diff --git a/.github/renovate.json b/.github/renovate.json
index 85516079..00bc7a77 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -6,8 +6,5 @@
   "baseBranchPatterns": [
     "main"
   ],
-  "prHourlyLimit": 2,
-  "baseBranches": [
-    "main"
-  ]
+  "prHourlyLimit": 2
 }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec694143..89d1a0ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,16 +12,21 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
       with:
         go-version-file: go.mod
         cache: false
+    # https://github.com/golang/go/issues/75031
+    - name: Set toolchain version
+      run: go env -w GOTOOLCHAIN=go1.25.4+auto
 
     - name: Lint
-      uses: golangci/golangci-lint-action@v4
+      uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+      with:
+        version: v2.7.1
 
     - name: Validate Go modules
       run: ./scripts/validate
@@ -51,7 +56,7 @@ jobs:
         echo "VERSION=$VERSION" >> $GITHUB_ENV
 
     - name: Docker Build
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         push: false
         context: package
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 19e78acd..56f0db59 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Load Secrets from Vault
         uses: rancher-eio/read-vault-secrets@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8a1248ac..70a00d60 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Load Secrets from Vault
       uses: rancher-eio/read-vault-secrets@main
@@ -25,24 +25,24 @@ jobs:
           secret/data/github/repo/${{ github.repository }}/google-auth/rancher/credentials token  | GOOGLE_AUTH ;
 
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
       with:
         username: ${{ env.DOCKER_USERNAME }}
         password: ${{ env.DOCKER_PASSWORD }}
 
     - name: Authenticate to Google Cloud 
-      uses: google-github-actions/auth@v2
+      uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
       with:
         credentials_json: "${{ env.GOOGLE_AUTH }}"
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
       with:
         go-version-file: go.mod
         cache: false
 
     - name: Lint
-      uses: golangci/golangci-lint-action@v4
+      uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4
 
     - name: Validate Go modules
       run: ./scripts/validate
@@ -82,7 +82,7 @@ jobs:
         gh release upload $VERSION *.txt *.xz *.gz *.zip
 
     - name: Upload Release assets to Google Cloud
-      uses: google-github-actions/upload-cloud-storage@v2
+      uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
       with:
         path: dist/artifacts/${{ env.VERSION }}
         destination: releases.rancher.com/cli2/${{ env.VERSION }}
@@ -93,7 +93,7 @@ jobs:
           cache-control: public,max-age=3600
 
