diff --git a/.ko.yaml b/.ko.yaml
index a16adb0c23..de52c8416c 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -12,14 +12,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-defaultBaseImage: gcr.io/distroless/static-debian13:latest@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe
+defaultBaseImage: gcr.io/distroless/static-debian13:latest@sha256:15f8637509792e05b97d83451b0b6ccfa4abd548f997e406ac1e72c87fe1fa78
 
 defaultPlatforms:
   - linux/amd64
   - linux/arm64
 
 baseImageOverrides:
-  go.ate.dev/substrate/demos/sandbox: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+  go.ate.dev/substrate/demos/sandbox: alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
   # atelet needs glibc to run the node's kubelet credential provider, which
   # some platforms ship dynamically linked (e.g. AKS, GKE Ubuntu).
-  go.ate.dev/substrate/cmd/atelet: gcr.io/distroless/base-debian13:latest@sha256:389cad21f73e4c37b94ffe5b13736d5a92bd5bd3c6c6b38c2be1c881e14ba2bd
+  go.ate.dev/substrate/cmd/atelet: gcr.io/distroless/base-debian13:latest@sha256:f5e95195e998742ff590b7569bae479accce1226e51ae6c3118954030121cdcb
diff --git a/cmd/kubectl-ate/README.md b/cmd/kubectl-ate/README.md
index 21c27a77e4..d0ac8f2528 100644
--- a/cmd/kubectl-ate/README.md
+++ b/cmd/kubectl-ate/README.md
@@ -49,7 +49,7 @@ gcloud beta container clusters update CLUSTER_NAME \
 
 **Local (kind):**
 
-The kind overlay installed by `hack/install-ate-kind.sh --deploy-ate-system` already provisions an in-cluster OpenTelemetry Collector and a Jaeger all-in-one in the `otel-system` namespace. No additional setup is required.
+The kind overlay installed by `hack/install-ate-kind.sh --deploy-ate-system` already provisions an in-cluster OpenTelemetry Collector and Jaeger in the `otel-system` namespace. No additional setup is required.
 
 Port-forward the Jaeger UI and invoke any command with `--trace`:
 ```bash
diff --git a/docs/dev/best-practices/otel-collector.md b/docs/dev/best-practices/otel-collector.md
index 864ded4538..ab34989c9d 100644
--- a/docs/dev/best-practices/otel-collector.md
+++ b/docs/dev/best-practices/otel-collector.md
@@ -504,7 +504,7 @@ failure.
 
 ## Local Development (kind)
 
-`hack/install-ate-kind.sh` installs a collector plus a Jaeger all-in-one into
+`hack/install-ate-kind.sh` installs a collector plus Jaeger into
 the `otel-system` namespace — see
 `manifests/ate-install/kind/otel-collector.yaml`. It is a single-replica
 Deployment, which is appropriate for a one-node kind cluster. The kind
diff --git a/internal/plugins/gcp-secret-manager/.ko.yaml b/internal/plugins/gcp-secret-manager/.ko.yaml
index b1cf10e495..9d60cbabcb 100644
--- a/internal/plugins/gcp-secret-manager/.ko.yaml
+++ b/internal/plugins/gcp-secret-manager/.ko.yaml
@@ -14,7 +14,7 @@
 
 # Substrate's base image, pinned by multi-platform index digest. Set
 # KO_DEFAULTPLATFORMS to override the platforms, e.g. host-only for kind.
-defaultBaseImage: gcr.io/distroless/static-debian13:latest@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe
+defaultBaseImage: gcr.io/distroless/static-debian13:latest@sha256:15f8637509792e05b97d83451b0b6ccfa4abd548f997e406ac1e72c87fe1fa78
 
 defaultPlatforms:
   - linux/amd64
diff --git a/manifests/ate-install/kind/otel-collector.yaml b/manifests/ate-install/kind/otel-collector.yaml
index d069c509e0..574272bfd8 100644
--- a/manifests/ate-install/kind/otel-collector.yaml
+++ b/manifests/ate-install/kind/otel-collector.yaml
@@ -242,7 +242,7 @@ spec:
     spec:
       containers:
       - name: jaeger
-        image: jaegertracing/all-in-one:1.55@sha256:f6b5d09073f14f76873d300f565a6691d815e81bea8e07e1dc3ff67e0596dd4e
+        image: jaegertracing/jaeger:2.22.0@sha256:836b967b5abcf1f7758066aa6b348619267a2f1459f72d472840570f9bd88a17
         ports:
         - name: otlp-grpc
           containerPort: 4317