             usesDefaultFeatures = false;
           }
           {
-            name = "num-traits";
-            packageId = "num-traits";
+            name = "digest";
+            packageId = "digest";
             usesDefaultFeatures = false;
-            features = [ "libm" ];
+            features = [ "alloc" "oid" ];
           }
           {
             name = "pkcs1";
             packageId = "pkcs1";
+            optional = true;
             usesDefaultFeatures = false;
-            features = [ "alloc" "pkcs8" ];
+            features = [ "alloc" "pem" ];
           }
           {
             name = "pkcs8";
             packageId = "pkcs8";
+            optional = true;
             usesDefaultFeatures = false;
-            features = [ "alloc" ];
+            features = [ "alloc" "pem" ];
           }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             usesDefaultFeatures = false;
           }
           {
@@ -8757,14 +8687,10 @@ rec {
           {
             name = "spki";
             packageId = "spki";
+            optional = true;
             usesDefaultFeatures = false;
             features = [ "alloc" ];
           }
-          {
-            name = "subtle";
-            packageId = "subtle";
-            usesDefaultFeatures = false;
-          }
           {
             name = "zeroize";
             packageId = "zeroize";
@@ -8774,7 +8700,7 @@ rec {
         devDependencies = [
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             usesDefaultFeatures = false;
           }
           {
@@ -8785,18 +8711,17 @@ rec {
           }
         ];
         features = {
-          "default" = [ "std" "pem" "u64_digit" ];
-          "getrandom" = [ "rand_core/getrandom" ];
-          "nightly" = [ "num-bigint/nightly" ];
-          "pem" = [ "pkcs1/pem" "pkcs8/pem" ];
+          "crypto-common" = [ "dep:crypto-common" ];
+          "default" = [ "std" "encoding" ];
+          "encoding" = [ "dep:pkcs1" "dep:pkcs8" "dep:spki" ];
+          "getrandom" = [ "crypto-bigint/getrandom" "crypto-common" ];
           "pkcs5" = [ "pkcs8/encryption" ];
-          "serde" = [ "dep:serde" "num-bigint/serde" ];
+          "serde" = [ "encoding" "dep:serde" "dep:serdect" "crypto-bigint/serde" ];
           "sha1" = [ "dep:sha1" ];
           "sha2" = [ "dep:sha2" ];
-          "std" = [ "digest/std" "pkcs1/std" "pkcs8/std" "rand_core/std" "signature/std" ];
-          "u64_digit" = [ "num-bigint/u64_digit" ];
+          "std" = [ "pkcs1?/std" "pkcs8?/std" ];
         };
-        resolvedDefaultFeatures = [ "default" "pem" "sha2" "std" "u64_digit" ];
+        resolvedDefaultFeatures = [ "default" "encoding" "sha2" "std" ];
       };
       "rstest" = rec {
         crateName = "rstest";
@@ -9161,9 +9086,9 @@ rec {
       };
       "rustls-webpki" = rec {
         crateName = "rustls-webpki";
-        version = "0.103.15";
+        version = "0.103.16";
         edition = "2021";
-        sha256 = "1hhanq3lz384v4nccacnjfwsyy99n3yc6m6iw8kljz8yicfwzhzk";
+        sha256 = "10djm2f00xzi5qlbcfqjhhn2smk2h9aw8b4l74qncz4xsfvb2hs4";
         libName = "webpki";
         dependencies = [
           {
@@ -9238,9 +9163,9 @@ rec {
       };
       "schannel" = rec {
         crateName = "schannel";
-        version = "0.1.29";
+        version = "0.1.30";
         edition = "2018";
-        sha256 = "0ffrzz5vf2s3gnzvphgb5gg8fqifvryl07qcf7q3x1scj3jbghci";
+        sha256 = "1das969n0zgq630zx56mcw062aky4g57fdl19nxl3s4f9m13rclw";
         authors = [
           "Steven Fackler <sfackler@gmail.com>"
           "Steffen Butzer <steffen.butzer@outlook.com>"
@@ -9390,9 +9315,9 @@ rec {
       };
       "sec1" = rec {
         crateName = "sec1";
-        version = "0.7.3";
-        edition = "2021";
-        sha256 = "1p273j8c87pid6a1iyyc7vxbvifrw55wbxgr0dh3l8vnbxb7msfk";
+        version = "0.8.1";
+        edition = "2024";
+        sha256 = "0k8fm3c0j2hb9bs5mgnksk9g75ny65w50bhjyzjkq80r5xy46vfm";
         authors = [
           "RustCrypto Developers"
         ];
@@ -9404,20 +9329,19 @@ rec {
             usesDefaultFeatures = false;
           }
           {
-            name = "der";
-            packageId = "der";
+            name = "ctutils";
+            packageId = "ctutils";
             optional = true;
-            features = [ "oid" ];
           }
           {
-            name = "generic-array";
-            packageId = "generic-array";
+            name = "der";
+            packageId = "der";
             optional = true;
-            usesDefaultFeatures = false;
+            features = [ "oid" ];
           }
           {
-            name = "pkcs8";
-            packageId = "pkcs8";
+            name = "hybrid-array";
+            packageId = "hybrid-array";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -9435,18 +9359,18 @@ rec {
           }
         ];
         features = {
-          "alloc" = [ "der?/alloc" "pkcs8?/alloc" "zeroize?/alloc" ];
+          "alloc" = [ "der?/alloc" "zeroize?/alloc" ];
+          "ctutils" = [ "dep:ctutils" ];
           "default" = [ "der" "point" ];
           "der" = [ "dep:der" "zeroize" ];
-          "pem" = [ "alloc" "der/pem" "pkcs8/pem" ];
-          "pkcs8" = [ "dep:pkcs8" ];
-          "point" = [ "dep:base16ct" "dep:generic-array" ];
+          "pem" = [ "alloc" "der/pem" ];
+          "point" = [ "dep:base16ct" "dep:hybrid-array" ];
           "serde" = [ "dep:serdect" ];
           "std" = [ "alloc" "der?/std" ];
           "subtle" = [ "dep:subtle" ];
           "zeroize" = [ "dep:zeroize" "der?/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "default" "der" "pem" "pkcs8" "point" "std" "subtle" "zeroize" ];
+        resolvedDefaultFeatures = [ "alloc" "ctutils" "default" "der" "pem" "point" "std" "subtle" "zeroize" ];
       };
       "secrecy" = rec {
         crateName = "secrecy";
@@ -9900,11 +9824,47 @@ rec {
         ];
 
       };
+      "serdect" = rec {
+        crateName = "serdect";
+        version = "0.4.3";
+        edition = "2024";
+        sha256 = "0ghby2vq4k21xlpy3v8897rym4pvvwil5cxw0qjg3z6jrvnqzkv6";
+        authors = [
+          "RustCrypto Developers"
+        ];
+        dependencies = [
+          {
+            name = "base16ct";
+            packageId = "base16ct";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "serde";
+            packageId = "serde";
+            usesDefaultFeatures = false;
+          }
+        ];
+        devDependencies = [
+          {
+            name = "serde";
+            packageId = "serde";
+            usesDefaultFeatures = false;
+            features = [ "derive" ];
+          }
+        ];
+        features = {
+          "alloc" = [ "base16ct/alloc" "serde/alloc" ];
+          "default" = [ "alloc" ];
+          "derive" = [ "serde/derive" ];
+          "zeroize" = [ "dep:zeroize" ];
+        };
+        resolvedDefaultFeatures = [ "alloc" ];
+      };
       "sha1" = rec {
         crateName = "sha1";
-        version = "0.10.7";
-        edition = "2018";
-        sha256 = "1f632d529qzz95yrprr632w1fxqkrv6b6jksjc11vnzl049lay59";
+        version = "0.11.0";
+        edition = "2024";
+        sha256 = "05025pf8d8zr2qq5xyh5m3wqls1fn7813gz1mfs7551mk724rk5a";
         authors = [
           "RustCrypto Developers"
         ];
@@ -9915,7 +9875,7 @@ rec {
           }
           {
             name = "cpufeatures";
-            packageId = "cpufeatures 0.2.17";
+            packageId = "cpufeatures";
             target = { target, features }: (("aarch64" == target."arch" or null) || ("x86" == target."arch" or null) || ("x86_64" == target."arch" or null));
           }
           {
@@ -9931,17 +9891,17 @@ rec {
           }
         ];
         features = {
-          "default" = [ "std" ];
+          "alloc" = [ "digest/alloc" ];
+          "default" = [ "alloc" "oid" ];
           "oid" = [ "digest/oid" ];
-          "std" = [ "digest/std" ];
+          "zeroize" = [ "digest/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "default" "std" ];
       };
       "sha2" = rec {
         crateName = "sha2";
-        version = "0.10.9";
-        edition = "2018";
-        sha256 = "10xjj843v31ghsksd9sl9y12qfc48157j1xpb8v1ml39jy0psl57";
+        version = "0.11.1";
+        edition = "2024";
+        sha256 = "06ddr559jvwx17d7847l6i1g4hrlwy39j0yimjwwfskxxfdhdms7";
         authors = [
           "RustCrypto Developers"
         ];
@@ -9952,7 +9912,7 @@ rec {
           }
           {
             name = "cpufeatures";
-            packageId = "cpufeatures 0.2.17";
+            packageId = "cpufeatures";
             target = { target, features }: (("aarch64" == target."arch" or null) || ("x86_64" == target."arch" or null) || ("x86" == target."arch" or null));
           }
           {
@@ -9968,14 +9928,12 @@ rec {
           }
         ];
         features = {
-          "asm" = [ "sha2-asm" ];
-          "asm-aarch64" = [ "asm" ];
-          "default" = [ "std" ];
+          "alloc" = [ "digest/alloc" ];
+          "default" = [ "alloc" "oid" ];
           "oid" = [ "digest/oid" ];
-          "sha2-asm" = [ "dep:sha2-asm" ];
-          "std" = [ "digest/std" ];
+          "zeroize" = [ "digest/zeroize" ];
         };
-        resolvedDefaultFeatures = [ "default" "oid" "std" ];
+        resolvedDefaultFeatures = [ "alloc" "default" "oid" ];
       };
       "sharded-slab" = rec {
         crateName = "sharded-slab";
@@ -10038,9 +9996,9 @@ rec {
       };
       "signature" = rec {
         crateName = "signature";
-        version = "2.2.0";
-        edition = "2021";
-        sha256 = "1pi9hd5vqfr3q3k49k37z06p7gs5si0in32qia4mmr1dancr6m3p";
+        version = "3.0.0";
+        edition = "2024";
+        sha256 = "1x9pfp51h2a0xs4x768q5r0y9yazv5naf216mjw9q17hpbf6gm98";
         authors = [
           "RustCrypto Developers"
         ];
@@ -10053,18 +10011,16 @@ rec {
           }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
             optional = true;
             usesDefaultFeatures = false;
           }
         ];
         features = {
-          "derive" = [ "dep:derive" ];
           "digest" = [ "dep:digest" ];
           "rand_core" = [ "dep:rand_core" ];
-          "std" = [ "alloc" "rand_core?/std" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "digest" "rand_core" "std" ];
+        resolvedDefaultFeatures = [ "alloc" "digest" "rand_core" ];
       };
       "simd-adler32" = rec {
         crateName = "simd-adler32";
@@ -10302,36 +10258,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "all" ];
       };
-      "spin" = rec {
-        crateName = "spin";
-        version = "0.9.9";
-        edition = "2015";
-        sha256 = "03psal0vh1xdxp7agphw09p7kf50v3bj1zshijq1s5bkdd7jcqrp";
-        authors = [
-          "Mathijs van de Nes <git@mathijs.vd-nes.nl>"
-          "John Ericson <git@JohnEricson.me>"
-          "Joshua Barretto <joshua.s.barretto@gmail.com>"
-        ];
-        features = {
-          "barrier" = [ "mutex" ];
-          "default" = [ "lock_api" "mutex" "spin_mutex" "rwlock" "once" "lazy" "barrier" ];
-          "fair_mutex" = [ "mutex" ];
-          "lazy" = [ "once" ];
-          "lock_api" = [ "lock_api_crate" ];
-          "lock_api_crate" = [ "dep:lock_api_crate" ];
-          "portable-atomic" = [ "dep:portable-atomic" ];
-          "portable_atomic" = [ "portable-atomic" ];
-          "spin_mutex" = [ "mutex" ];
-          "ticket_mutex" = [ "mutex" ];
-          "use_ticket_mutex" = [ "mutex" "ticket_mutex" ];
-        };
-        resolvedDefaultFeatures = [ "once" ];
-      };
       "spki" = rec {
         crateName = "spki";
-        version = "0.7.3";
-        edition = "2021";
-        sha256 = "17fj8k5fmx4w9mp27l970clrh5qa7r5sjdvbsln987xhb34dc7nr";
+        version = "0.8.1";
+        edition = "2024";
+        sha256 = "1aci2hbcr0qbmhndkc4dl5i1w7p6yglld2f7ry8a4pcxiflmiyby";
         authors = [
           "RustCrypto Developers"
         ];
@@ -10352,7 +10283,8 @@ rec {
           "alloc" = [ "base64ct?/alloc" "der/alloc" ];
           "arbitrary" = [ "std" "dep:arbitrary" "der/arbitrary" ];
           "base64" = [ "dep:base64ct" ];
-          "fingerprint" = [ "sha2" ];
+          "digest" = [ "dep:digest" ];
+          "fingerprint" = [ "digest" "sha2" ];
           "pem" = [ "alloc" "der/pem" ];
           "sha2" = [ "dep:sha2" ];
           "std" = [ "der/std" "alloc" ];
@@ -10372,6 +10304,49 @@ rec {
           "std" = [ "alloc" ];
         };
       };
+      "stackable-agent" = rec {
+        crateName = "stackable-agent";
+        version = "0.1.0";
+        edition = "2024";
+        workspace_member = null;
+        src = pkgs.fetchgit {
+          url = "https://github.com/stackabletech/operator-rs.git";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
+        };
+        libName = "stackable_agent";
+        authors = [
+          "Stackable GmbH <info@stackable.de>"
+        ];
+        dependencies = [
+          {
+            name = "k8s-openapi";
+            packageId = "k8s-openapi";
+            usesDefaultFeatures = false;
+            features = [ "schemars" "v1_36" ];
+          }
+          {
+            name = "schemars";
+            packageId = "schemars";
+            features = [ "url2" ];
+          }
+          {
+            name = "serde";
+            packageId = "serde";
+            features = [ "derive" ];
+          }
+          {
+            name = "stackable-versioned";
+            packageId = "stackable-versioned";
+          }
+          {
+            name = "strum";
+            packageId = "strum";
+            features = [ "derive" ];
+          }
+        ];
+
+      };
       "stackable-certs" = rec {
         crateName = "stackable-certs";
         version = "0.4.1";
@@ -10379,8 +10354,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_certs";
         authors = [
@@ -10420,7 +10395,7 @@ rec {
           }
           {
             name = "rand_core";
-            packageId = "rand_core 0.6.4";
+            packageId = "rand_core 0.10.1";
           }
           {
             name = "rsa";
@@ -10475,6 +10450,54 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" "rustls" ];
       };
+      "stackable-kafka-agent" = rec {
+        crateName = "stackable-kafka-agent";
+        version = "0.0.0-dev";
+        edition = "2024";
+        crateBin = [
+          {
+            name = "stackable-kafka-agent";
+            path = "src/main.rs";
+            requiredFeatures = [ ];
+          }
+        ];
+        src = lib.cleanSourceWith { filter = sourceFilter;  src = ./rust/agent-binary; };
+        authors = [
+          "Stackable GmbH <info@stackable.tech>"
+        ];
+        dependencies = [
+          {
+            name = "anyhow";
+            packageId = "anyhow";
+          }
+          {
+            name = "clap";
+            packageId = "clap";
+          }
+          {
+            name = "stackable-operator";
+            packageId = "stackable-operator";
+            features = [ "agent" "crds" "webhook" ];
+          }
+          {
+            name = "tokio";
+            packageId = "tokio";
+            features = [ "full" ];
+          }
+          {
+            name = "tracing";
+            packageId = "tracing";
+          }
+        ];
+        buildDependencies = [
+          {
+            name = "built";
+            packageId = "built";
+            features = [ "chrono" "git2" ];
+          }
+        ];
+
+      };
       "stackable-kafka-operator" = rec {
         crateName = "stackable-kafka-operator";
         version = "0.0.0-dev";
@@ -10528,10 +10551,14 @@ rec {
             name = "snafu";
             packageId = "snafu 0.9.2";
           }
+          {
+            name = "stackable-kafka-shared";
+            packageId = "stackable-kafka-shared";
+          }
           {
             name = "stackable-operator";
             packageId = "stackable-operator";
-            features = [ "crds" "webhook" ];
+            features = [ "agent" "crds" "webhook" ];
           }
           {
             name = "strum";
@@ -10562,6 +10589,35 @@ rec {
           }
         ];
 