     - name: Docker Build
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         push: true
         context: package
diff --git a/.golangci.json b/.golangci.json
index 0c2977c8..82cf01b1 100644
--- a/.golangci.json
+++ b/.golangci.json
@@ -1,10 +1,17 @@
 {
-    "linters": {
-        "enable": [
-            "gofmt"
-        ]
-    },
-    "run": {
-        "timeout": "10m"
-    }
-}
\ No newline at end of file
+  "formatters": {
+    "enable": [
+      "gofmt"
+    ]
+  },
+  "linters": {
+    "default": "none",
+    "enable": [
+      "govet",
+      "ineffassign",
+      "staticcheck",
+      "unused"
+    ]
+  },
+  "version": "2"
+}
diff --git a/cliclient/cliclient.go b/cliclient/cliclient.go
index 9b8073de..83050ea6 100644
--- a/cliclient/cliclient.go
+++ b/cliclient/cliclient.go
@@ -162,11 +162,11 @@ func (mc *MasterClient) newCAPIClient() error {
 func (mc *MasterClient) ByID(resource *ntypes.Resource, respObject interface{}) error {
 	if strings.HasPrefix(resource.Type, "cluster.x-k8s.io") {
 		return mc.CAPIClient.ByID(resource.Type, resource.ID, &respObject)
-	} else if _, ok := mc.ManagementClient.APIBaseClient.Types[resource.Type]; ok {
+	} else if _, ok := mc.ManagementClient.Types[resource.Type]; ok {
 		return mc.ManagementClient.ByID(resource.Type, resource.ID, &respObject)
-	} else if _, ok := mc.ProjectClient.APIBaseClient.Types[resource.Type]; ok {
+	} else if _, ok := mc.ProjectClient.Types[resource.Type]; ok {
 		return mc.ProjectClient.ByID(resource.Type, resource.ID, &respObject)
-	} else if _, ok := mc.ClusterClient.APIBaseClient.Types[resource.Type]; ok {
+	} else if _, ok := mc.ClusterClient.Types[resource.Type]; ok {
 		return mc.ClusterClient.ByID(resource.Type, resource.ID, &respObject)
 	}
 	return fmt.Errorf("MasterClient - unknown resource type %v", resource.Type)
diff --git a/cmd/cluster.go b/cmd/cluster.go
index 966ba112..590d497b 100644
--- a/cmd/cluster.go
+++ b/cmd/cluster.go
@@ -742,7 +742,7 @@ func getClusterRAM(cluster managementClient.Cluster) string {
 // parseResourceString returns GB for Ki and Mi and CPU cores from 'm'
 func parseResourceString(mem string) string {
 	if strings.HasSuffix(mem, "Ki") {
-		num, err := strconv.ParseFloat(strings.Replace(mem, "Ki", "", -1), 64)
+		num, err := strconv.ParseFloat(strings.ReplaceAll(mem, "Ki", ""), 64)
 		if err != nil {
 			return mem
 		}
@@ -750,7 +750,7 @@ func parseResourceString(mem string) string {
 		return strings.TrimSuffix(fmt.Sprintf("%.2f", num), ".0")
 	}
 	if strings.HasSuffix(mem, "Mi") {
-		num, err := strconv.ParseFloat(strings.Replace(mem, "Mi", "", -1), 64)
+		num, err := strconv.ParseFloat(strings.ReplaceAll(mem, "Mi", ""), 64)
 		if err != nil {
 			return mem
 		}
@@ -758,7 +758,7 @@ func parseResourceString(mem string) string {
 		return strings.TrimSuffix(fmt.Sprintf("%.2f", num), ".0")
 	}
 	if strings.HasSuffix(mem, "m") {
-		num, err := strconv.ParseFloat(strings.Replace(mem, "m", "", -1), 64)
+		num, err := strconv.ParseFloat(strings.ReplaceAll(mem, "m", ""), 64)
 		if err != nil {
 			return mem
 		}
diff --git a/cmd/common.go b/cmd/common.go
index 08d522f7..5ac90e29 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -261,7 +261,7 @@ func loadAndVerifyCert(path string) (string, error) {
 
 func verifyCert(caCert []byte) (string, error) {
 	// replace the escaped version of the line break
-	caCert = bytes.Replace(caCert, []byte(`\n`), []byte("\n"), -1)
+	caCert = bytes.ReplaceAll(caCert, []byte(`\n`), []byte("\n"))
 
 	block, _ := pem.Decode(caCert)
 
@@ -322,28 +322,28 @@ func GetClient(ctx *cli.Context) (*cliclient.MasterClient, error) {
 // GetResourceType maps an incoming resource type to a valid one from the schema
 func GetResourceType(c *cliclient.MasterClient, resource string) (string, error) {
 	if c.ManagementClient != nil {
-		for key := range c.ManagementClient.APIBaseClient.Types {
+		for key := range c.ManagementClient.Types {
 			if strings.EqualFold(key, resource) {
 				return key, nil
 			}
 		}
 	}
 	if c.ProjectClient != nil {
-		for key := range c.ProjectClient.APIBaseClient.Types {
+		for key := range c.ProjectClient.Types {
 			if strings.EqualFold(key, resource) {
 				return key, nil
 			}
 		}
 	}
 	if c.ClusterClient != nil {
-		for key := range c.ClusterClient.APIBaseClient.Types {
+		for key := range c.ClusterClient.Types {
 			if strings.EqualFold(key, resource) {
 				return key, nil
 			}
 		}
 	}
 	if c.CAPIClient != nil {
-		for key := range c.CAPIClient.APIBaseClient.Types {
+		for key := range c.CAPIClient.Types {
 			lowerKey := strings.ToLower(key)
 			if strings.HasPrefix(lowerKey, "cluster.x-k8s.io") && lowerKey == strings.ToLower(resource) {
 				return key, nil
@@ -370,17 +370,17 @@ func Lookup(c *cliclient.MasterClient, name string, types ...string) (*ntypes.Re
 			}
 		}
 		if c.ManagementClient != nil {
-			if _, ok := c.ManagementClient.APIBaseClient.Types[rt]; ok {
+			if _, ok := c.ManagementClient.Types[rt]; ok {
 				schemaClient = c.ManagementClient
 			}
 		}
 		if c.ProjectClient != nil {
-			if _, ok := c.ProjectClient.APIBaseClient.Types[rt]; ok {
+			if _, ok := c.ProjectClient.Types[rt]; ok {
 				schemaClient = c.ProjectClient
 			}
 		}
 		if c.ClusterClient != nil {
-			if _, ok := c.ClusterClient.APIBaseClient.Types[rt]; ok {
+			if _, ok := c.ClusterClient.Types[rt]; ok {
 				schemaClient = c.ClusterClient
 			}
 		}
@@ -415,7 +415,7 @@ func Lookup(c *cliclient.MasterClient, name string, types ...string) (*ntypes.Re
 			for _, data := range collection.Data {
 				ids = append(ids, data.ID)
 			}
-			return nil, fmt.Errorf("Multiple resources of type %s found for name %s: %v", schemaType, name, ids)
+			return nil, fmt.Errorf("multiple resources of type %s found for name %s: %v", schemaType, name, ids)
 		}
 
