diff --git a/ci/resources/stemcell-version-bump/go.mod b/ci/resources/stemcell-version-bump/go.mod
index 884fe9b06..096a5a1fe 100644
--- a/ci/resources/stemcell-version-bump/go.mod
+++ b/ci/resources/stemcell-version-bump/go.mod
@@ -44,17 +44,17 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea // indirect
-	google.golang.org/grpc v1.83.0 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/ci/resources/stemcell-version-bump/go.sum b/ci/resources/stemcell-version-bump/go.sum
index cbf5e35a7..00c7a90ec 100644
--- a/ci/resources/stemcell-version-bump/go.sum
+++ b/ci/resources/stemcell-version-bump/go.sum
@@ -101,18 +101,18 @@ go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRk
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
 go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
 go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
@@ -125,8 +125,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea h1:kVhQEPTpKQahD5+JSBTfBB19wcgQTTjAIn45MBqnyHk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
index 8d99551fe..b1da45687 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!amd64 && !loong64 && !ppc64le && !ppc64 && !s390x) || !gc || purego
+//go:build (!amd64 && !loong64 && !ppc64le && !ppc64 && !riscv64 && !s390x) || !gc || purego
 
 package poly1305
 
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go
index 315b84ac3..55041bf51 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build gc && !purego && (amd64 || loong64 || ppc64 || ppc64le)
+//go:build gc && !purego && (amd64 || loong64 || ppc64 || ppc64le || riscv64)
 