+      };
+      "stackable-kafka-shared" = rec {
+        crateName = "stackable-kafka-shared";
+        version = "0.0.0-dev";
+        edition = "2024";
+        src = lib.cleanSourceWith { filter = sourceFilter;  src = ./rust/shared; };
+        libName = "stackable_kafka_shared";
+        authors = [
+          "Stackable GmbH <info@stackable.tech>"
+        ];
+        dependencies = [
+          {
+            name = "stackable-operator";
+            packageId = "stackable-operator";
+            features = [ "agent" "crds" "webhook" ];
+          }
+          {
+            name = "strum";
+            packageId = "strum";
+            features = [ "derive" ];
+          }
+        ];
+        devDependencies = [
+          {
+            name = "rstest";
+            packageId = "rstest";
+          }
+        ];
+
       };
       "stackable-operator" = rec {
         crateName = "stackable-operator";
@@ -10570,14 +10626,18 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_operator";
         authors = [
           "Stackable GmbH <info@stackable.de>"
         ];
         dependencies = [
+          {
+            name = "base16ct";
+            packageId = "base16ct";
+          }
           {
             name = "base64";
             packageId = "base64 0.23.1";
@@ -10682,6 +10742,11 @@ rec {
             name = "snafu";
             packageId = "snafu 0.9.2";
           }
+          {
+            name = "stackable-agent";
+            packageId = "stackable-agent";
+            optional = true;
+          }
           {
             name = "stackable-operator-derive";
             packageId = "stackable-operator-derive";
@@ -10748,11 +10813,12 @@ rec {
           }
         ];
         features = {
+          "agent" = [ "dep:stackable-agent" ];
           "certs" = [ "dep:stackable-certs" ];
           "client-feature-gates" = [ "dep:winnow" ];
           "crds" = [ "dep:stackable-versioned" ];
           "default" = [ "crds" ];
-          "full" = [ "client-feature-gates" "crds" "certs" "test-support" "time" "webhook" "kube-ws" "kube-cel" "kube-http-proxy" "kube-socks5" ];
+          "full" = [ "agent" "client-feature-gates" "crds" "certs" "test-support" "time" "webhook" "kube-ws" "kube-cel" "kube-http-proxy" "kube-socks5" ];
           "kube-cel" = [ "kube/cel" ];
           "kube-http-proxy" = [ "kube/http-proxy" ];
           "kube-socks5" = [ "kube/socks5" ];
@@ -10760,7 +10826,7 @@ rec {
           "time" = [ "stackable-shared/time" ];
           "webhook" = [ "dep:stackable-webhook" ];
         };
-        resolvedDefaultFeatures = [ "crds" "default" "webhook" ];
+        resolvedDefaultFeatures = [ "agent" "crds" "default" "webhook" ];
       };
       "stackable-operator-derive" = rec {
         crateName = "stackable-operator-derive";
@@ -10769,8 +10835,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         procMacro = true;
         libName = "stackable_operator_derive";
@@ -10804,8 +10870,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_shared";
         authors = [
@@ -10885,8 +10951,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_telemetry";
         authors = [
@@ -10995,8 +11061,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_versioned";
         authors = [
@@ -11031,10 +11097,6 @@ rec {
             name = "stackable-versioned-macros";
             packageId = "stackable-versioned-macros";
           }
-          {
-            name = "yaml_serde";
-            packageId = "yaml_serde";
-          }
         ];
 
       };
@@ -11045,8 +11107,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         procMacro = true;
         libName = "stackable_versioned_macros";
@@ -11109,8 +11171,8 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "433ac4fe45418d39631e683fac74cb49e11911f6";
-          sha256 = "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm";
+          rev = "46a18a9a4899976b702ca87f73430c6f12d17c56";
+          sha256 = "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7";
         };
         libName = "stackable_webhook";
         authors = [
@@ -11353,7 +11415,7 @@ rec {
         features = {
           "default" = [ "std" "i128" ];
         };
-        resolvedDefaultFeatures = [ "i128" ];
+        resolvedDefaultFeatures = [ "const-generics" "i128" ];
       };
       "symlink" = rec {
         crateName = "symlink";
@@ -11825,9 +11887,9 @@ rec {
       };
       "tokio" = rec {
         crateName = "tokio";
-        version = "1.53.3";
+        version = "1.54.1";
         edition = "2021";
-        sha256 = "0kny1nnbpy11dllv6ncxy3n804wh0ddn3msq78rxl744f7x3acyf";
+        sha256 = "18wn0c3yvy6ld8yis0fw6rqkc4rwnmv5mav4fan6zljqa8jx6bxm";
         authors = [
           "Tokio Contributors <team@tokio.rs>"
         ];
@@ -11888,7 +11950,7 @@ rec {
             name = "socket2";
             packageId = "socket2";
             optional = true;
-            target = { target, features }: ((!(builtins.elem "wasm" target."family")) || (("wasi" == target."os" or null) && (!("p1" == target."env" or null))));
+            target = { target, features }: ((!(builtins.elem "wasm" target."family")) || ("emscripten" == target."os" or null) || (("wasi" == target."os" or null) && (!("p1" == target."env" or null))));
             features = [ "all" ];
           }
           {
@@ -13175,6 +13237,7 @@ rec {
           "scale-info" = [ "dep:scale-info" ];
           "scale_info" = [ "scale-info/derive" ];
         };
+        resolvedDefaultFeatures = [ "const-generics" ];
       };
       "ucd-trie" = rec {
         crateName = "ucd-trie";
@@ -13339,9 +13402,9 @@ rec {
       };
       "uuid" = rec {
         crateName = "uuid";
-        version = "1.28.0";
+        version = "1.29.0";
         edition = "2021";
-        sha256 = "01mnlhz09hwdjaxwzjd6bql3fjb5zl9n8dzaxn7dvdxyhiiiihbw";
+        sha256 = "0525458ww4jwa0nw513jdrhgwxrldglzvfrbw5gnjl0cc88js3ja";
         authors = [
           "Ashley Mannix<ashleymannix@live.com.au>"
           "Dylan DPC<dylan.dpc@gmail.com>"
@@ -14187,9 +14250,9 @@ rec {
       };
       "webpki-root-certs" = rec {
         crateName = "webpki-root-certs";
-        version = "1.0.9";
+        version = "1.0.10";
         edition = "2021";
-        sha256 = "16qw59hxn1lln1615kb9rjy16pfxd1x8m9f9w6vwv36c5am58rdr";
+        sha256 = "1jzy361hdpb4p7mbpmfnj2lvsj2kqxa5aqfry1xzbfnq7zkq1v2q";
         libName = "webpki_root_certs";
         dependencies = [
           {
@@ -15045,6 +15108,41 @@ rec {
           "rustc-dep-of-std" = [ "dep:core" "dep:alloc" ];
         };
       };
+      "wnaf" = rec {
+        crateName = "wnaf";
+        version = "0.14.1";
+        edition = "2024";
+        sha256 = "1ypnjmp4jpfh58hmxqijgnzpxkyx861jg691k2zn4pnv7y5s2p3r";
+        authors = [
+          "RustCrypto Developers"
+        ];
+        dependencies = [
+          {
+            name = "ff";
+            packageId = "ff";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "group";
+            packageId = "group";
+            usesDefaultFeatures = false;
+          }
+          {
+            name = "hybrid-array";
+            packageId = "hybrid-array";
+            rename = "array";
+          }
+          {
+            name = "primefield";
+            packageId = "primefield";
+            usesDefaultFeatures = false;
+          }
+        ];
+        features = {
+          "alloc" = [ "array/alloc" "ff/alloc" "group/alloc" ];
+          "default" = [ "alloc" ];
+        };
+      };
       "writeable" = rec {
         crateName = "writeable";
         version = "0.6.4";
@@ -15060,9 +15158,9 @@ rec {
       };
       "x509-cert" = rec {
         crateName = "x509-cert";
-        version = "0.2.5";
-        edition = "2021";
-        sha256 = "155f42vm6m7phn8w7s2wmk9vli3ws45dqpk5z3jilw0a04syj08k";
+        version = "0.3.0";
+        edition = "2024";
+        sha256 = "12q37mnxnjhp9a8cl64rkvvavf08pzjd08ynhgpkgccw5mjg8phh";
         libName = "x509_cert";
         authors = [
           "RustCrypto Developers"
@@ -15082,6 +15180,7 @@ rec {
             name = "sha1";
             packageId = "sha1";
             optional = true;
+            usesDefaultFeatures = false;
           }
           {
             name = "signature";
@@ -15104,15 +15203,17 @@ rec {
         ];
         features = {
           "arbitrary" = [ "dep:arbitrary" "std" "der/arbitrary" "spki/arbitrary" ];
-          "builder" = [ "std" "sha1/default" "signature" ];
+          "base64" = [ "spki/base64" ];
+          "builder" = [ "dep:sha1" "signature" ];
           "default" = [ "pem" "std" ];
+          "digest" = [ "dep:digest" "spki/digest" ];
+          "fingerprint" = [ "spki/fingerprint" ];
           "pem" = [ "der/pem" "spki/pem" ];
           "sct" = [ "dep:tls_codec" ];
-          "sha1" = [ "dep:sha1" ];
           "signature" = [ "dep:signature" ];
-          "std" = [ "const-oid/std" "der/std" "spki/std" "tls_codec?/std" ];
+          "std" = [ "der/std" "spki/std" "tls_codec?/std" ];
         };
-        resolvedDefaultFeatures = [ "builder" "default" "pem" "sha1" "signature" "std" ];
+        resolvedDefaultFeatures = [ "builder" "default" "pem" "signature" "std" ];
       };
       "xml" = rec {
         crateName = "xml";
diff --git a/Cargo.toml b/Cargo.toml
index c38af62d0..ae973805a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-members = ["rust/operator-binary"]
+members = ["rust/operator-binary", "rust/agent-binary", "rust/shared"]
 resolver = "2"
 