 		// No matches for this schemaType, try the next one
@@ -424,7 +424,7 @@ func Lookup(c *cliclient.MasterClient, name string, types ...string) (*ntypes.Re
 		}
 
 		if byName != nil {
-			return nil, fmt.Errorf("Multiple resources named %s: %s:%s, %s:%s", name, collection.Data[0].Type,
+			return nil, fmt.Errorf("multiple resources named %s: %s:%s, %s:%s", name, collection.Data[0].Type,
 				collection.Data[0].ID, byName.Type, byName.ID)
 		}
 
@@ -433,7 +433,7 @@ func Lookup(c *cliclient.MasterClient, name string, types ...string) (*ntypes.Re
 	}
 
 	if byName == nil {
-		return nil, fmt.Errorf("Not found: %s", name)
+		return nil, fmt.Errorf("not found: %s", name)
 	}
 
 	return byName, nil
@@ -546,7 +546,7 @@ func parseClusterAndProjectID(id string) (string, string, error) {
 		parts := SplitOnColon(id)
 		return parts[0], parts[1], nil
 	}
-	return "", "", fmt.Errorf("Unable to extract clusterid and projectid from [%s]", id)
+	return "", "", fmt.Errorf("unable to extract clusterid and projectid from [%s]", id)
 }
 
 // Return a JSON blob of the file at path
diff --git a/cmd/kubectl_token.go b/cmd/kubectl_token.go
index 5ac97ba4..2002a143 100644
--- a/cmd/kubectl_token.go
+++ b/cmd/kubectl_token.go
@@ -241,7 +241,7 @@ func loadCachedCredential(ctx *cli.Context, serverConfig *config.ServerConfig, k
 		return cred, nil
 	}
 	ts := cred.Status.ExpirationTimestamp
-	if ts != nil && ts.Time.Before(time.Now()) {
+	if ts != nil && ts.Before(time.Now()) {
 		cf, err := loadConfig(ctx)
 		if err != nil {
 			return nil, err
diff --git a/cmd/kubectl_token_test.go b/cmd/kubectl_token_test.go
index 43753817..fd8896c0 100644
--- a/cmd/kubectl_token_test.go
+++ b/cmd/kubectl_token_test.go
@@ -165,5 +165,5 @@ func TestCacheCredential(t *testing.T) {
 
 	expirationTimestamp := cfg.Servers["rancher.example.com"].KubeCredentials["dev-server"].Status.ExpirationTimestamp
 	require.NotNil(t, expirationTimestamp)
-	assert.True(t, expirationTimestamp.Time.Equal(expires.Time))
+	assert.True(t, expirationTimestamp.Equal(expires.Time))
 }
diff --git a/cmd/login.go b/cmd/login.go
index 9c4b2077..432c764c 100644
--- a/cmd/login.go
+++ b/cmd/login.go
@@ -2,23 +2,17 @@ package cmd
 
 import (
 	"bufio"
-	"crypto/tls"
-	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
-	"net/http"
 	"net/url"
 	"os"
 	"strconv"
 	"strings"
 
-	"github.com/sirupsen/logrus"
-
-	"github.com/grantae/certinfo"
 	"github.com/rancher/cli/cliclient"
 	"github.com/rancher/cli/config"
 	managementClient "github.com/rancher/rancher/pkg/client/generated/management/v3"
+	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
 