 package poly1305
 
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s
new file mode 100644
index 000000000..ce5eb3d43
--- /dev/null
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s
@@ -0,0 +1,158 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+
+#define LOAD64U(base, offset, t0, t1, t2, t3, dst) \
+	MOVBU	(offset+0*1)(base), t0; \
+	MOVBU	(offset+1*1)(base), t1; \
+	MOVBU	(offset+2*1)(base), t2; \
+	MOVBU	(offset+3*1)(base), t3; \
+	SLL	$8, t1; \
+	SLL	$16, t2; \
+	SLL	$24, t3; \
+	OR	t1, t0; \
+	OR	t3, t2; \
+	OR	t2, t0, dst; \
+	MOVBU	(offset+4*1)(base), t0; \
+	MOVBU	(offset+5*1)(base), t1; \
+	MOVBU	(offset+6*1)(base), t2; \
+	MOVBU	(offset+7*1)(base), t3; \
+	SLL	$32, t0; \
+	SLL	$40, t1; \
+	SLL	$48, t2; \
+	SLL	$56, t3; \
+	OR	t1, t0; \
+	OR	t3, t2; \
+	OR	t2, t0; \
+	OR	t0, dst
+
+// func update(state *macState, msg []byte)
+TEXT ·update(SB), $0-32
+	MOV	state+0(FP), X5
+	MOV	msg_base+8(FP), X6
+	MOV	msg_len+16(FP), X7
+
+	MOV	$16, X8
+
+	AND	$7, X6, X28
+
+	MOV	(0*8)(X5), X9		// h0
+	MOV	(1*8)(X5), X10		// h1
+	MOV	(2*8)(X5), X11		// h2
+	MOV	(3*8)(X5), X12		// r0
+	MOV	(4*8)(X5), X13		// r1
+
+	BLT	X7, X8, tail
+
+loop:
+	BEQZ	X28, aligned_load
+
+	LOAD64U(X6, 0*8, X16, X18, X19, X20, X15)	// msg[0:8]
+	LOAD64U(X6, 1*8, X16, X18, X19, X20, X17)	// msg[8:16]
+	JMP	block
+
+aligned_load:
+	MOV	(0*8)(X6), X15		// msg[0:8]
+	MOV	(1*8)(X6), X17		// msg[8:16]
+
+block:
+	ADD	X15, X9		// h0 (x1 + y1 = z1', if z1' < x1 then z1' overflow)
+	SLTU	X15, X9, X19	// h0.carry
+	ADD	X17, X10, X22
+	SLTU	X17, X22, X23
+	ADD	X22, X19, X10	// h1
+	SLTU	X22, X10, X19
+	OR	X23, X19	// h1.carry
+	ADD	$1, X19
+	ADD	X19, X11	// h2
+
+	ADD	$16, X6		// msg = msg[16:]
+
+multiply:
+	MULHU	X9, X12, X16	// h0r0.hi
+	MUL	X9, X12, X15	// h0r0.lo
+	MULHU	X10, X12, X17	// h1r0.hi
+	MUL	X10, X12, X14	// h1r0.lo
+	ADD	X14, X16
+	SLTU	X14, X16, X19
+	ADD	X19, X17
+	MUL	X11, X12, X20
+	ADD	X17, X20
+	MULHU	X9, X13, X17	// h0r1.hi
+	MUL	X9, X13, X14	// h0r1.lo
+	ADD	X14, X16
+	SLTU	X14, X16, X19
+	ADD	X19, X17
+	MOV	X17, X9
+	MUL	X11, X13, X21	// h2r1
+	MULHU	X10, X13, X17	// h1r1.hi
+	MUL	X10, X13, X14	// h1r1.lo
+	ADD	X14, X20
+	ADD	X17, X21, X22
+	SLTU	X14, X20, X19
+	ADD	X22, X19, X21
+	ADD	X9, X20
+	SLTU	X9, X20, X19
+	ADD	X19, X21
+	AND	$3, X20, X11
+	AND	$-4, X20, X18
+	ADD	X18, X15, X9
+	ADD	X21, X16, X22
+	SLTU	X18, X9, X19
+	SLTU	X21, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X19, X23, X19
+	ADD	X19, X11
+	SLL	$62, X21, X22
+	SRL	$2, X20, X23
+	SRL	$2, X21, X21
+	OR	X22, X23, X20
+	ADD	X20, X9, X9
+	ADD	X21, X10, X22
+	SLTU	X20, X9, X19
+	SLTU	X21, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X19, X23, X19
+	ADD	X19, X11, X11
+
+	SUB	$16, X7, X7
+	BGE	X7, X8, loop
+
+tail:
+	BEQ	X7, X0, done
+	MOV	$1, X15
+	MOV $0, X16
+	ADD	X7, X6, X6
+
+flush_buffer:
+	MOVBU	-1(X6), X20
+	SRL	$56, X15, X19
+	SLL	$8, X16, X23
+	SLL	$8, X15, X15
+	OR	X19, X23, X16
+	XOR	X20, X15
+	SUB	$1, X7, X7
+	SUB	$1, X6, X6
+	BNE	X7, X0, flush_buffer
+
+	ADD	X15, X9
+	SLTU	X15, X9, X19
+	ADD	X16, X10, X22
+	SLTU	X16, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X23, X19
+	ADD	X19, X11
+
+	MOV	$16, X7
+	JMP	multiply
+
+done:
+	MOV	X9, (0*8)(X5)	// h0
+	MOV	X10, (1*8)(X5)
+	MOV	X11, (2*8)(X5)
+	RET
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/encode.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/encode.go
index 46219da2b..e6d0c265a 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/encode.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/encode.go
@@ -39,7 +39,6 @@ func NewEncoder(w io.Writer) *Encoder {
 		tableSizeUpdate: false,
 		w:               w,
 	}
-	e.dynTab.table.init()
 	e.dynTab.setMaxSize(initialHeaderTableSize)
 	return e
 }
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/hpack.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/hpack.go
index 7a1d97669..ecd3eeca9 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/hpack.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/hpack.go
@@ -105,7 +105,6 @@ func NewDecoder(maxDynamicTableSize uint32, emitFunc func(f HeaderField)) *Decod
 		emitEnabled: true,
 		firstField:  true,
 	}
-	d.dynTab.table.init()
 	d.dynTab.allowedMaxSize = maxDynamicTableSize
 	d.dynTab.setMaxSize(maxDynamicTableSize)
 	return d
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/tables.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/tables.go
index 8cbdf3f01..3bd7eb753 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/tables.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/hpack/tables.go
@@ -31,10 +31,18 @@ type headerFieldTable struct {
 