 [workspace.package]
@@ -10,7 +10,8 @@ edition = "2024"
 repository = "https://github.com/stackabletech/kafka-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.121.0", features = ["crds", "webhook"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", branch = "feat/platform-access", features = ["agent", "crds", "webhook"] }
+stackable-kafka-shared = { path = "rust/shared" }
 
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }
diff --git a/crate-hashes.json b/crate-hashes.json
index 364992159..e08caca83 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,11 +1,12 @@
 {
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#k8s-version@0.1.4": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-certs@0.4.1": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-operator-derive@0.3.1": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-operator@0.121.0": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-shared@0.2.0": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-telemetry@0.6.5": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-versioned-macros@0.13.0": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-versioned@0.13.0": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.121.0#stackable-webhook@0.10.0": "1dax2l1ghd609k19z4kznpnk5v40xbl84qwwxlfvwjamvf7jj6mm"
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#k8s-version@0.1.4": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-agent@0.1.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-certs@0.4.1": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-operator-derive@0.3.1": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-operator@0.121.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-shared@0.2.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-telemetry@0.6.5": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-versioned-macros@0.13.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-versioned@0.13.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7",
+  "git+https://github.com/stackabletech/operator-rs.git?branch=feat%2Fplatform-access#stackable-webhook@0.10.0": "10va8k2dwshcb6c7pp01q6m6bx2ad58fzqxf19mp90hhcp00bxm7"
 }
\ No newline at end of file
diff --git a/deploy/helm/kafka-operator/templates/clusterrole-agent.yaml b/deploy/helm/kafka-operator/templates/clusterrole-agent.yaml
new file mode 100644
index 000000000..fb3f2995e
--- /dev/null
+++ b/deploy/helm/kafka-operator/templates/clusterrole-agent.yaml
@@ -0,0 +1,21 @@
+---
+# Agent ClusterRole: bound (via per KafkaCluster RoleBinding) to the ServiceAccount that the
+# agent pod runs as.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "kafka-operator.name" . }}-agent-clusterrole
+  labels:
+  {{- include "kafka-operator.labels" . | nindent 4 }}
+rules:
+{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
+  # On OpenShift, the agent pod must be allowed to use the nonroot-v2 SCC
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - nonroot-v2
+    verbs:
+      - use
+{{ end }}
diff --git a/deploy/helm/kafka-operator/templates/clusterrole-operator.yaml b/deploy/helm/kafka-operator/templates/clusterrole-operator.yaml
index 59a34e6ce..aafed503c 100644
--- a/deploy/helm/kafka-operator/templates/clusterrole-operator.yaml
+++ b/deploy/helm/kafka-operator/templates/clusterrole-operator.yaml
@@ -41,7 +41,7 @@ rules:
       - list
       - patch
       - watch
-  # Required to bind the product ClusterRole to the per-cluster ServiceAccount.
+  # Required to bind the product and agent ClusterRoles to the per-cluster ServiceAccounts.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -50,6 +50,7 @@ rules:
       - bind
     resourceNames:
       - {{ include "kafka-operator.name" . }}-clusterrole
+      - {{ include "kafka-operator.name" . }}-agent-clusterrole
   # StatefulSet created per role group (broker, KRaft controller). Applied via
   # SSA, tracked for orphan cleanup, and owned by the controller.
   - apiGroups:
@@ -63,6 +64,18 @@ rules:
       - list
       - patch
       - watch
+  # Deployment of the agent.
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - watch
   # PodDisruptionBudget created per role group. Applied via SSA and tracked for orphan cleanup, and owned by the controller.
   - apiGroups:
       - policy
diff --git a/extra/crds.yaml b/extra/crds.yaml
index 8b954ae6b..48821787b 100644
--- a/extra/crds.yaml
+++ b/extra/crds.yaml
@@ -1024,6 +1024,60 @@ spec:
                     nullable: true
                     pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
+                  managementAccess:
+                    description: |-
+                      Management access of the Stackable Data Platform to this Kafka cluster, used to manage
+                      resources like `KafkaTopic`s. The credential must be authorized in Kafka by the user.
+                    nullable: true
+                    properties:
+                      authentication:
+                        description: How the Stackable Data Platform authenticates to Kafka.
+                        properties:
+                          userProvided:
+                            description: A credential provided by the user.
+                            oneOf:
+                            - required:
+                              - anonymous
+                            - required:
+                              - tls
+                            properties:
+                              anonymous:
+                                description: 'No credential: the product does not require authentication.'
+                                type: object
+                              tls:
+                                description: 'Source of a TLS client certificate: a secret-operator SecretClass or a static Secret.'
+                                oneOf:
+                                - required:
+                                  - secretClassName
+                                - required:
+                                  - secretName
+                                properties:
+                                  secretClassName:
+                                    description: A SecretClass providing the certificate.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  secretName:
+                                    description: |-
+                                      A static Secret holding the certificate in the keys `tls.crt` and `tls.key` (PEM), e.g. as
+                                      a Secret of type `kubernetes.io/tls`.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                type: object
+                            type: object
+                        required:
+                        - userProvided
+                        type: object
+                      enabled:
+                        description: Whether management access is enabled.
+                        type: boolean
+                    required:
+                    - authentication
+                    - enabled
+                    type: object
                   metadataManager:
                     description: |-
                       Metadata manager to use for the Kafka cluster.
diff --git a/rust/agent-binary/Cargo.toml b/rust/agent-binary/Cargo.toml
new file mode 100644
index 000000000..c138e675b
--- /dev/null
+++ b/rust/agent-binary/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "stackable-kafka-agent"
+description = "Stackable Agent for Apache Kafka"
+version.workspace = true
+authors.workspace = true
+license.workspace = true
+edition.workspace = true
+repository.workspace = true
+publish = false
+
+[dependencies]
+stackable-operator.workspace = true
+
+anyhow.workspace = true
+clap.workspace = true
+tokio.workspace = true
+tracing.workspace = true
+
+[build-dependencies]
+built.workspace = true
+
+[[bin]]
+name = "stackable-kafka-agent"
+path = "src/main.rs"
diff --git a/rust/agent-binary/build.rs b/rust/agent-binary/build.rs
new file mode 100644
index 000000000..fa809bfd1
--- /dev/null
+++ b/rust/agent-binary/build.rs
@@ -0,0 +1,3 @@
+fn main() {
+    built::write_built_file().unwrap();
+}
diff --git a/rust/agent-binary/src/main.rs b/rust/agent-binary/src/main.rs
new file mode 100644
index 000000000..0934f803f
--- /dev/null
+++ b/rust/agent-binary/src/main.rs
@@ -0,0 +1,44 @@
+//! The Stackable Kafka agent: a per-cluster controller that reconciles in-cluster resources like `KafkaTopic`s.
+
+use clap::Parser;
+use stackable_operator::{
+    cli::{Command, CommonOptions},
+    telemetry::Tracing,
+    utils::signal::SignalWatcher,
+};
+
+mod built_info {
+    include!(concat!(env!("OUT_DIR"), "/built.rs"));
+}
+
+#[derive(clap::Parser)]
+#[clap(about, author)]
+struct Opts {
+    #[clap(subcommand)]
+    cmd: Command<CommonOptions>,
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    match Opts::parse().cmd {
+        Command::Crd => anyhow::bail!("this agent has no CRDs, they are owned by the operator"),
+        Command::Run(CommonOptions { telemetry, .. }) => {
+            let _tracing_guard = Tracing::pre_configured(built_info::PKG_NAME, telemetry).init()?;
+
+            tracing::info!(
+                built_info.pkg_version = built_info::PKG_VERSION,
+                built_info.git_version = built_info::GIT_VERSION,
+                built_info.target = built_info::TARGET,
+                built_info.built_time_utc = built_info::BUILT_TIME_UTC,
+                built_info.rustc_version = built_info::RUSTC_VERSION,
+                "Starting {description}",
+                description = built_info::PKG_DESCRIPTION
+            );
+
+            let sigterm_watcher = SignalWatcher::sigterm()?;
+            sigterm_watcher.handle().await;
+        }
+    }
+
+    Ok(())
+}
diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml
index 38e9e1e18..ca41d66db 100644
--- a/rust/operator-binary/Cargo.toml
+++ b/rust/operator-binary/Cargo.toml
@@ -9,6 +9,7 @@ repository.workspace = true
 publish = false
 
 [dependencies]
+stackable-kafka-shared.workspace = true
 stackable-operator.workspace = true
 
 indoc.workspace = true
diff --git a/rust/operator-binary/src/controller.rs b/rust/operator-binary/src/controller.rs
index dd3176ecf..1c349de28 100644
--- a/rust/operator-binary/src/controller.rs
+++ b/rust/operator-binary/src/controller.rs
@@ -15,6 +15,7 @@ use std::{
 
 use const_format::concatcp;
 use snafu::{ResultExt, Snafu};
+use stackable_kafka_shared::agent::ClientSecurity;
 use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
@@ -25,9 +26,9 @@ use stackable_operator::{
         resources::{NoRuntimeLimits, Resources},
     },
     constant,
-    crd::listener,
+    crd::{listener, management_access::v1alpha1::TlsClientCredential},
     k8s_openapi::api::{
-        apps::v1::StatefulSet,
+        apps::v1::{Deployment, StatefulSet},
         core::v1::{ConfigMap, Service, ServiceAccount},
         policy::v1::PodDisruptionBudget,
         rbac::v1::RoleBinding,
@@ -35,17 +36,21 @@ use stackable_operator::{
     kube::{
         Resource,
         api::{DynamicObject, ObjectMeta},
-        core::{DeserializeGuard, error_boundary},
+        core::{DeserializeGuard, Selector, error_boundary},
         runtime::{controller::Action, reflector::ObjectRef},
     },
     logging::controller::ReconcilerError,
     shared::time::Duration,
     v2::{
         HasName, HasUid, NameIsValidLabelValue,
+        agent_utils::AgentResourceNames,
+        kvp::label,
         role_group_utils::ResourceNames,
         role_utils,
         types::{
-            kubernetes::{ConfigMapName, ListenerClassName, ListenerName, NamespaceName, Uid},
+            kubernetes::{
+                ConfigMapName, ListenerClassName, ListenerName, NamespaceName, SecretClassName, Uid,
+            },
             operator::{ClusterName, ControllerName, OperatorName, ProductName, ProductVersion},
         },
     },
@@ -85,6 +90,11 @@ constant!(PRODUCT_NAME: ProductName = APP_NAME);
 constant!(OPERATOR_NAME: OperatorName = KAFKA_OPERATOR_NAME);
 constant!(CONTROLLER_NAME: ControllerName = KAFKA_CONTROLLER_NAME);
 