@@ -57,10 +51,6 @@ func LoginCommand() cli.Command {
 				Name:  "name",
 				Usage: "Name of the Server",
 			},
-			cli.BoolFlag{
-				Name:  "skip-verify",
-				Usage: "Skip verification of the CACerts presented by the Server",
-			},
 		},
 	}
 }
@@ -85,7 +75,7 @@ func loginSetup(ctx *cli.Context) error {
 	// Validate the url and drop the path
 	u, err := url.ParseRequestURI(ctx.Args().First())
 	if err != nil {
-		return fmt.Errorf("Failed to parse SERVERURL (%s), make sure it is a valid HTTPS URL (e.g. https://rancher.yourdomain.com or https://1.1.1.1). Error: %s", ctx.Args().First(), err)
+		return fmt.Errorf("failed to parse SERVERURL (%s), make sure it is a valid HTTPS URL (e.g. https://rancher.yourdomain.com or https://1.1.1.1). Error: %s", ctx.Args().First(), err)
 	}
 
 	u.Path = ""
@@ -115,16 +105,7 @@ func loginSetup(ctx *cli.Context) error {
 
 	c, err := cliclient.NewManagementClient(serverConfig)
 	if err != nil {
-		if _, ok := err.(*url.Error); ok && strings.Contains(err.Error(), "certificate signed by unknown authority") {
-			// no cert was provided and it's most likely a self signed cert if
-			// we get here so grab the cacert and see if the user accepts the server
-			c, err = getCertFromServer(ctx, serverConfig)
-			if err != nil {
-				return err
-			}
-		} else {
-			return err
-		}
+		return err
 	}
 
 	proj, err := getProjectContext(ctx, c)
@@ -152,12 +133,12 @@ func getProjectContext(ctx *cli.Context, c *cliclient.MasterClient) (string, err
 		// Check if given context is in valid format
 		_, _, err := parseClusterAndProjectID(context)
 		if err != nil {
-			return "", fmt.Errorf("Unable to parse context (%s). Please provide context as local:p-xxxxx, c-xxxxx:p-xxxxx, c-xxxxx:project-xxxxx, c-m-xxxxxxxx:p-xxxxx or c-m-xxxxxxxx:project-xxxxx", context)
+			return "", fmt.Errorf("unable to parse context (%s). Please provide context as local:p-xxxxx, c-xxxxx:p-xxxxx, c-xxxxx:project-xxxxx, c-m-xxxxxxxx:p-xxxxx or c-m-xxxxxxxx:project-xxxxx", context)
 		}
 		// Check if context exists
 		_, err = Lookup(c, context, "project")
 		if err != nil {
-			return "", fmt.Errorf("Unable to find context (%s). Make sure the context exists and you have permissions to use it. Error: %s", context, err)
+			return "", fmt.Errorf("unable to find context (%s). Make sure the context exists and you have permissions to use it. Error: %s", context, err)
 		}
 		return context, nil
 	}
@@ -252,94 +233,6 @@ func getProjectContext(ctx *cli.Context, c *cliclient.MasterClient) (string, err
 	return projectCollection.Data[selection].ID, nil
 }
 
