diff --git a/.gitignore b/.gitignore
index a46cc75..91527a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,8 @@
 
 # Local planning notes
 .plans/
+
+# Running the gate scripts under scripts/ leaves this behind. An untracked
+# directory is not harmless here: several checks in this org read
+# `git status --porcelain` to decide whether a tree is clean before acting.
+__pycache__/
diff --git a/stack/core/reloader/install.sh b/stack/core/reloader/install.sh
index 6d71132..d3cae73 100755
--- a/stack/core/reloader/install.sh
+++ b/stack/core/reloader/install.sh
@@ -8,6 +8,6 @@ helm repo update stakater >/dev/null
 
 helm upgrade --install reloader stakater/reloader \
   --namespace kube-system \
-  --version 2.2.14 \
+  --version 2.2.15 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/observability/opencost/install.sh b/stack/observability/opencost/install.sh
index 59d04a6..b77c277 100755
--- a/stack/observability/opencost/install.sh
+++ b/stack/observability/opencost/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f
 
 helm upgrade --install opencost opencost/opencost \
   --namespace monitoring \
-  --version 2.5.28 \
+  --version 2.5.29 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/security/trivy-operator/install.sh b/stack/security/trivy-operator/install.sh
index 1ca4731..7857479 100755
--- a/stack/security/trivy-operator/install.sh
+++ b/stack/security/trivy-operator/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace trivy-system --dry-run=client -o yaml | kubectl apply -
 
 helm upgrade --install trivy-operator aqua/trivy-operator \
   --namespace trivy-system \
-  --version 0.34.0 \
+  --version 0.35.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/upstream.json b/stack/upstream.json
index 0a9c151..e915465 100644
--- a/stack/upstream.json
+++ b/stack/upstream.json
@@ -3,7 +3,7 @@
   "upstream": {
     "repository": "nanohype/eks-gitops",
     "path": "applicationsets",
-    "ref": "614560ad84ad0461506c4574f50f7e449a7b3c55"
+    "ref": "46f9f8e94d7d63a7092007f22dcf77a7de6fd9e5"
   },
   "divergences": [
     {