+/// Selector matching the agents of all KafkaClusters, e.g. to watch them.
+pub fn all_agents_selector() -> Selector {
+    Selector::from_iter(BTreeMap::from(label::all_agents_selector(&PRODUCT_NAME)))
+}
+
 #[derive(Snafu, Debug)]
 pub enum PodDescriptorsError {
     #[snafu(display(
@@ -117,6 +127,7 @@ pub struct Applied;
 /// bootstrap [`Listener`](listener)s.
 pub struct KubernetesResources<T> {
     pub stateful_sets: Vec<StatefulSet>,
+    pub deployments: Vec<Deployment>,
     pub services: Vec<Service>,
     pub listeners: Vec<listener::v1alpha1::Listener>,
     pub config_maps: Vec<ConfigMap>,
@@ -162,6 +173,7 @@ pub struct ValidatedCluster {
     /// address-less around the first reconcile runs; the listener-operator populates the ingress
     /// addresses and the `Listener` watch triggers a new run once it does.
     pub bootstrap_listeners: Vec<listener::v1alpha1::Listener>,
+    pub agent_config: Option<ValidatedAgentConfig>,
 }
 
 /// The number of pods a role group runs when its `replicas` is unset.
@@ -286,6 +298,14 @@ impl ValidatedCluster {
         }
     }
 
+    /// Type-safe names for the resources of the agent.
+    pub fn agent_resource_names(&self) -> AgentResourceNames {
+        AgentResourceNames {
+            cluster_name: self.name.clone(),
+            product_name: PRODUCT_NAME.clone(),
+        }
+    }
+
     /// Type-safe names for the resources of a given role group.
     pub(crate) fn role_group_resource_names(
         &self,
@@ -367,6 +387,34 @@ impl ValidatedClusterConfig {
     }
 }
 
+/// The configuration of the agent deployed with the cluster.
+pub struct ValidatedAgentConfig {
+    pub image: String,
+    pub connection: AgentConnection,
+}
+
+#[derive(Debug, PartialEq)]
+pub enum AgentConnection {
+    Plaintext,
+    Tls {
+        server_ca_secret_class: SecretClassName,
+    },
+    MutualTls {
+        server_ca_secret_class: SecretClassName,
+        client_credential: TlsClientCredential,
+    },
+}
+
+impl From<&AgentConnection> for ClientSecurity {
+    fn from(connection: &AgentConnection) -> Self {
+        match connection {
+            AgentConnection::Plaintext => Self::Plaintext,
+            AgentConnection::Tls { .. } => Self::Tls,
+            AgentConnection::MutualTls { .. } => Self::MutualTls,
+        }
+    }
+}
+
 /// Per-role configuration extracted during validation.
 ///
 /// Resolved from the raw [`v1alpha1::KafkaCluster`] spec during validation so the reconcile loop
@@ -450,6 +498,7 @@ pub type ControllerRoleGroupConfig = role_utils::RoleGroupConfig<
 pub struct Ctx {
     pub client: stackable_operator::client::Client,
     pub operator_environment: OperatorEnvironmentOptions,
+    pub operator_image: Option<String>,
 }
 
 #[derive(Snafu, Debug, EnumDiscriminants)]
@@ -519,9 +568,13 @@ pub async fn reconcile_kafka(
         .context(DereferenceSnafu)?;
 
     // validate (no client required)
-    let validated_cluster =
-        validate::validate(kafka, dereferenced_objects, &ctx.operator_environment)
-            .context(ValidateClusterSnafu)?;
+    let validated_cluster = validate::validate(
+        kafka,
+        dereferenced_objects,
+        &ctx.operator_environment,
+        ctx.operator_image.as_deref(),
+    )
+    .context(ValidateClusterSnafu)?;
 
     tracing::debug!(
         kerberos_enabled = validated_cluster.cluster_config.kafka_security.has_kerberos_enabled(),
@@ -567,24 +620,31 @@ pub fn error_policy(
 
 #[cfg(test)]
 pub(crate) mod test_support {
-    use std::collections::BTreeMap;
+    use std::{collections::BTreeMap, str::FromStr};
 
     use stackable_operator::{
+        builder::meta::ObjectMetaBuilder,
         cli::OperatorEnvironmentOptions,
         commons::networking::DomainName,
-        crd::{authentication::core, listener},
+        crd::{
+            authentication::{core, kerberos, tls},
+            listener,
+        },
         utils::{cluster_info::KubernetesClusterInfo, yaml_from_str_singleton_map},
+        v2::types::kubernetes::SecretClassName,
     };
 
     use super::{
         BrokerRoleGroupConfig, ControllerRoleGroupConfig, ValidatedCluster,
-        dereference::DereferencedObjects, validate::validate,
+        dereference::DereferencedObjects, security::ValidatedKafkaSecurity, validate::validate,
     };
     use crate::crd::{
         authentication::ResolvedAuthenticationClasses, authorization::KafkaAuthorizationConfig,
         v1alpha1,
     };
 
+    pub const OPERATOR_IMAGE: &str = "oci.stackable.tech/sdp/kafka-operator:0.0.0-dev";
+
     /// The expected `app.kubernetes.io/version` label value for the given product version.
     ///
     /// The `-stackable` suffix carries the operator's own version, which is `0.0.0-dev` on main
@@ -601,6 +661,96 @@ pub(crate) mod test_support {
         yaml_from_str_singleton_map(yaml).expect("invalid test KafkaCluster YAML")
     }
 
+    fn tls_auth_class() -> core::v1alpha1::AuthenticationClass {
+        core::v1alpha1::AuthenticationClass {
+            metadata: ObjectMetaBuilder::new().name("tls-auth").build(),
+            spec: core::v1alpha1::AuthenticationClassSpec {
+                provider: core::v1alpha1::AuthenticationClassProvider::Tls(
+                    tls::v1alpha1::AuthenticationProvider {
+                        client_cert_secret_class: Some("client-auth-secret-class".to_string()),
+                    },
+                ),
+            },
+        }
+    }
+
+    fn kerberos_auth_class() -> core::v1alpha1::AuthenticationClass {
+        core::v1alpha1::AuthenticationClass {
+            metadata: ObjectMetaBuilder::new().name("kerberos-auth").build(),
+            spec: core::v1alpha1::AuthenticationClassSpec {
+                provider: core::v1alpha1::AuthenticationClassProvider::Kerberos(
+                    kerberos::v1alpha1::AuthenticationProvider {
+                        kerberos_secret_class: "kerberos-secret-class".to_string(),
+                    },
+                ),
+            },
+        }
+    }
+
+    fn no_auth() -> ResolvedAuthenticationClasses {
+        ResolvedAuthenticationClasses::new(vec![])
+    }
+
+    /// Plaintext: no TLS, no authentication, no OPA.
+    pub fn plaintext() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            no_auth(),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            None,
+            None,
+        )
+    }
+
+    /// Server TLS only (encryption without client authentication).
+    pub fn server_tls() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            no_auth(),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            Some("tls".parse().unwrap()),
+            None,
+        )
+    }
+
+    /// Mutual TLS (client-certificate authentication).
+    pub fn client_auth_tls() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            ResolvedAuthenticationClasses::new(vec![tls_auth_class()]),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            Some("tls".parse().unwrap()),
+            None,
+        )
+    }
+
+    /// Kerberos, which also requires server and internal TLS.
+    pub fn kerberos() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            ResolvedAuthenticationClasses::new(vec![kerberos_auth_class()]),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            Some("tls".parse().unwrap()),
+            None,
+        )
+    }
+
+    /// Internal TLS only (broker/controller encryption without client TLS).
+    pub fn internal_tls() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            no_auth(),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            None,
+            None,
+        )
+    }
+
+    /// OPA authorization with a TLS truststore (internal + server TLS also enabled).
+    pub fn opa() -> ValidatedKafkaSecurity {
+        ValidatedKafkaSecurity::new(
+            no_auth(),
+            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
+            Some("tls".parse().unwrap()),
+            Some("opa-tls".parse().unwrap()),
+        )
+    }
+
     fn cluster_info() -> KubernetesClusterInfo {
         KubernetesClusterInfo {
             cluster_domain: DomainName::try_from("cluster.local").expect("valid domain"),
@@ -711,6 +861,7 @@ pub(crate) mod test_support {
                 bootstrap_listeners: Vec::new(),
             },
             &operator_environment(),
+            Some(OPERATOR_IMAGE),
         )
         .expect("validate should succeed for the test fixture")
     }
@@ -719,6 +870,13 @@ pub(crate) mod test_support {
     /// the result. Used for tests asserting on a specific validation failure.
     pub fn validate_err(
         kafka: &v1alpha1::KafkaCluster,
+    ) -> Result<ValidatedCluster, super::validate::Error> {
+        validate_with_operator_image(kafka, Some(OPERATOR_IMAGE))
+    }
+
+    pub fn validate_with_operator_image(
+        kafka: &v1alpha1::KafkaCluster,
+        operator_image: Option<&str>,
     ) -> Result<ValidatedCluster, super::validate::Error> {
         validate(
             kafka,
@@ -729,6 +887,7 @@ pub(crate) mod test_support {
                 bootstrap_listeners: Vec::new(),
             },
             &operator_environment(),
+            operator_image,
         )
     }
 }
@@ -940,6 +1099,7 @@ spec: {}
                         operator_service_name: "kafka-operator".to_owned(),
                         image_repository: "oci.stackable.tech/sdp".to_owned(),
                     },
+                    operator_image: None,
                 });
 
                 reconcile_kafka(Arc::new(kafka), ctx).await
diff --git a/rust/operator-binary/src/controller/apply.rs b/rust/operator-binary/src/controller/apply.rs
index 1ce080f87..5f740ecc4 100644
--- a/rust/operator-binary/src/controller/apply.rs
+++ b/rust/operator-binary/src/controller/apply.rs
@@ -78,6 +78,7 @@ impl<'a> Applier<'a> {
         // compile here instead of silently never being applied.
         let KubernetesResources {
             stateful_sets,
+            deployments,
             services,
             listeners,
             config_maps,
@@ -97,6 +98,7 @@ impl<'a> Applier<'a> {
         let config_maps = self.add_resources(config_maps).await?;
         let pod_disruption_budgets = self.add_resources(pod_disruption_budgets).await?;
         let stateful_sets = self.add_resources(stateful_sets).await?;
+        let deployments = self.add_resources(deployments).await?;
 
         self.cluster_resources
             .delete_orphaned_resources(self.client)
@@ -105,6 +107,7 @@ impl<'a> Applier<'a> {
 
         Ok(KubernetesResources {
             stateful_sets,
+            deployments,
             services,
             listeners,
             config_maps,
diff --git a/rust/operator-binary/src/controller/build/command.rs b/rust/operator-binary/src/controller/build/command.rs
index 04c1f5e07..173d8be5b 100644
--- a/rust/operator-binary/src/controller/build/command.rs
+++ b/rust/operator-binary/src/controller/build/command.rs
@@ -394,7 +394,7 @@ mod tests {
     use indoc::indoc;
 
     use super::*;
-    use crate::controller::build::security::tests::{kerberos, plaintext};
+    use crate::controller::test_support::{kerberos, plaintext};
 
     #[test]
     fn controller_command_does_not_export_a_realm_without_kerberos() {
diff --git a/rust/operator-binary/src/controller/build/mod.rs b/rust/operator-binary/src/controller/build/mod.rs
index 33775c002..32f13dc19 100644
--- a/rust/operator-binary/src/controller/build/mod.rs
+++ b/rust/operator-binary/src/controller/build/mod.rs
@@ -20,6 +20,9 @@ use crate::{
         RoleName, ValidatedCluster,
         build::{
             resource::{
+                agent::{
+                    build_agent_deployment, build_agent_role_binding, build_agent_service_account,
+                },
                 discovery::build_discovery_configmap,
                 pdb::build_pdb,
                 rbac::{build_role_binding, build_service_account},
@@ -143,14 +146,24 @@ pub fn build(cluster: &ValidatedCluster) -> Result<KubernetesResources<Prepared>
 
     config_maps.push(build_discovery_configmap(cluster).context(DiscoveryConfigMapSnafu)?);
 
+    let mut deployments = vec![];
+    let mut service_accounts = vec![build_service_account(cluster)];
+    let mut role_bindings = vec![build_role_binding(cluster)];
+    if let Some(agent_config) = &cluster.agent_config {
+        deployments.push(build_agent_deployment(cluster, agent_config));
+        service_accounts.push(build_agent_service_account(cluster));
+        role_bindings.push(build_agent_role_binding(cluster));
+    }
+
     Ok(KubernetesResources {
         stateful_sets,
+        deployments,
         services,
         listeners,
         config_maps,
         pod_disruption_budgets,
-        service_accounts: vec![build_service_account(cluster)],
-        role_bindings: vec![build_role_binding(cluster)],
+        service_accounts,
+        role_bindings,
         status: PhantomData,
     })
 }
@@ -165,6 +178,16 @@ pub(crate) fn recommended_labels_for_cluster_resources(cluster: &ValidatedCluste
     )
 }
 