-func getCertFromServer(ctx *cli.Context, serverConfig *config.ServerConfig) (*cliclient.MasterClient, error) {
-	req, err := http.NewRequest("GET", serverConfig.URL+"/v3/settings/cacerts", nil)
-	if err != nil {
-		return nil, err
-	}
-
-	req.SetBasicAuth(serverConfig.AccessKey, serverConfig.SecretKey)
-
-	tlsConfig := &tls.Config{InsecureSkipVerify: true}
-	client, err := newHTTPClient(serverConfig, tlsConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	res, err := client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-
-	defer res.Body.Close()
-
-	content, err := io.ReadAll(res.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	var certReponse *CACertResponse
-	err = json.Unmarshal(content, &certReponse)
-	if err != nil {
-		return nil, fmt.Errorf("Unable to parse response from %s/v3/settings/cacerts\nError: %s\nResponse:\n%s", serverConfig.URL, err, content)
-	}
-
-	cert, err := verifyCert([]byte(certReponse.Value))
-	if err != nil {
-		return nil, err
-	}
-
-	// Get the server cert chain in a printable form
-	serverCerts, err := processServerChain(res)
-	if err != nil {
-		return nil, err
-	}
-
-	if !ctx.Bool("skip-verify") {
-		if ok := verifyUserAcceptsCert(serverCerts, serverConfig.URL); !ok {
-			return nil, errors.New("CACert of server was not accepted, unable to login")
-		}
-	}
-
-	serverConfig.CACerts = cert
-
-	return cliclient.NewManagementClient(serverConfig)
-}
-
-func verifyUserAcceptsCert(certs []string, url string) bool {
-	fmt.Printf("The authenticity of server '%s' can't be established.\n", url)
-	fmt.Printf("Cert chain is : %v \n", certs)
-	fmt.Print("Do you want to continue connecting (yes/no)? ")
-
-	scanner := bufio.NewScanner(os.Stdin)
-
-	for scanner.Scan() {
-		input := scanner.Text()
-		input = strings.ToLower(strings.TrimSpace(input))
-
-		if input == "yes" || input == "y" {
-			return true
-		} else if input == "no" || input == "n" {
-			return false
-		}
-		fmt.Printf("Please type 'yes' or 'no': ")
-	}
-	return false
-}
-
-func processServerChain(res *http.Response) ([]string, error) {
-	var allCerts []string
-
-	for _, cert := range res.TLS.PeerCertificates {
-		result, err := certinfo.CertificateText(cert)
-		if err != nil {
-			return allCerts, err
-		}
-		allCerts = append(allCerts, result)
-	}
-	return allCerts, nil
-}
-
 func loginContext(ctx *cli.Context) error {
 	c, err := GetClient(ctx)
 	if err != nil {
diff --git a/cmd/wait.go b/cmd/wait.go
index 86e80a17..f563c6b3 100644
--- a/cmd/wait.go
+++ b/cmd/wait.go
@@ -67,7 +67,7 @@ func wait(ctx *cli.Context) error {
 	for {
 		select {
 		case <-timeout:
-			return fmt.Errorf("Timeout reached %v:%v transitioningMessage: %v", resource.Type, resource.ID, mapResource["transitioningMessage"])
+			return fmt.Errorf("timeout reached %v:%v transitioningMessage: %v", resource.Type, resource.ID, mapResource["transitioningMessage"])
 		case <-ticker.C:
 			err = c.ByID(resource, &mapResource)
 			if err != nil {
diff --git a/cmd/writer.go b/cmd/writer.go
index 9a5dc75e..9e746231 100644
--- a/cmd/writer.go
+++ b/cmd/writer.go
@@ -93,21 +93,22 @@ func (t *TableWriter) Write(obj interface{}) {
 		return
 	}
 
-	if t.ValueFormat == "json" {
+	switch t.ValueFormat {
+	case "json":
 		content, err := json.Marshal(obj)
 		t.err = err
 		if t.err != nil {
 			return
 		}
 		_, t.err = t.Writer.Write(append(content, byte('\n')))
-	} else if t.ValueFormat == "yaml" {
+	case "yaml":
 		content, err := yaml.Marshal(obj)
 		t.err = err
 		if t.err != nil {
 			return
 		}
 		_, t.err = t.Writer.Write(append(content, byte('\n')))
-	} else {
+	default:
 		t.err = printTemplate(t.Writer, t.ValueFormat, obj)
 	}
 }
diff --git a/go.mod b/go.mod
index b80c91fd..59b651db 100644
--- a/go.mod
+++ b/go.mod
@@ -1,22 +1,21 @@
 module github.com/rancher/cli
 
-go 1.24.0
+go 1.25.0
 
-toolchain go1.25.4
+toolchain go1.25.5
 
 replace (
-	k8s.io/apiserver => k8s.io/apiserver v0.34.1
-	k8s.io/client-go => k8s.io/client-go v0.34.1
-	k8s.io/component-base => k8s.io/component-base v0.34.1
-	k8s.io/kubernetes => k8s.io/kubernetes v1.34.1
+	k8s.io/apiserver => k8s.io/apiserver v0.34.2
+	k8s.io/client-go => k8s.io/client-go v0.34.2
+	k8s.io/component-base => k8s.io/component-base v0.34.2
+	k8s.io/kubernetes => k8s.io/kubernetes v1.34.2
 )
 
