diff --git a/go.mod b/go.mod
index 90512e24a..5e014f85f 100644
--- a/go.mod
+++ b/go.mod
@@ -37,7 +37,7 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2
 	github.com/prometheus/common v0.67.5
-	github.com/siderolabs/go-kmsg v0.1.5
+	github.com/siderolabs/go-kmsg v0.1.6
 	github.com/stretchr/testify v1.11.1
 	github.com/tenebris-tech/tail v1.0.5
 	github.com/testcontainers/testcontainers-go v0.42.0
diff --git a/go.sum b/go.sum
index 1ef684428..20e9dfc98 100644
--- a/go.sum
+++ b/go.sum
@@ -314,8 +314,8 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/siderolabs/gen v0.8.6 h1:pE6shuqov3L+5rEcAUJ/kY6iJofimljQw5G95P8a5c4=
 github.com/siderolabs/gen v0.8.6/go.mod h1:J9IbusbES2W6QWjtSHpDV9iPGZHc978h1+KJ4oQRspQ=
-github.com/siderolabs/go-kmsg v0.1.5 h1:bdaultamVoM6f2ZmhwFL+LAh2A1c2sdCno5cEubv3rs=
-github.com/siderolabs/go-kmsg v0.1.5/go.mod h1:fryspKc1f6nMIOK5YbUPutz2v2rdBTBeLqW/ci9BDfk=
+github.com/siderolabs/go-kmsg v0.1.6 h1:ZrJPExUnJubqiNA7T8RUi/ySvJsnIen+bdiY+pea8+A=
+github.com/siderolabs/go-kmsg v0.1.6/go.mod h1:fryspKc1f6nMIOK5YbUPutz2v2rdBTBeLqW/ci9BDfk=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
diff --git a/vendor/github.com/siderolabs/go-kmsg/.dockerignore b/vendor/github.com/siderolabs/go-kmsg/.dockerignore
index 6b367eee6..f897f26cc 100644
--- a/vendor/github.com/siderolabs/go-kmsg/.dockerignore
+++ b/vendor/github.com/siderolabs/go-kmsg/.dockerignore
@@ -1,12 +1,13 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-13T17:41:07Z by kres e68c408.
+# Generated on 2026-04-29T10:33:35Z by kres 980313d.
 
 *
 !kmsg.go
 !message.go
 !message_test.go
 !reader.go
+!reader_internal_test.go
 !reader_test.go
 !utils_bsd.go
 !utils_linux.go
@@ -18,3 +19,4 @@
 !README.md
 !.markdownlint.json
 !hack/govulncheck.sh
+!.disvulncheck.yaml
diff --git a/vendor/github.com/siderolabs/go-kmsg/Dockerfile b/vendor/github.com/siderolabs/go-kmsg/Dockerfile
index 3b055abc5..b7c2db1d7 100644
--- a/vendor/github.com/siderolabs/go-kmsg/Dockerfile
+++ b/vendor/github.com/siderolabs/go-kmsg/Dockerfile
@@ -1,8 +1,8 @@
-# syntax = docker/dockerfile-upstream:1.22.0-labs
+# syntax = docker/dockerfile-upstream:1.23.0-labs
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-13T17:41:07Z by kres e68c408.
+# Generated on 2026-04-29T10:33:35Z by kres 980313d.
 
 ARG TOOLCHAIN=scratch
 
@@ -10,7 +10,7 @@ ARG TOOLCHAIN=scratch
 FROM scratch AS generate
 
 # runs markdownlint
-FROM docker.io/oven/bun:1.3.10-alpine AS lint-markdown
+FROM docker.io/oven/bun:1.3.13-alpine AS lint-markdown
 WORKDIR /src
 RUN bun i markdownlint-cli@0.48.0 sentences-per-line@0.5.2
 COPY .markdownlint.json .
@@ -39,6 +39,9 @@ RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-bu
 	&& mv /go/bin/golangci-lint /bin/golangci-lint
 RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=go-kmsg/go/pkg go install golang.org/x/vuln/cmd/govulncheck@latest \
 	&& mv /go/bin/govulncheck /bin/govulncheck
+ARG DIS_VULNCHECK_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=go-kmsg/go/pkg go install github.com/shanduur/dis-vulncheck@${DIS_VULNCHECK_VERSION} \
+	&& mv /go/bin/dis-vulncheck /bin/dis-vulncheck
 ARG GOFUMPT_VERSION
 RUN go install mvdan.cc/gofumpt@${GOFUMPT_VERSION} \
 	&& mv /go/bin/gofumpt /bin/gofumpt
@@ -55,6 +58,7 @@ COPY ./kmsg.go ./kmsg.go
 COPY ./message.go ./message.go
 COPY ./message_test.go ./message_test.go
 COPY ./reader.go ./reader.go
+COPY ./reader_internal_test.go ./reader_internal_test.go
 COPY ./reader_test.go ./reader_test.go
 COPY ./utils_bsd.go ./utils_bsd.go
 COPY ./utils_linux.go ./utils_linux.go
@@ -84,8 +88,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-bu
 # runs govulncheck
 FROM base AS lint-govulncheck
 WORKDIR /src
-COPY --chmod=0755 hack/govulncheck.sh ./hack/govulncheck.sh
-RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=go-kmsg/go/pkg ./hack/govulncheck.sh ./...
+RUN --mount=type=cache,target=/root/.cache/go-build,id=go-kmsg/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=go-kmsg/go/pkg dis-vulncheck -tool=false ./...
 