+pub(crate) fn recommended_labels_for_agent_resources(cluster: &ValidatedCluster) -> Labels {
+    label::recommended_labels_for_agent_resources(
+        &cluster.name,
+        &PRODUCT_NAME,
+        &cluster.product_version,
+        &OPERATOR_NAME,
+        &CONTROLLER_NAME,
+    )
+}
+
 pub(crate) fn recommended_labels_for_role_resources(
     cluster: &ValidatedCluster,
     role_name: &RoleName,
@@ -210,6 +233,10 @@ pub(crate) fn recommended_labels_for_unversioned_role_group_resources(
     )
 }
 
+pub(crate) fn agent_selector(cluster: &ValidatedCluster) -> Labels {
+    label::agent_selector(&cluster.name, &PRODUCT_NAME)
+}
+
 /// Selector labels matching the pods of a role group.
 pub(crate) fn role_group_selector(
     cluster: &ValidatedCluster,
@@ -534,6 +561,8 @@ mod tests {
             sorted_names(&resources.role_bindings),
             ["simple-kafka-rolebinding"]
         );
+        // No agent without management access.
+        assert!(resources.deployments.is_empty());
     }
 
     #[test]
diff --git a/rust/operator-binary/src/controller/build/properties/listener.rs b/rust/operator-binary/src/controller/build/properties/listener.rs
index acc632558..2cb533769 100644
--- a/rust/operator-binary/src/controller/build/properties/listener.rs
+++ b/rust/operator-binary/src/controller/build/properties/listener.rs
@@ -6,7 +6,13 @@
 
 use std::collections::BTreeMap;
 
-use stackable_operator::{commons::networking::DomainName, v2::types::kubernetes::NamespaceName};
+use stackable_operator::{
+    commons::networking::DomainName,
+    v2::types::{
+        common::Port,
+        kubernetes::{NamespaceName, ServiceName},
+    },
+};
 
 use crate::{
     controller::{RoleGroupName, ValidatedCluster, security::ValidatedKafkaSecurity},
@@ -151,6 +157,17 @@ pub(crate) fn pod_fqdn(
     format!("${{env:POD_NAME}}.{sts_service_name}.{namespace}.svc.{cluster_domain}")
 }
 
+/// `<service>.<namespace>.svc.<cluster-domain>:<port>`, which resolves to the Pods of a headless
+/// Service.
+pub(crate) fn headless_service_address(
+    headless_service_name: &ServiceName,
+    namespace: &NamespaceName,
+    cluster_domain: &DomainName,
+    port: &Port,
+) -> String {
+    format!("{headless_service_name}.{namespace}.svc.{cluster_domain}:{port}")
+}
+
 #[cfg(test)]
 mod tests {
     use stackable_operator::{
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
index 8cd11fc51..39c2c1b6a 100644
--- a/rust/operator-binary/src/controller/build/properties/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -91,12 +91,11 @@ pub(crate) fn kraft_controllers(
                     client_port = desc.client_port,
                 )
             } else {
-                format!(
-                    "{service}.{namespace}.svc.{cluster_domain}:{client_port}",
-                    service = desc.role_group_service_name,
-                    namespace = desc.namespace,
-                    cluster_domain = desc.cluster_domain,
-                    client_port = desc.client_port,
+                listener::headless_service_address(
+                    &desc.role_group_service_name,
+                    &desc.namespace,
+                    &desc.cluster_domain,
+                    &desc.client_port,
                 )
             }
         })
diff --git a/rust/operator-binary/src/controller/build/resource/agent.rs b/rust/operator-binary/src/controller/build/resource/agent.rs
new file mode 100644
index 000000000..a97886a17
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/resource/agent.rs
@@ -0,0 +1,481 @@
+//! Builds the resources of the agent deployed alongside the cluster.
+
+use std::str::FromStr;
+
+use stackable_kafka_shared::agent::{
+    ClientSecurity, ENV_BOOTSTRAP_SERVERS, ENV_CLIENT_SECURITY, ENV_CLUSTER_NAME,
+    ENV_CLUSTER_NAMESPACE, KAFKA_TLS_DIR,
+};
+use stackable_operator::{
+    builder::{
+        meta::ObjectMetaBuilder,
+        pod::{
+            PodBuilder,
+            container::ContainerBuilder,
+            resources::ResourceRequirementsBuilder,
+            security::PodSecurityContextBuilder,
+            volume::{SecretFormat, SecretOperatorVolumeSourceBuilder, VolumeBuilder},
+        },
+    },
+    commons::secret_class::SecretClassVolumeProvisionParts,
+    constant,
+    k8s_openapi::{
+        api::{
+            apps::v1::{Deployment, DeploymentSpec, DeploymentStrategy},
+            core::v1::{EnvVar, EnvVarSource, ObjectFieldSelector, ServiceAccount},
+            rbac::v1::RoleBinding,
+        },
+        apimachinery::pkg::apis::meta::v1::LabelSelector,
+    },
+    v2::{
+        builder::{
+            meta::ownerreference_from_resource,
+            pod::container::{EnvVarName, EnvVarSet, new_container_builder},
+        },
+        rbac::{self, RbacResourceNames},
+        types::kubernetes::{ContainerName, SecretClassName, VolumeName},
+    },
+};
+
+use crate::{
+    controller::{
+        AgentConnection, ValidatedAgentConfig, ValidatedCluster,
+        build::{
+            agent_selector, properties::listener::headless_service_address,
+            recommended_labels_for_agent_resources,
+        },
+    },
+    crd::role::KafkaRole,
+};
+
+constant!(AGENT_CONTAINER_NAME: ContainerName = "agent");
+constant!(KAFKA_TLS_VOLUME_NAME: VolumeName = "tls-kafka");
+constant!(KUBERNETES_NODE_NAME: EnvVarName = "KUBERNETES_NODE_NAME");
+constant!(KUBERNETES_CLUSTER_DOMAIN: EnvVarName = "KUBERNETES_CLUSTER_DOMAIN");
+
+pub fn build_agent_deployment(
+    cluster: &ValidatedCluster,
+    agent_config: &ValidatedAgentConfig,
+) -> Deployment {
+    let resource_names = cluster.agent_resource_names();
+    let mut container_builder_agent = new_container_builder(&AGENT_CONTAINER_NAME);
+    let mut pod_builder = PodBuilder::new();
+
+    match &agent_config.connection {
+        AgentConnection::Plaintext => {}
+        AgentConnection::Tls {
+            server_ca_secret_class,
+        } => add_kafka_tls_volume_and_mount(
+            server_ca_secret_class,
+            &mut pod_builder,
+            &mut container_builder_agent,
+        ),
+        AgentConnection::MutualTls {
+            server_ca_secret_class,
+            client_credential,
+        } => {
+            add_kafka_tls_volume_and_mount(
+                server_ca_secret_class,
+                &mut pod_builder,
+                &mut container_builder_agent,
+            );
+            client_credential
+                .add_volumes_and_mounts(&mut pod_builder, vec![&mut container_builder_agent])
+                .expect(
+                    "the agent Pod has no other volume or mount for the TLS client certificate",
+                );
+        }
+    }
+
+    container_builder_agent
+        .image(&agent_config.image)
+        .command(vec!["stackable-kafka-agent".to_owned()])
+        .args(vec!["run".to_owned()])
+        .add_env_vars(agent_env_vars(cluster, agent_config))
+        .resources(
+            ResourceRequirementsBuilder::new()
+                .with_cpu_request("100m")
+                .with_cpu_limit("500m")
+                .with_memory_request("128Mi")
+                .with_memory_limit("128Mi")
+                .build(),
+        );
+
+    pod_builder
+        .metadata(
+            ObjectMetaBuilder::new()
+                .with_labels(recommended_labels_for_agent_resources(cluster))
+                .build(),
+        )
+        .image_pull_secrets_from_product_image(&cluster.image)
+        .add_container(container_builder_agent.build())
+        .service_account_name(resource_names.service_account_name().to_string())
+        .security_context(
+            PodSecurityContextBuilder::with_stackable_defaults()
+                .fs_group(1000)
+                .build(),
+        );
+
+    Deployment {
+        metadata: ObjectMetaBuilder::new()
+            .name_and_namespace(cluster)
+            .name(resource_names.deployment_name().to_string())
+            .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
+            .with_labels(recommended_labels_for_agent_resources(cluster))
+            .build(),
+        spec: Some(DeploymentSpec {
+            replicas: Some(1),
+            // Never run two agents at the same time, as for the operator itself.
+            strategy: Some(DeploymentStrategy {
+                type_: Some("Recreate".to_owned()),
+                ..DeploymentStrategy::default()
+            }),
+            selector: LabelSelector {
+                match_labels: Some(agent_selector(cluster).into()),
+                ..LabelSelector::default()
+            },
+            template: pod_builder.build_template(),
+            ..DeploymentSpec::default()
+        }),
+        status: None,
+    }
+}
+
+pub fn build_agent_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
+    rbac::build_service_account(
+        cluster,
+        &cluster.agent_resource_names(),
+        recommended_labels_for_agent_resources(cluster),
+    )
+}
+
+/// Binds the agent ServiceAccount to the agent ClusterRole deployed by the Helm chart.
+pub fn build_agent_role_binding(cluster: &ValidatedCluster) -> RoleBinding {
+    rbac::build_role_binding(
+        cluster,
+        &cluster.agent_resource_names(),
+        recommended_labels_for_agent_resources(cluster),
+    )
+}
+
+fn agent_env_vars(cluster: &ValidatedCluster, agent_config: &ValidatedAgentConfig) -> EnvVarSet {
+    let node_name_env_var = EnvVar {
+        name: KUBERNETES_NODE_NAME.to_string(),
+        value: None,
+        value_from: Some(EnvVarSource {
+            field_ref: Some(ObjectFieldSelector {
+                field_path: "spec.nodeName".to_owned(),
+                ..ObjectFieldSelector::default()
+            }),
+            ..EnvVarSource::default()
+        }),
+    };
+
+    EnvVarSet::new()
+        .with_value(&ENV_BOOTSTRAP_SERVERS, bootstrap_servers(cluster))
+        .with_value(&ENV_CLUSTER_NAME, cluster.name.to_string())
+        .with_value(&ENV_CLUSTER_NAMESPACE, cluster.namespace.to_string())
+        .with_value(
+            &ENV_CLIENT_SECURITY,
+            ClientSecurity::from(&agent_config.connection).to_string(),
+        )
+        // Saves the agent from looking the domain up via the kubelet, which needs extra RBAC.
+        .with_value(
+            &KUBERNETES_CLUSTER_DOMAIN,
+            cluster.cluster_domain.to_string(),
+        )
+        .with_env_var(node_name_env_var)
+        .expect("the env var name is a valid EnvVarName")
+}
+
+/// The headless Services of the broker role groups, which resolve to the broker Pods.
+///
+/// They keep the traffic within the Kubernetes cluster regardless of the ListenerClass. The pod
+/// scope of the broker certificates puts them into the SANs, so hostname verification passes. The
+/// agent stays on the bootstrap connection, so it never follows the advertised addresses.
+fn bootstrap_servers(cluster: &ValidatedCluster) -> String {
+    let client_port = cluster.cluster_config.kafka_security.client_port();
+    cluster
+        .broker_role_group_configs
+        .keys()
+        .map(|role_group_name| {
+            headless_service_address(
+                &cluster
+                    .role_group_resource_names(&KafkaRole::Broker, role_group_name)
+                    .headless_service_name(),
+                &cluster.namespace,
+                &cluster.cluster_domain,
+                &client_port,
+            )
+        })
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+fn add_kafka_tls_volume_and_mount(
+    secret_class: &SecretClassName,
+    pod_builder: &mut PodBuilder,
+    container_builder: &mut ContainerBuilder,
+) {
+    pod_builder
+        .add_volume(
+            VolumeBuilder::new(&*KAFKA_TLS_VOLUME_NAME)
+                .ephemeral(
+                    SecretOperatorVolumeSourceBuilder::new(
+                        secret_class,
+                        SecretClassVolumeProvisionParts::Public,
+                    )
+                    .with_format(SecretFormat::TlsPem)
+                    .build()
+                    .expect(
+                        "the annotations are built from a valid SecretClass name and constant \
+                         values",
+                    ),
+                )
+                .build(),
+        )
+        .expect("the volume name is statically defined and must not collide");
+    container_builder
+        .add_volume_mount(&*KAFKA_TLS_VOLUME_NAME, KAFKA_TLS_DIR)
+        .expect("the mount path is statically defined and must not collide");
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{Value, json};
+
+    use super::*;
+    use crate::controller::test_support::{
+        OPERATOR_IMAGE, app_version_label, minimal_kafka, validated_cluster,
+    };
+
+    const TLS_SECRET_CLASS: &str =
+        "{enabled: true, authentication: {userProvided: {tls: {secretClassName: tls}}}}";
+
+    fn cluster(management_access: &str) -> ValidatedCluster {
+        cluster_with_image("{productVersion: 3.9.2}", management_access)
+    }
+
+    fn cluster_with_image(image: &str, management_access: &str) -> ValidatedCluster {
+        let kafka = minimal_kafka(&format!(
+            r#"
+            apiVersion: kafka.stackable.tech/v1alpha1
+            kind: KafkaCluster
+            metadata:
+              name: simple-kafka
+              namespace: default
+              uid: 12345678-1234-1234-1234-123456789012
+            spec:
+              image: {image}
+              clusterConfig:
+                metadataManager: kraft
+                managementAccess: {management_access}
+              controllers:
+                roleGroups:
+                  default:
+                    replicas: 1
+              brokers:
+                roleGroups:
+                  default:
+                    replicas: 1
+            "#
+        ));
+        validated_cluster(&kafka)
+    }
+
+    fn agent_deployment(cluster: &ValidatedCluster) -> Value {
+        let agent_config = cluster
+            .agent_config
+            .as_ref()
+            .expect("management access is enabled");
+        serde_json::to_value(build_agent_deployment(cluster, agent_config))
+            .expect("must be serializable")
+    }
+
+    #[test]
+    fn test_constants() {
+        // Test that dereferencing the constants does not panic.
+        let _ = *AGENT_CONTAINER_NAME;
+        let _ = *KAFKA_TLS_VOLUME_NAME;
+        let _ = *KUBERNETES_NODE_NAME;
+        let _ = *KUBERNETES_CLUSTER_DOMAIN;
+    }
+
+    #[test]
+    fn agent_config_is_only_resolved_if_management_access_is_enabled() {
+        assert!(
+            cluster(
+                "{enabled: false, authentication: {userProvided: {tls: {secretClassName: tls}}}}"
+            )
+            .agent_config
+            .is_none()
+        );
+
+        let cluster = cluster(TLS_SECRET_CLASS);
+        let agent_config = cluster.agent_config.expect("management access is enabled");
+        assert_eq!(agent_config.image, OPERATOR_IMAGE);
+    }
+
+    #[test]
+    fn test_deployment() {
+        let deployment = agent_deployment(&cluster(TLS_SECRET_CLASS));
+
+        assert_eq!(deployment["metadata"]["name"], "simple-kafka-agent");
+        assert_eq!(deployment["spec"]["replicas"], 1);
+        assert_eq!(deployment["spec"]["strategy"]["type"], "Recreate");
+        // secret-operator volumes are only readable by the fsGroup.
+        assert_eq!(
+            deployment["spec"]["template"]["spec"]["securityContext"]["fsGroup"],
+            1000
+        );
+        // The selector must not match the broker or controller Pods.
+        assert_eq!(
+            deployment["spec"]["selector"]["matchLabels"],
+            json!({
+                "app.kubernetes.io/component": "kafka-agent",
+                "app.kubernetes.io/instance": "simple-kafka",
+                "app.kubernetes.io/name": "kafka"
+            })
+        );
+        assert_eq!(
+            deployment["spec"]["template"]["metadata"]["labels"],
+            json!({
+                "app.kubernetes.io/component": "kafka-agent",
+                "app.kubernetes.io/instance": "simple-kafka",
+                "app.kubernetes.io/managed-by": "kafka.stackable.tech_kafkacluster",
+                "app.kubernetes.io/name": "kafka",
+                "app.kubernetes.io/version": app_version_label("3.9.2"),
+                "stackable.tech/vendor": "Stackable"
+            })
+        );
+
+        let pod_spec = &deployment["spec"]["template"]["spec"];
+        assert_eq!(pod_spec["serviceAccountName"], "simple-kafka-agent");
+        assert_eq!(pod_spec["containers"][0]["image"], OPERATOR_IMAGE);
+        assert_eq!(
+            pod_spec["containers"][0]["command"],
+            json!(["stackable-kafka-agent"])
+        );
+        assert_eq!(pod_spec["containers"][0]["args"], json!(["run"]));
+        assert_eq!(
+            pod_spec["containers"][0]["volumeMounts"],
+            json!([
+                {"mountPath": "/stackable/secrets/tls-kafka", "name": "tls-kafka"},
+                {"mountPath": "/stackable/secrets/tls-management-access", "name": "tls-management-access"}
+            ])
+        );
+        assert_eq!(
+            pod_spec["volumes"][0]["ephemeral"]["volumeClaimTemplate"]["metadata"]["annotations"],
+            json!({
+                "secrets.stackable.tech/class": "tls",
+                "secrets.stackable.tech/format": "tls-pem",
+                "secrets.stackable.tech/provision-parts": "public"
+            })
+        );
+        assert_eq!(pod_spec["volumes"][1]["name"], "tls-management-access");
+
+        assert_eq!(
+            pod_spec["containers"][0]["env"],
+            json!([
+                {
+                    "name": "KAFKA_BOOTSTRAP_SERVERS",
+                    "value": "simple-kafka-broker-default-headless.default.svc.cluster.local:9093"
+                },
+                {"name": "KAFKA_CLIENT_SECURITY", "value": "mutual-tls"},
+                {"name": "KAFKA_CLUSTER_NAME", "value": "simple-kafka"},
+                {"name": "KAFKA_CLUSTER_NAMESPACE", "value": "default"},
+                {"name": "KUBERNETES_CLUSTER_DOMAIN", "value": "cluster.local"},
+                {
+                    "name": "KUBERNETES_NODE_NAME",
+                    "valueFrom": {"fieldRef": {"fieldPath": "spec.nodeName"}}
+                }
+            ])
+        );
+    }
+
+    #[test]
+    fn test_deployment_with_static_secret() {
+        let deployment = agent_deployment(&cluster(
+            "{enabled: true, authentication: {userProvided: {tls: {secretName: my-cert}}}}",
+        ));
+
+        assert_eq!(
+            deployment["spec"]["template"]["spec"]["volumes"][1],
+            json!({"name": "tls-management-access", "secret": {"optional": false, "secretName": "my-cert"}})
+        );
+    }
+
+    #[test]
+    fn deployment_with_anonymous_authentication_verifies_brokers_without_credential() {
+        let deployment = agent_deployment(&cluster(
+            "{enabled: true, authentication: {userProvided: {anonymous: {}}}}",
+        ));
+
+        let pod_spec = &deployment["spec"]["template"]["spec"];
+        assert_eq!(pod_spec["volumes"][0]["name"], "tls-kafka");
+        assert_eq!(pod_spec["volumes"][1], Value::Null);
+        assert_eq!(
+            pod_spec["containers"][0]["env"][1],
+            json!({"name": "KAFKA_CLIENT_SECURITY", "value": "tls"})
+        );
+    }
+
+    #[test]
+    fn test_deployment_uses_product_image_pull_secrets() {
+        let deployment = agent_deployment(&cluster_with_image(
+            "{productVersion: 3.9.2, pullSecrets: [{name: regcred}]}",
+            TLS_SECRET_CLASS,
+        ));
+
+        assert_eq!(
+            deployment["spec"]["template"]["spec"]["imagePullSecrets"],
+            json!([{"name": "regcred"}])
+        );
+    }
+
+    #[test]
+    fn test_role_binding() {
+        let cluster = cluster(TLS_SECRET_CLASS);
+
+        assert_eq!(
+            json!({
+                "apiVersion": "rbac.authorization.k8s.io/v1",
+                "kind": "RoleBinding",
+                "metadata": {
+                    "labels": {
+                        "app.kubernetes.io/component": "kafka-agent",
+                        "app.kubernetes.io/instance": "simple-kafka",
+                        "app.kubernetes.io/managed-by": "kafka.stackable.tech_kafkacluster",
+                        "app.kubernetes.io/name": "kafka",
+                        "app.kubernetes.io/version": app_version_label("3.9.2"),
+                        "stackable.tech/vendor": "Stackable"
+                    },
+                    "name": "simple-kafka-agent",
+                    "namespace": "default",
+                    "ownerReferences": [
+                        {
+                            "apiVersion": "kafka.stackable.tech/v1alpha1",
+                            "controller": true,
+                            "kind": "KafkaCluster",
+                            "name": "simple-kafka",
+                            "uid": "12345678-1234-1234-1234-123456789012"
+                        }
+                    ]
+                },
+                "roleRef": {
+                    "apiGroup": "rbac.authorization.k8s.io",
+                    "kind": "ClusterRole",
+                    "name": "kafka-agent-clusterrole"
+                },
+                "subjects": [
+                    {
+                        "kind": "ServiceAccount",
+                        "name": "simple-kafka-agent",
+                        "namespace": "default"
+                    }
+                ]
+            }),
+            serde_json::to_value(build_agent_role_binding(&cluster)).expect("must be serializable")
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/resource/mod.rs b/rust/operator-binary/src/controller/build/resource/mod.rs
index 7f458714f..4acba6265 100644
--- a/rust/operator-binary/src/controller/build/resource/mod.rs
+++ b/rust/operator-binary/src/controller/build/resource/mod.rs
@@ -1,5 +1,6 @@
 //! Builders that assemble Kubernetes resources for kafka rolegroups.
 