 require (
 	github.com/ghodss/yaml v1.0.0
-	github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b
-	github.com/rancher/norman v0.7.1
-	github.com/rancher/rancher/pkg/apis v0.0.0-20251021175546-d963555ab77f
-	github.com/rancher/rancher/pkg/client v0.0.0-20251021175546-d963555ab77f
+	github.com/rancher/norman v0.8.1
+	github.com/rancher/rancher/pkg/apis v0.0.0-20260109182643-230c7fbdae00
+	github.com/rancher/rancher/pkg/client v0.0.0-20260109182643-230c7fbdae00
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/gjson v1.17.0
@@ -58,13 +57,13 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rancher/aks-operator v1.13.0-rc.1 // indirect
-	github.com/rancher/ali-operator v0.0.3-0.20251001142421-ca64da576db5 // indirect
-	github.com/rancher/eks-operator v1.13.0-rc.1 // indirect
-	github.com/rancher/fleet/pkg/apis v0.14.0-beta.1 // indirect
-	github.com/rancher/gke-operator v1.13.0-rc.1 // indirect
+	github.com/rancher/aks-operator v1.13.0-rc.4 // indirect
+	github.com/rancher/ali-operator v1.13.0-rc.2 // indirect
+	github.com/rancher/eks-operator v1.13.0-rc.4 // indirect
+	github.com/rancher/fleet/pkg/apis v0.15.0-alpha.4 // indirect
+	github.com/rancher/gke-operator v1.13.0-rc.3 // indirect
 	github.com/rancher/lasso v0.2.5 // indirect
-	github.com/rancher/rke v1.8.0-rc.4 // indirect
+	github.com/rancher/rke v1.8.0 // indirect
 	github.com/rancher/wrangler/v3 v3.3.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
@@ -82,13 +81,13 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.34.1 // indirect
-	k8s.io/apimachinery v0.34.1 // indirect
-	k8s.io/apiserver v0.34.1 // indirect
-	k8s.io/component-base v0.34.1 // indirect
+	k8s.io/api v0.34.3 // indirect
+	k8s.io/apimachinery v0.34.3 // indirect
+	k8s.io/apiserver v0.34.2 // indirect
+	k8s.io/component-base v0.34.2 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
-	k8s.io/kubernetes v1.34.1 // indirect
+	k8s.io/kubernetes v1.34.2 // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 62669a44..db0c253f 100644
--- a/go.sum
+++ b/go.sum
@@ -43,8 +43,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
-github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b h1:NGgE5ELokSf2tZ/bydyDUKrvd/jP8lrAoPNeBuMOTOk=
-github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b/go.mod h1:zT/uzhdQGTqlwTq7Lpbj3JoJQWfPfIJ1tE0OidAmih8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -69,8 +67,8 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.26.0 h1:1J4Wut1IlYZNEAWIV3ALrT9NfiaGW2cDCJQSFQMs/gE=
-github.com/onsi/ginkgo/v2 v2.26.0/go.mod h1:qhEywmzWTBUY88kfO0BRvX4py7scov9yR+Az2oavUzw=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
 github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -86,26 +84,26 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/rancher/aks-operator v1.13.0-rc.1 h1:Vy83SjeSm9q7kI18+nkSOR0hyeydDj398KGTo3XEuS4=
-github.com/rancher/aks-operator v1.13.0-rc.1/go.mod h1:xu0BJ01Ynzs4wLMDf2V5eaazEf1/kndX0AeqqsTFVfQ=
