diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 875433dfee..22d9fde0c9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -117,7 +117,7 @@ jobs:
     if: always() && contains(needs.release.result, 'success') && !github.event.act
     runs-on: ubuntu-latest
     container:
-      image: linode/apl-tools:v2.4.0
+      image: linode/apl-tools:2.7.0
       options: --user 0
     env:
       COMMIT_MSG: ${{ github.event.head_commit.message }}
diff --git a/tools/Dockerfile b/tools/Dockerfile
index 307cd4e3e8..d8242d2962 100644
--- a/tools/Dockerfile
+++ b/tools/Dockerfile
@@ -4,27 +4,27 @@ FROM ubuntu:20.04 as builder
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 # https://github.com/kubernetes/kubernetes/releases
-ARG KUBECTL_VERSION=1.30.4
+ARG KUBECTL_VERSION=1.31.1
 # https://github.com/helm/helm/tags
-ARG HELM_VERSION=3.15.1
+ARG HELM_VERSION=3.16.1
 # https://github.com/databus23/helm-diff/releases
-ARG HELM_DIFF_VERSION=3.9.7
+ARG HELM_DIFF_VERSION=3.9.11
 # https://github.com/jkroepke/helm-secrets/releases
 ARG HELM_SECRETS_VERSION=3.15.0
 # https://github.com/mozilla/sops/releases
-ARG SOPS_VERSION=3.7.3
+ARG SOPS_VERSION=3.9.0
 # https://github.com/FiloSottile/age/releases
 ARG AGE_VERSION=1.2.0
 # https://github.com/noqcks/gucci/releases
-ARG GUCCI_VERSION=1.6.6
+ARG GUCCI_VERSION=1.6.13
 # https://github.com/helmfile/helmfile/releases
-ARG HELMFILE_VERSION=0.165.0
+ARG HELMFILE_VERSION=0.168.0
 # https://github.com/yannh/kubeconform/releases
-ARG KUBECONFORM_VERSION="v0.6.4"
+ARG KUBECONFORM_VERSION="v0.6.7"
 # https://github.com/open-policy-agent/conftest/releases
-ARG CONFTEST_VERSION=0.39.2
+ARG CONFTEST_VERSION=0.55.0
 # https://github.com/plexsystems/konstraint/releases
-ARG KONSTRAINT_VERSION=0.26.0
+ARG KONSTRAINT_VERSION=0.38.0
 # https://nodejs.org/en/download/
 ARG NODE_VERSION=16
 
@@ -89,7 +89,7 @@ RUN curl -LO "https://dl.k8s.io/release/v$KUBECTL_VERSION/bin/linux/$TARGETARCH/
   chmod +x kubectl
 
 # sops
-ADD https://github.com/mozilla/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux sops
+ADD https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64 sops
 RUN chmod +x sops
 
 # age
@@ -110,7 +110,7 @@ ADD https://github.com/helmfile/helmfile/releases/download/v${HELMFILE_VERSION}/
 RUN tar -zxvf /tmp/helmfile_${HELMFILE_VERSION}_linux_${TARGETARCH}.tar.gz -C /tmp && mv /tmp/helmfile helmfile
 
 # gucci
-ADD https://github.com/noqcks/gucci/releases/download/${GUCCI_VERSION}/gucci-v${GUCCI_VERSION}-linux-${TARGETARCH} gucci
+ADD https://github.com/noqcks/gucci/releases/download/v${GUCCI_VERSION}/gucci-v${GUCCI_VERSION}-linux-${TARGETARCH} gucci
 RUN chmod +x gucci
 
 # aws
diff --git a/versions.yaml b/versions.yaml
index 030ae04ac3..412571f4cf 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -1,4 +1,4 @@
 api: main
 console: main
 tasks: 3.2.0
-tools: 2.6.0
+tools: 2.7.0