+pub mod agent;
 pub mod config_map;
 pub mod discovery;
 pub mod listener;
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
index 7dc85c99a..0a535f054 100644
--- a/rust/operator-binary/src/controller/build/resource/statefulset.rs
+++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -20,6 +20,7 @@ use stackable_operator::{
     v2::{
         builder::{meta::ownerreference_from_resource, pod::container::EnvVarSet},
         product_logging::framework::vector_container,
+        rbac::RbacResourceNames,
         role_group_utils::ResourceNames,
         types::kubernetes::{ContainerName, VolumeName},
     },
diff --git a/rust/operator-binary/src/controller/build/role_group/controller.rs b/rust/operator-binary/src/controller/build/role_group/controller.rs
index 99d24dd99..503b3048f 100644
--- a/rust/operator-binary/src/controller/build/role_group/controller.rs
+++ b/rust/operator-binary/src/controller/build/role_group/controller.rs
@@ -499,7 +499,7 @@ mod tests {
     #[test]
     fn quorum_manager_container_env_can_be_overridden() {
         let resolved_product_image = test_resolved_product_image();
-        let kafka_security = crate::controller::build::security::tests::kerberos();
+        let kafka_security = crate::controller::test_support::kerberos();
         assert!(
             kafka_security.has_kerberos_enabled(),
             "sanity check failed: the fixture must have Kerberos enabled so that KRB5_CONFIG \
diff --git a/rust/operator-binary/src/controller/build/security.rs b/rust/operator-binary/src/controller/build/security.rs
index bffc7fc51..bbd7bbcea 100644
--- a/rust/operator-binary/src/controller/build/security.rs
+++ b/rust/operator-binary/src/controller/build/security.rs
@@ -13,7 +13,6 @@ use stackable_operator::{
     },
     commons::secret_class::SecretClassVolumeProvisionParts,
     constant,
-    crd::authentication::core,
     k8s_openapi::api::core::v1::Volume,
     shared::time::Duration,
     v2::types::kubernetes::VolumeName,
@@ -271,7 +270,7 @@ pub fn mount_broker_tls_volumes(
     let mut volumes = Vec::new();
 
     // add tls (server or client authentication volumes) if required
-    if let Some(tls_server_secret_class) = tls_secret_class(security) {
+    if let Some(tls_server_secret_class) = security.tls_secret_class() {
         // We have to mount tls pem files for kcat's readiness-probe command (the mount can be
         // used directly)
         volumes.push(create_kcat_tls_volume(
@@ -588,19 +587,6 @@ pub fn controller_config_settings(security: &ValidatedKafkaSecurity) -> BTreeMap
     config
 }
 
-/// Returns the `SecretClass` provided in a `AuthenticationClass` for TLS.
-fn tls_secret_class(security: &ValidatedKafkaSecurity) -> Option<&str> {
-    security
-        .tls_client_authentication_class()
-        .and_then(|auth_class| match &auth_class.spec.provider {
-            core::v1alpha1::AuthenticationClassProvider::Tls(tls) => {
-                tls.client_cert_secret_class.as_deref()
-            }
-            _ => None,
-        })
-        .or_else(|| security.tls_server_secret_class())
-}
-
 /// Creates ephemeral volumes to mount the `SecretClass` into the Pods for kcat client
 fn create_kcat_tls_volume(
     volume_name: &VolumeName,
@@ -692,107 +678,13 @@ fn kcat_client_sasl_ssl(cert_directory: &str, service_name: &str) -> Vec<String>
 }
 