-github.com/rancher/ali-operator v0.0.3-0.20251001142421-ca64da576db5 h1:phyZ6BUqR/XnZNAHfSpYyGxclxu/ZTLGCc3wpcTjcmM=
-github.com/rancher/ali-operator v0.0.3-0.20251001142421-ca64da576db5/go.mod h1:aJNM8GVaKCO1jH70Ds4qH8lE5tZlzOxWFbyOFOBHu5k=
-github.com/rancher/eks-operator v1.13.0-rc.1 h1:IbimIq+TuC88RQ3KF1Ez882XFP2nDnihbeqVPXLvuLk=
-github.com/rancher/eks-operator v1.13.0-rc.1/go.mod h1:tj6ioCe9v5J1HM0ZXR3/K5InoEjOfjCvSHMuXMj2x4M=
-github.com/rancher/fleet/pkg/apis v0.14.0-beta.1 h1:UoWkP6tiVx6xbOU6lG0EQXf3caEyBAYd5c88FFBULSg=
-github.com/rancher/fleet/pkg/apis v0.14.0-beta.1/go.mod h1:oc+QHbx4P9guY34dr6UbzCOgt17Q9eSZhlyOs7xSinY=
-github.com/rancher/gke-operator v1.13.0-rc.1 h1:VViWerZyc9iMmWTxK5FapRmMnBp8cq3CgqjbM+bvyaQ=
-github.com/rancher/gke-operator v1.13.0-rc.1/go.mod h1:xW0iUqGMqUTPLzC4i+UKeydh9N9zYdM0BqC+7wiDfec=
+github.com/rancher/aks-operator v1.13.0-rc.4 h1:tc7p2gZmRg4c6VBwWTQJYwmh1hlN68kftjoBIdGCnqw=
+github.com/rancher/aks-operator v1.13.0-rc.4/go.mod h1:1ZjZB6zGHK+NGchN9KLplq+xPxRRi+q6Uzet5bjFwxo=
+github.com/rancher/ali-operator v1.13.0-rc.2 h1:a0biHGez+Np9XybJVh3yKN4RGPdaCzfM6D6cAXJac6o=
+github.com/rancher/ali-operator v1.13.0-rc.2/go.mod h1:s5HznpxsN9LsgtX6u5UoW9dZNKnDLuXcwzQRAEoDcog=
+github.com/rancher/eks-operator v1.13.0-rc.4 h1:XowN8+m3QZTIBOBLzar4frtz0xtREb9kcX6KXhF4eas=
+github.com/rancher/eks-operator v1.13.0-rc.4/go.mod h1:SbaKX2ttFWCxGOYkrKYeWH/6E4oToq2rRTcrMa2Mmdk=
+github.com/rancher/fleet/pkg/apis v0.15.0-alpha.4 h1:l6pdMToVQSuhFaNmENuY1+v+5lltwHvw92zbt7iK6sU=
+github.com/rancher/fleet/pkg/apis v0.15.0-alpha.4/go.mod h1:srlFTlA6425rCPRELTdtFcZM8wDNPaqW4O4aj6sArs4=
+github.com/rancher/gke-operator v1.13.0-rc.3 h1:a6U+7+XIbJPH2CE7/vFUx6RpThNbFl7fqIqkEBb6zmA=
+github.com/rancher/gke-operator v1.13.0-rc.3/go.mod h1:TroxpmqMh63Hf4H5bC+2GYcgOCQp9kIUDfyKdNAMo6Q=
 github.com/rancher/lasso v0.2.5 h1:K++lWDDdfeN98Ixc1kCfUq0/q6tLjoHN++Np6QntXw0=
 github.com/rancher/lasso v0.2.5/go.mod h1:71rWfv+KkdSmSxZ9Ly5QYhxAu0nEUcaq9N2ByjcHqAM=
-github.com/rancher/norman v0.7.1 h1:OfmYfN4YeJ4qosXTAbOTPgCrb5GE8W6wFWnDxWcuKCo=
-github.com/rancher/norman v0.7.1/go.mod h1:vZ5qL+eKodJ7zOMQYdl6jwMrSFrqTKpA+KYSFEKew2M=
-github.com/rancher/rancher/pkg/apis v0.0.0-20251021175546-d963555ab77f h1:qeo/eORtYuZmYq3AJP8X52pr8H4haLN3U9dvKk+U5WU=
-github.com/rancher/rancher/pkg/apis v0.0.0-20251021175546-d963555ab77f/go.mod h1:H+KsnFeYVNUyLBAl1kqyKTM8KjuV1TNWDrZ2HT9ou/4=
-github.com/rancher/rancher/pkg/client v0.0.0-20251021175546-d963555ab77f h1:ZkIH/2JbwATXMnDPgqNSteC6YBpFLX1vM+AGZeaxQc4=
-github.com/rancher/rancher/pkg/client v0.0.0-20251021175546-d963555ab77f/go.mod h1:kN5U1qD97yp9EUzm6LeoPENApyZsMzQdYES1GTJJbJw=
-github.com/rancher/rke v1.8.0-rc.4 h1:jowVyaF3LsJonC7vNsAwWf3MONHAtEFUD/j3UzNSE5U=
-github.com/rancher/rke v1.8.0-rc.4/go.mod h1:x9N1abruzDFMwTpqq2cnaDYpKCptlNoW8VraNWB6Pc4=
+github.com/rancher/norman v0.8.1 h1:114Rdt3xsWTUdqaxlIR2F6PJT0ls01vF0Rfglustgow=