 # runs unit-tests with race detector
 FROM base AS unit-tests-race
diff --git a/vendor/github.com/siderolabs/go-kmsg/Makefile b/vendor/github.com/siderolabs/go-kmsg/Makefile
index 53bf810ec..b6bcce34b 100644
--- a/vendor/github.com/siderolabs/go-kmsg/Makefile
+++ b/vendor/github.com/siderolabs/go-kmsg/Makefile
@@ -1,18 +1,19 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-13T17:41:07Z by kres e68c408.
+# Generated on 2026-04-29T10:33:35Z by kres 980313d.
 
 # common variables
 
 SHA := $(shell git describe --match=none --always --abbrev=8 --dirty)
-TAG := $(shell git describe --tag --always --dirty --match v[0-9]\*)
+TAG ?= $(shell git describe --tag --always --dirty --match v[0-9]\*)
 TAG_SUFFIX ?=
-ABBREV_TAG := $(shell git describe --tags >/dev/null 2>/dev/null && git describe --tag --always --match v[0-9]\* --abbrev=0 || echo 'undefined')
+ABBREV_TAG ?= $(shell git describe --tags >/dev/null 2>/dev/null && git describe --tag --always --match v[0-9]\* --abbrev=0 || echo 'undefined')
 BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
 ARTIFACTS := _out
 IMAGE_TAG ?= $(TAG)$(TAG_SUFFIX)
 OPERATING_SYSTEM := $(shell uname -s | tr '[:upper:]' '[:lower:]')
 GOARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+CI_RELEASE_TAG := $(shell git log --oneline --format=%B -n 1 HEAD^2 -- 2>/dev/null | head -n 1 | sed -r "/^release\(.*\)/ s/^release\((.*)\):.*$$/\\1/; t; Q")
 WITH_DEBUG ?= false
 WITH_RACE ?= false
 REGISTRY ?= ghcr.io
@@ -20,14 +21,15 @@ USERNAME ?= siderolabs
 REGISTRY_AND_USERNAME ?= $(REGISTRY)/$(USERNAME)
 PROTOBUF_GO_VERSION ?= 1.36.11
 GRPC_GO_VERSION ?= 1.6.1
-GRPC_GATEWAY_VERSION ?= 2.28.0
+GRPC_GATEWAY_VERSION ?= 2.29.0
 VTPROTOBUF_VERSION ?= 0.6.0
-GOIMPORTS_VERSION ?= 0.42.0
+GOIMPORTS_VERSION ?= 0.44.0
 GOMOCK_VERSION ?= 0.6.0
 DEEPCOPY_VERSION ?= v0.5.8
-GOLANGCILINT_VERSION ?= v2.11.3
+GOLANGCILINT_VERSION ?= v2.11.4
 GOFUMPT_VERSION ?= v0.9.2
-GO_VERSION ?= 1.26.1
+GO_VERSION ?= 1.26.2
+DIS_VULNCHECK_VERSION ?= v0.0.0-20260409114749-05440f84fe69
 GO_BUILDFLAGS ?=
 GO_BUILDTAGS ?= ,
 GO_LDFLAGS ?=
@@ -75,6 +77,7 @@ COMMON_ARGS += --build-arg=GOMOCK_VERSION="$(GOMOCK_VERSION)"
 COMMON_ARGS += --build-arg=DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
 COMMON_ARGS += --build-arg=GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
 COMMON_ARGS += --build-arg=GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
+COMMON_ARGS += --build-arg=DIS_VULNCHECK_VERSION="$(DIS_VULNCHECK_VERSION)"
 COMMON_ARGS += --build-arg=TESTPKGS="$(TESTPKGS)"
 TOOLCHAIN ?= docker.io/golang:1.26-alpine
 
@@ -153,6 +156,14 @@ $(ARTIFACTS):  ## Creates artifacts directory.
 clean:  ## Cleans up all artifacts.
 	@rm -rf $(ARTIFACTS)
 