 #[cfg(test)]
-pub(crate) mod tests {
-    use std::{collections::BTreeMap, str::FromStr};
-
-    use stackable_operator::{
-        builder::meta::ObjectMetaBuilder,
-        crd::authentication::{core, kerberos, tls},
-        v2::types::kubernetes::SecretClassName,
-    };
+mod tests {
+    use std::collections::BTreeMap;
 
     use super::*;
-    use crate::crd::authentication::ResolvedAuthenticationClasses;
-
-    fn tls_auth_class() -> core::v1alpha1::AuthenticationClass {
-        core::v1alpha1::AuthenticationClass {
-            metadata: ObjectMetaBuilder::new().name("tls-auth").build(),
-            spec: core::v1alpha1::AuthenticationClassSpec {
-                provider: core::v1alpha1::AuthenticationClassProvider::Tls(
-                    tls::v1alpha1::AuthenticationProvider {
-                        client_cert_secret_class: Some("client-auth-secret-class".to_string()),
-                    },
-                ),
-            },
-        }
-    }
-
-    fn kerberos_auth_class() -> core::v1alpha1::AuthenticationClass {
-        core::v1alpha1::AuthenticationClass {
-            metadata: ObjectMetaBuilder::new().name("kerberos-auth").build(),
-            spec: core::v1alpha1::AuthenticationClassSpec {
-                provider: core::v1alpha1::AuthenticationClassProvider::Kerberos(
-                    kerberos::v1alpha1::AuthenticationProvider {
-                        kerberos_secret_class: "kerberos-secret-class".to_string(),
-                    },
-                ),
-            },
-        }
-    }
-
-    fn no_auth() -> ResolvedAuthenticationClasses {
-        ResolvedAuthenticationClasses::new(vec![])
-    }
-
-    /// Plaintext: no TLS, no authentication, no OPA.
-    pub(crate) fn plaintext() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            no_auth(),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            None,
-            None,
-        )
-    }
-
-    /// Server TLS only (encryption without client authentication).
-    fn server_tls() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            no_auth(),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            Some("tls".parse().unwrap()),
-            None,
-        )
-    }
-
-    /// Mutual TLS (client-certificate authentication).
-    fn client_auth_tls() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            ResolvedAuthenticationClasses::new(vec![tls_auth_class()]),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            Some("tls".parse().unwrap()),
-            None,
-        )
-    }
-
-    /// Kerberos, which also requires server and internal TLS.
-    pub(crate) fn kerberos() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            ResolvedAuthenticationClasses::new(vec![kerberos_auth_class()]),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            Some("tls".parse().unwrap()),
-            None,
-        )
-    }
-
-    /// Internal TLS only (broker/controller encryption without client TLS).
-    fn internal_tls() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            no_auth(),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            None,
-            None,
-        )
-    }
-
-    /// OPA authorization with a TLS truststore (internal + server TLS also enabled).
-    fn opa() -> ValidatedKafkaSecurity {
-        ValidatedKafkaSecurity::new(
-            no_auth(),
-            SecretClassName::from_str("tls").expect("tls secret class name is valid"),
-            Some("tls".parse().unwrap()),
-            Some("opa-tls".parse().unwrap()),
-        )
-    }
+    use crate::controller::test_support::{
+        client_auth_tls, internal_tls, kerberos, opa, plaintext, server_tls,
+    };
 
     fn as_str_vec(commands: &[String]) -> Vec<&str> {
         commands.iter().map(String::as_str).collect()
diff --git a/rust/operator-binary/src/controller/security.rs b/rust/operator-binary/src/controller/security.rs
index 90bd62178..a97c732f2 100644
--- a/rust/operator-binary/src/controller/security.rs
+++ b/rust/operator-binary/src/controller/security.rs
@@ -101,6 +101,18 @@ impl ValidatedKafkaSecurity {
             .get_tls_authentication_class()
     }
 
+    /// The `SecretClass` of a TLS `AuthenticationClass`, otherwise the server `SecretClass`.
+    pub fn tls_secret_class(&self) -> Option<&str> {
+        self.tls_client_authentication_class()
+            .and_then(|auth_class| match &auth_class.spec.provider {
+                core::v1alpha1::AuthenticationClassProvider::Tls(tls) => {
+                    tls.client_cert_secret_class.as_deref()
+                }
+                _ => None,
+            })
+            .or_else(|| self.tls_server_secret_class())
+    }
+
     /// Retrieve the internal `SecretClass`. Internal (inter-broker) TLS is mandatory, so this is
     /// always set (defaults to `tls`).
     pub fn tls_internal_secret_class(&self) -> &str {
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index 3f0f2322d..c31f81d4b 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -6,7 +6,7 @@
 use std::{collections::BTreeMap, str::FromStr};
 
 use serde::Serialize;
-use snafu::{OptionExt, ResultExt, Snafu};
+use snafu::{OptionExt, ResultExt, Snafu, ensure};
 use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     commons::product_image_selection,
@@ -24,14 +24,15 @@ use stackable_operator::{
             validate_logging_configuration_for_container,
         },
         role_utils::{JavaCommonConfig, Role, RoleGroup, RoleGroupConfig, with_validated_config},
-        types::kubernetes::ConfigMapName,
+        types::kubernetes::{ConfigMapName, SecretClassName},
     },
 };
 
 use crate::{
     controller::{
-        BrokerRoleGroupConfig, ControllerRoleGroupConfig, RoleGroupName, ValidatedBrokerConfig,
-        ValidatedCluster, ValidatedClusterConfig, ValidatedControllerConfig, ValidatedRoleConfig,
+        AgentConnection, BrokerRoleGroupConfig, ControllerRoleGroupConfig, RoleGroupName,
+        ValidatedAgentConfig, ValidatedBrokerConfig, ValidatedCluster, ValidatedClusterConfig,
+        ValidatedControllerConfig, ValidatedRoleConfig,
         dereference::DereferencedObjects,
         replicas_or_default,
         security::{self, ValidatedKafkaSecurity},
@@ -131,6 +132,32 @@ pub enum Error {
          to join without it"
     ))]
     MissingKraftControllerRole,
+
+    #[snafu(display(
+        "management access requires the operator image, which also contains the agent; set the \
+         OPERATOR_IMAGE environment variable of the operator"
+    ))]
+    ManagementAccessRequiresOperatorImage,
+
+    #[snafu(display("management access is only supported in KRaft mode"))]
+    ManagementAccessRequiresKraft,
+
+    #[snafu(display("management access does not support clusters with Kerberos authentication"))]
+    ManagementAccessWithKerberos,
+
+    #[snafu(display(
+        "the cluster requires client authentication, but management access is anonymous"
+    ))]
+    AnonymousManagementAccessWithClientAuthentication,
+
+    #[snafu(display("TLS management access requires the cluster to use TLS"))]
+    TlsManagementAccessRequiresTls,
+
+    #[snafu(display("the SecretClass {secret_class:?} of the client listener is invalid"))]
+    ParseClientListenerSecretClass {
+        source: stackable_operator::v2::macros::attributed_string_type::Error,
+        secret_class: String,
+    },
 }
 
 /// Validated logging configuration for a Kafka role group's Kafka and (optional) Vector
@@ -215,6 +242,7 @@ pub fn validate(
     kafka: &v1alpha1::KafkaCluster,
     dereferenced_objects: DereferencedObjects,
     operator_environment: &OperatorEnvironmentOptions,
+    operator_image: Option<&str>,
 ) -> Result<ValidatedCluster> {
     let image = kafka
         .spec
@@ -341,6 +369,29 @@ pub fn validate(
         .cluster_domain
         .clone();
 
+    let agent_config = kafka
+        .spec
+        .cluster_config
+        .management_access
+        .as_ref()
+        .filter(|management_access| management_access.enabled)
+        .map(|management_access| {
+            ensure!(
+                metadata_manager == crate::crd::MetadataManager::KRaft,
+                ManagementAccessRequiresKraftSnafu
+            );
+            Ok(ValidatedAgentConfig {
+                image: operator_image
+                    .context(ManagementAccessRequiresOperatorImageSnafu)?
+                    .to_owned(),
+                connection: validate_agent_connection(
+                    &management_access.authentication.user_provided,
+                    &kafka_security,
+                )?,
+            })
+        })
+        .transpose()?;
+
     Ok(ValidatedCluster {
         metadata: ValidatedCluster::object_meta(&name, &namespace, &uid),
         name,
@@ -365,6 +416,7 @@ pub fn validate(
         controller_config,
         controller_role_group_configs,
         bootstrap_listeners: dereferenced_objects.bootstrap_listeners,
+        agent_config,
     })
 }
 
@@ -557,16 +609,159 @@ fn inject_cluster_id(env_overrides: EnvVarSet, cluster_id: Option<&str>) -> EnvV
     }
 }
 
+/// Determines how the agent connects to the cluster, and rejects management access authentication
+/// config that cannot connect to it.
+fn validate_agent_connection(
+    authentication: &v1alpha1::UserProvidedAuthentication,
+    security: &ValidatedKafkaSecurity,
+) -> Result<AgentConnection> {
+    ensure!(
+        !security.has_kerberos_enabled(),
+        ManagementAccessWithKerberosSnafu
+    );
+
+    let server_ca_secret_class = security
+        .tls_secret_class()
+        .map(|secret_class| {
+            SecretClassName::from_str(secret_class)
+                .context(ParseClientListenerSecretClassSnafu { secret_class })
+        })
+        .transpose()?;
+
+    match (authentication, server_ca_secret_class) {
+        (v1alpha1::UserProvidedAuthentication::Anonymous(_), server_ca_secret_class) => {
+            ensure!(
+                security.tls_client_authentication_class().is_none(),
+                AnonymousManagementAccessWithClientAuthenticationSnafu
+            );
+            Ok(match server_ca_secret_class {
+                None => AgentConnection::Plaintext,
+                Some(server_ca_secret_class) => AgentConnection::Tls {
+                    server_ca_secret_class,
+                },
+            })
+        }
+        (v1alpha1::UserProvidedAuthentication::Tls(_), None) => {
+            TlsManagementAccessRequiresTlsSnafu.fail()
+        }
+        (
+            v1alpha1::UserProvidedAuthentication::Tls(client_credential),
+            Some(server_ca_secret_class),
+        ) => Ok(AgentConnection::MutualTls {
+            server_ca_secret_class,
+            client_credential: client_credential.clone(),
+        }),
+    }
+}
+
 #[cfg(test)]
 mod tests {
-    use stackable_operator::v2::builder::pod::container::EnvVarSet;
+    use std::str::FromStr;
+
+    use rstest::rstest;
+    use stackable_operator::{
+        crd::management_access::v1alpha1::{Anonymous, TlsClientCredential},
+        v2::{
+            builder::pod::container::EnvVarSet,
+            types::kubernetes::{SecretClassName, SecretName},
+        },
+    };
 
-    use super::{Error, KAFKA_CLUSTER_ID, inject_cluster_id};
-    use crate::controller::test_support::{
-        app_version_label, broker_role_group_config, controller_role_group_config, minimal_kafka,
-        validated_cluster,
+    use super::{Error, KAFKA_CLUSTER_ID, inject_cluster_id, validate_agent_connection};
+    use crate::{
+        controller::{
+            AgentConnection,
+            security::ValidatedKafkaSecurity,
+            test_support::{
+                app_version_label, broker_role_group_config, client_auth_tls,
+                controller_role_group_config, kerberos, minimal_kafka, plaintext, server_tls,
+                validate_with_operator_image, validated_cluster,
+            },
+        },
+        crd::v1alpha1::UserProvidedAuthentication,
     };
 