+github.com/rancher/norman v0.8.1/go.mod h1:vZ5qL+eKodJ7zOMQYdl6jwMrSFrqTKpA+KYSFEKew2M=
+github.com/rancher/rancher/pkg/apis v0.0.0-20260109182643-230c7fbdae00 h1:TkmbSNk3NxCJg8WZ0zDZ6DyKeW2CBLaYKpkI93E6UXc=
+github.com/rancher/rancher/pkg/apis v0.0.0-20260109182643-230c7fbdae00/go.mod h1:NwWL+lOkxPRibQ6j+9uFSo6t1CJ18z1oY4OYJMOQ/R0=
+github.com/rancher/rancher/pkg/client v0.0.0-20260109182643-230c7fbdae00 h1:n9ZKQOGwYf3GXDzuSRs+vZRbZTbEBU61Il/qYu/6vTM=
+github.com/rancher/rancher/pkg/client v0.0.0-20260109182643-230c7fbdae00/go.mod h1:uVKBI6ZYvTksdnIc/Wf2U5FShccbNn1p8KYD31IdCBc=
+github.com/rancher/rke v1.8.0 h1:87jeoOccnnNCq27YgWgMh4o0GVrrVKbw+zfo+cHMZlo=
+github.com/rancher/rke v1.8.0/go.mod h1:x9N1abruzDFMwTpqq2cnaDYpKCptlNoW8VraNWB6Pc4=
 github.com/rancher/wrangler/v3 v3.3.1 h1:YFqRfhxjuLNudUrvWrn+64wUPZ8pnn2KWbTsha75JLg=
 github.com/rancher/wrangler/v3 v3.3.1/go.mod h1:0D4kZDaOUkP5W2Zfww/75tQwF9w7kaZgzpZG+4XQDAI=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
@@ -144,8 +142,6 @@ go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
 go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -214,22 +210,22 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
-k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
-k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
-k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
-k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
-k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
-k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
-k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
-k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
+k8s.io/api v0.34.3 h1:D12sTP257/jSH2vHV2EDYrb16bS7ULlHpdNdNhEw2S4=
+k8s.io/api v0.34.3/go.mod h1:PyVQBF886Q5RSQZOim7DybQjAbVs8g7gwJNhGtY5MBk=
+k8s.io/apimachinery v0.34.3 h1:/TB+SFEiQvN9HPldtlWOTp0hWbJ+fjU+wkxysf/aQnE=
+k8s.io/apimachinery v0.34.3/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.2 h1:2/yu8suwkmES7IzwlehAovo8dDE07cFRC7KMDb1+MAE=
+k8s.io/apiserver v0.34.2/go.mod h1:gqJQy2yDOB50R3JUReHSFr+cwJnL8G1dzTA0YLEqAPI=
+k8s.io/client-go v0.34.2 h1:Co6XiknN+uUZqiddlfAjT68184/37PS4QAzYvQvDR8M=
+k8s.io/client-go v0.34.2/go.mod h1:2VYDl1XXJsdcAxw7BenFslRQX28Dxz91U9MWKjX97fE=
+k8s.io/component-base v0.34.2 h1:HQRqK9x2sSAsd8+R4xxRirlTjowsg6fWCPwWYeSvogQ=
+k8s.io/component-base v0.34.2/go.mod h1:9xw2FHJavUHBFpiGkZoKuYZ5pdtLKe97DEByaA+hHbM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
-k8s.io/kubernetes v1.34.1 h1:F3p8dtpv+i8zQoebZeK5zBqM1g9x1aIdnA5vthvcuUk=
-k8s.io/kubernetes v1.34.1/go.mod h1:iu+FhII+Oc/1gGWLJcer6wpyih441aNFHl7Pvm8yPto=
+k8s.io/kubernetes v1.34.2 h1:WQdDvYJazkmkwSncgNwGvVtaCt4TYXIU3wSMRgvp3MI=
+k8s.io/kubernetes v1.34.2/go.mod h1:m6pZk6a179pRo2wsTiCPORJ86iOEQmfIzUvtyEF8BwA=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
diff --git a/scripts/ci b/scripts/ci
index 608fddf1..e6fae796 100755
--- a/scripts/ci
+++ b/scripts/ci
@@ -5,6 +5,5 @@ cd $(dirname $0)
 
 ./build
 ./test
-./lint
 ./validate
 ./package