+.PHONY: ci-temp-release-tag
+ci-temp-release-tag:  ## Generates a temporary release tag for CI run.
+	@if [ -n "$(CI_RELEASE_TAG)" -a -n "$${GITHUB_ENV}" ]; then \
+		echo Setting temporary release tag "$(CI_RELEASE_TAG)"; \
+		echo "TAG=$(CI_RELEASE_TAG)" >> "$${GITHUB_ENV}"; \
+		echo "ABBREV_TAG=$(CI_RELEASE_TAG)" >> "$${GITHUB_ENV}"; \
+	fi
+
 target-%:  ## Builds the specified target defined in the Dockerfile. The build result will only remain in the build cache.
 	@$(BUILD) --target=$* $(COMMON_ARGS) $(TARGET_ARGS) $(CI_ARGS) .
 
@@ -236,3 +247,15 @@ conformance:
 	@docker pull $(CONFORMANCE_IMAGE)
 	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
 
+.PHONY: renovate-local
+renovate-local:  ## runs renovate locally to check syntax and test configuration
+	@docker run --rm \
+		--user $(shell id -u):$(shell id -g) \
+		-v $(PWD):/src \
+		-w /src \
+		-e GITHUB_TOKEN \
+		-e LOG_LEVEL=debug \
+		-e RENOVATE_PLATFORM=local \
+		-e RENOVATE_DRY_RUN=full \
+	renovate/renovate
+
diff --git a/vendor/github.com/siderolabs/go-kmsg/reader.go b/vendor/github.com/siderolabs/go-kmsg/reader.go
index f58ace0ac..e2ae54bd2 100644
--- a/vendor/github.com/siderolabs/go-kmsg/reader.go
+++ b/vendor/github.com/siderolabs/go-kmsg/reader.go
@@ -60,19 +60,20 @@ func FromTail() Option {
 
 // NewReader initializes new /dev/kmsg reader.
 func NewReader(options ...Option) (Reader, error) {
-	r := &reader{}
+	r := &reader{
+		bootTime: bootTimeNow,
+	}
 
 	for _, o := range options {
 		o(&r.options)
 	}
 
-	var err error
-
-	r.bootOffset, err = getBootTimeOffset()
-	if err != nil {
+	if _, err := getBootTimeOffset(); err != nil {
 		return nil, err
 	}
 
+	var err error
+
 	r.f, err = os.OpenFile("/dev/kmsg", os.O_RDONLY, 0)
 	if err != nil {
 		return nil, err
@@ -91,9 +92,28 @@ func NewReader(options ...Option) (Reader, error) {
 }
 
 type reader struct {
-	f          *os.File
-	bootOffset time.Duration
-	options    options
+	f *os.File
+
+	// bootTime returns the wall-clock time at which the system booted.
+	//
+	// It is invoked freshly for every kmsg message: a fixed offset captured
+	// at NewReader, added to time.Now() per message, drifts forward by the
+	// elapsed wall time over long-running streams. Re-evaluating per message
+	// also lets timestamps recover when the wall clock jumps (e.g. NTP
+	// catches up after boot on a system without an RTC).
+	bootTime func() time.Time
+
+	options options
+}
+
+// bootTimeNow returns the current best-estimate wall-clock time of system boot.
+func bootTimeNow() time.Time {
+	offset, err := getBootTimeOffset()
+	if err != nil {
+		return time.Now()
+	}
+
+	return time.Now().Add(offset)
 }
 
 func (r *reader) Close() error {
@@ -149,7 +169,7 @@ func (r *reader) scanNoFollow(ctx context.Context, ch chan<- Packet) {
 
 		var packet Packet
 
-		packet.Message, packet.Err = ParseMessage(buf[:n], time.Now().Add(r.bootOffset))
+		packet.Message, packet.Err = ParseMessage(buf[:n], r.bootTime())
 
 		if !channel.SendWithContext(ctx, ch, packet) {
 			return
@@ -184,7 +204,7 @@ func (r *reader) scanFollow(ctx context.Context, ch chan<- Packet) {
 
 		var packet Packet
 
-		packet.Message, packet.Err = ParseMessage(buf[:n], time.Now().Add(r.bootOffset))
+		packet.Message, packet.Err = ParseMessage(buf[:n], r.bootTime())
 
 		if !channel.SendWithContext(ctx, ch, packet) {
 			return
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ac3f119f2..e1fa4f469 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -601,7 +601,7 @@ github.com/shopspring/decimal
 # github.com/siderolabs/gen v0.8.6
 ## explicit; go 1.24.0
 github.com/siderolabs/gen/channel
-# github.com/siderolabs/go-kmsg v0.1.5
+# github.com/siderolabs/go-kmsg v0.1.6
 ## explicit; go 1.25.0
 github.com/siderolabs/go-kmsg
 # github.com/sirupsen/logrus v1.9.4