+    fn anonymous() -> UserProvidedAuthentication {
+        UserProvidedAuthentication::Anonymous(Anonymous::default())
+    }
+
+    fn agent_cert() -> TlsClientCredential {
+        TlsClientCredential::SecretName(
+            SecretName::from_str("agent-cert").expect("the Secret name should be valid"),
+        )
+    }
+
+    fn tls() -> UserProvidedAuthentication {
+        UserProvidedAuthentication::Tls(agent_cert())
+    }
+
+    fn tls_secret_class(name: &str) -> SecretClassName {
+        SecretClassName::from_str(name).expect("the SecretClass name should be valid")
+    }
+
+    #[rstest]
+    #[case::plaintext_anonymous(plaintext(), anonymous(), AgentConnection::Plaintext)]
+    #[case::server_tls_anonymous(
+        server_tls(),
+        anonymous(),
+        AgentConnection::Tls { server_ca_secret_class: tls_secret_class("tls") }
+    )]
+    #[case::server_tls_with_credential(
+        server_tls(),
+        tls(),
+        AgentConnection::MutualTls {
+            server_ca_secret_class: tls_secret_class("tls"),
+            client_credential: agent_cert(),
+        }
+    )]
+    #[case::client_auth_with_credential(
+        client_auth_tls(),
+        tls(),
+        AgentConnection::MutualTls {
+            server_ca_secret_class: tls_secret_class("client-auth-secret-class"),
+            client_credential: agent_cert(),
+        }
+    )]
+    fn agent_connection(
+        #[case] security: ValidatedKafkaSecurity,
+        #[case] authentication: UserProvidedAuthentication,
+        #[case] expected: AgentConnection,
+    ) {
+        let connection = validate_agent_connection(&authentication, &security)
+            .expect("the management access should be valid");
+
+        assert_eq!(expected, connection);
+    }
+
+    #[rstest]
+    #[case::anonymous(anonymous())]
+    #[case::tls(tls())]
+    fn reject_management_access_with_kerberos(#[case] authentication: UserProvidedAuthentication) {
+        let error = validate_agent_connection(&authentication, &kerberos())
+            .expect_err("the management access should be invalid");
+
+        assert!(matches!(error, Error::ManagementAccessWithKerberos));
+    }
+
+    #[test]
+    fn reject_anonymous_management_access_with_client_authentication() {
+        let error = validate_agent_connection(&anonymous(), &client_auth_tls())
+            .expect_err("the management access should be invalid");
+
+        assert!(matches!(
+            error,
+            Error::AnonymousManagementAccessWithClientAuthentication
+        ));
+    }
+
+    #[test]
+    fn reject_tls_management_access_without_tls() {
+        let error = validate_agent_connection(&tls(), &plaintext())
+            .expect_err("the management access should be invalid");
+
+        assert!(matches!(error, Error::TlsManagementAccessRequiresTls));
+    }
+
     #[test]
     fn test_constants() {
         // Test that dereferencing the constants does not panic.
@@ -678,6 +873,89 @@ mod tests {
         }
     }
 
+    #[rstest::rstest]
+    #[case::enabled(true)]
+    #[case::disabled(false)]
+    fn management_access_requires_the_operator_image(#[case] enabled: bool) {
+        let kafka = minimal_kafka(&format!(
+            r#"
+            apiVersion: kafka.stackable.tech/v1alpha1
+            kind: KafkaCluster
+            metadata:
+              name: simple-kafka
+              namespace: default
+              uid: 12345678-1234-1234-1234-123456789012
+            spec:
+              image:
+                productVersion: 3.9.2
+              clusterConfig:
+                metadataManager: kraft
+                managementAccess:
+                  enabled: {enabled}
+                  authentication:
+                    userProvided:
+                      tls:
+                        secretClassName: tls
+              controllers:
+                roleGroups:
+                  default:
+                    replicas: 1
+              brokers:
+                roleGroups:
+                  default:
+                    replicas: 1
+            "#
+        ));
+
+        let result = validate_with_operator_image(&kafka, None);
+
+        if enabled {
+            assert!(
+                matches!(result, Err(Error::ManagementAccessRequiresOperatorImage)),
+                "expected ManagementAccessRequiresOperatorImage, got: {:?}",
+                result.err()
+            );
+        } else {
+            assert!(result.is_ok(), "expected Ok, got: {:?}", result.err());
+        }
+    }
+
+    #[test]
+    fn zookeeper_mode_rejects_management_access() {
+        let kafka = minimal_kafka(
+            r#"
+            apiVersion: kafka.stackable.tech/v1alpha1
+            kind: KafkaCluster
+            metadata:
+              name: simple-kafka
+              namespace: default
+              uid: 12345678-1234-1234-1234-123456789012
+            spec:
+              image:
+                productVersion: 3.9.2
+              clusterConfig:
+                zookeeperConfigMapName: zk-discovery
+                managementAccess:
+                  enabled: true
+                  authentication:
+                    userProvided:
+                      anonymous: {}
+              brokers:
+                roleGroups:
+                  default:
+                    replicas: 3
+            "#,
+        );
+
+        let result = crate::controller::test_support::validate_err(&kafka);
+
+        assert!(
+            matches!(result, Err(Error::ManagementAccessRequiresKraft)),
+            "expected ManagementAccessRequiresKraft, got: {:?}",
+            result.err()
+        );
+    }
+
     #[test]
     fn injects_cluster_id_when_absent() {
         let env = inject_cluster_id(EnvVarSet::new(), Some("my-id"));
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 77bbfd17c..3faba948e 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -18,6 +18,7 @@ use stackable_operator::{
     },
     config::merge::Merge,
     constant,
+    crd::management_access::v1alpha1::{Anonymous, TlsClientCredential},
     deep_merger::ObjectOverrides,
     kube::{CustomResource, runtime::reflector::ObjectRef},
     role_utils::GenericRoleConfig,
@@ -241,6 +242,37 @@ pub mod versioned {
         ///
         #[serde(skip_serializing_if = "Option::is_none")]
         pub broker_id_pod_config_map_name: Option<ConfigMapName>,
+
+        // no doc - docs in KafkaManagementAccess struct.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub management_access: Option<v1alpha1::KafkaManagementAccess>,
+    }
+
+    /// Management access of the Stackable Data Platform to this Kafka cluster, used to manage
+    /// resources like `KafkaTopic`s. The credential must be authorized in Kafka by the user.
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct KafkaManagementAccess {
+        /// Whether management access is enabled.
+        pub enabled: bool,
+
+        /// How the Stackable Data Platform authenticates to Kafka.
+        pub authentication: v1alpha1::KafkaManagementAccessAuthentication,
+    }
+
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct KafkaManagementAccessAuthentication {
+        // no doc - docs in UserProvidedAuthentication enum.
+        pub user_provided: v1alpha1::UserProvidedAuthentication,
+    }
+
+    /// A credential provided by the user.
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub enum UserProvidedAuthentication {
+        Anonymous(Anonymous),
+        Tls(TlsClientCredential),
     }
 
     #[derive(Clone, Debug, Default, Deserialize, JsonSchema, Merge, PartialEq, Serialize)]
@@ -274,6 +306,7 @@ impl Default for v1alpha1::KafkaClusterConfig {
             zookeeper_config_map_name: None,
             metadata_manager: None,
             broker_id_pod_config_map_name: None,
+            management_access: None,
         }
     }
 }
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
index 7cc27ba43..7a0a9c5f9 100644
--- a/rust/operator-binary/src/main.rs
+++ b/rust/operator-binary/src/main.rs
@@ -14,7 +14,7 @@ use stackable_operator::{
     crd::listener,
     eos::EndOfSupportChecker,
     k8s_openapi::api::{
-        apps::v1::StatefulSet,
+        apps::v1::{Deployment, StatefulSet},
         core::v1::{ConfigMap, Service, ServiceAccount},
         policy::v1::PodDisruptionBudget,
         rbac::v1::RoleBinding,
@@ -37,7 +37,7 @@ use stackable_operator::{
 };
 
 use crate::{
-    controller::KAFKA_FULL_CONTROLLER_NAME,
+    controller::{KAFKA_FULL_CONTROLLER_NAME, all_agents_selector},
     crd::{KAFKA_OPERATOR_NAME, KafkaCluster, KafkaClusterVersion, v1alpha1},
     webhooks::conversion::create_webhook_server,
 };
@@ -68,6 +68,11 @@ struct Opts {
 struct KafkaRun {
     #[clap(flatten)]
     common: RunArguments,
+
+    /// The image of this operator, which also contains the agent. Required to enable management
+    /// access on a KafkaCluster.
+    #[arg(long, env)]
+    operator_image: Option<String>,
 }
 
 #[tokio::main]
@@ -84,7 +89,7 @@ async fn main() -> anyhow::Result<()> {
                     maintenance,
                     common,
                 },
-            ..
+            operator_image,
         }) => {
             // NOTE (@NickLarsenNZ): Before stackable-telemetry was used:
             // - The console log level was set by `KAFKA_OPERATOR_LOG`, and is now `CONSOLE_LOG` (when using Tracing::pre_configured).
@@ -179,6 +184,11 @@ async fn main() -> anyhow::Result<()> {
                     watch_namespace.get_api::<DeserializeGuard<StatefulSet>>(&client),
                     watcher::Config::default(),
                 )
+                .owns(
+                    watch_namespace.get_api::<DeserializeGuard<Deployment>>(&client),
+                    // The agent is the only Deployment
+                    watcher::Config::default().labels_from(&all_agents_selector()),
+                )
                 .watches(
                     watch_namespace.get_api::<DeserializeGuard<ConfigMap>>(&client),
                     watcher::Config::default(),
@@ -197,6 +207,7 @@ async fn main() -> anyhow::Result<()> {
                     Arc::new(controller::Ctx {
                         client: client.clone(),
                         operator_environment,
+                        operator_image,
                     }),
                 )
                 // We can let the reporting happen in the background
diff --git a/rust/shared/Cargo.toml b/rust/shared/Cargo.toml
new file mode 100644
index 000000000..a26223f1c
--- /dev/null
+++ b/rust/shared/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "stackable-kafka-shared"
+description = "Types and contracts shared by the Stackable operator and agent for Apache Kafka"
+version.workspace = true
+authors.workspace = true
+license.workspace = true
+edition.workspace = true
+repository.workspace = true
+publish = false
+
+[dependencies]
+stackable-operator.workspace = true
+
+strum.workspace = true
+
+[dev-dependencies]
+rstest.workspace = true
diff --git a/rust/shared/src/agent.rs b/rust/shared/src/agent.rs
new file mode 100644
index 000000000..c481cbc47
--- /dev/null
+++ b/rust/shared/src/agent.rs
@@ -0,0 +1,51 @@
+//! Paths and environment variables through which the operator configures the agent.
+
+use std::str::FromStr;
+
+use stackable_operator::{constant, v2::builder::pod::container::EnvVarName};
+use strum::{Display, EnumString};
+
+/// Directory of the CA certificate the Kafka brokers are verified with.
+pub const KAFKA_TLS_DIR: &str = "/stackable/secrets/tls-kafka";
+
+constant!(pub ENV_CLUSTER_NAME: EnvVarName = "KAFKA_CLUSTER_NAME");
+constant!(pub ENV_CLUSTER_NAMESPACE: EnvVarName = "KAFKA_CLUSTER_NAMESPACE");
+constant!(pub ENV_CLIENT_SECURITY: EnvVarName = "KAFKA_CLIENT_SECURITY");
+// Comma-separated `host:port` list
+constant!(pub ENV_BOOTSTRAP_SERVERS: EnvVarName = "KAFKA_BOOTSTRAP_SERVERS");
+
+/// How the agent connects to the brokers.
+#[derive(Clone, Copy, Debug, Display, EnumString, Eq, PartialEq)]
+#[strum(serialize_all = "kebab-case")]
+pub enum ClientSecurity {
+    Plaintext,
+    Tls,
+    MutualTls,
+}
+
+#[cfg(test)]
+mod tests {
+    use std::str::FromStr;
+
+    use rstest::rstest;
+
+    use super::*;
+
+    #[test]
+    fn test_constants() {
+        // Test that dereferencing the constants does not panic.
+        let _ = *ENV_CLUSTER_NAME;
+        let _ = *ENV_CLUSTER_NAMESPACE;
+        let _ = *ENV_CLIENT_SECURITY;
+        let _ = *ENV_BOOTSTRAP_SERVERS;
+    }
+
+    #[rstest]
+    #[case::plaintext(ClientSecurity::Plaintext, "plaintext")]
+    #[case::tls(ClientSecurity::Tls, "tls")]
+    #[case::mutual_tls(ClientSecurity::MutualTls, "mutual-tls")]
+    fn roundtrip(#[case] security: ClientSecurity, #[case] value: &str) {
+        assert_eq!(value, security.to_string());
+        assert_eq!(Ok(security), ClientSecurity::from_str(value));
+    }
+}
diff --git a/rust/shared/src/lib.rs b/rust/shared/src/lib.rs
new file mode 100644
index 000000000..f17bc55db
--- /dev/null
+++ b/rust/shared/src/lib.rs
@@ -0,0 +1 @@
+pub mod agent;