 	// byName maps a HeaderField name to the unique id of the newest entry with
 	// the same name. See above for a definition of "unique id".
+	//
+	// byName and byNameValue are used only by search, which is only called
+	// for tables used by encoders. For tables used only by decoders, the
+	// maps are never built, as a memory optimization for servers with many
+	// mostly-idle connections, each pinning a dynamic table. The maps are
+	// built lazily by the first search call and are nil until then. The two
+	// maps are always both nil or both non-nil.
 	byName map[string]uint64
 
 	// byNameValue maps a HeaderField name/value pair to the unique id of the newest
 	// entry with the same name and value. See above for a definition of "unique id".
+	// See byName for when this map is non-nil.
 	byNameValue map[pairNameValue]uint64
 }
 
@@ -42,9 +50,17 @@ type pairNameValue struct {
 	name, value string
 }
 
-func (t *headerFieldTable) init() {
-	t.byName = make(map[string]uint64)
-	t.byNameValue = make(map[pairNameValue]uint64)
+// buildMaps initializes byName and byNameValue from ents.
+func (t *headerFieldTable) buildMaps() {
+	t.byName = make(map[string]uint64, len(t.ents))
+	t.byNameValue = make(map[pairNameValue]uint64, len(t.ents))
+	for k, f := range t.ents {
+		// Map to the newest matching entry: later (newer) entries
+		// overwrite earlier ones, matching addEntry's behavior.
+		id := t.evictCount + uint64(k) + 1
+		t.byName[f.Name] = id
+		t.byNameValue[pairNameValue{f.Name, f.Value}] = id
+	}
 }
 
 // len reports the number of entries in the table.
@@ -54,9 +70,11 @@ func (t *headerFieldTable) len() int {
 
 // addEntry adds a new entry.
 func (t *headerFieldTable) addEntry(f HeaderField) {
-	id := uint64(t.len()) + t.evictCount + 1
-	t.byName[f.Name] = id
-	t.byNameValue[pairNameValue{f.Name, f.Value}] = id
+	if t.byName != nil {
+		id := uint64(t.len()) + t.evictCount + 1
+		t.byName[f.Name] = id
+		t.byNameValue[pairNameValue{f.Name, f.Value}] = id
+	}
 	t.ents = append(t.ents, f)
 }
 
@@ -65,14 +83,16 @@ func (t *headerFieldTable) evictOldest(n int) {
 	if n > t.len() {
 		panic(fmt.Sprintf("evictOldest(%v) on table with %v entries", n, t.len()))
 	}
-	for k := 0; k < n; k++ {
-		f := t.ents[k]
-		id := t.evictCount + uint64(k) + 1
-		if t.byName[f.Name] == id {
-			delete(t.byName, f.Name)
-		}
-		if p := (pairNameValue{f.Name, f.Value}); t.byNameValue[p] == id {
-			delete(t.byNameValue, p)
+	if t.byName != nil {
+		for k := 0; k < n; k++ {
+			f := t.ents[k]
+			id := t.evictCount + uint64(k) + 1
+			if t.byName[f.Name] == id {
+				delete(t.byName, f.Name)
+			}
+			if p := (pairNameValue{f.Name, f.Value}); t.byNameValue[p] == id {
+				delete(t.byNameValue, p)
+			}
 		}
 	}
 	copy(t.ents, t.ents[n:])
@@ -100,6 +120,9 @@ func (t *headerFieldTable) evictOldest(n int) {
 //
 // See Section 2.3.3.
 func (t *headerFieldTable) search(f HeaderField) (i uint64, nameValueMatch bool) {
+	if t.byName == nil {
+		t.buildMaps()
+	}
 	if !f.Sensitive {
 		if id := t.byNameValue[pairNameValue{f.Name, f.Value}]; id != 0 {
 			return t.idToIndex(id), true
diff --git a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/transport_wrap.go b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/transport_wrap.go
index 534e77ab9..741fb9706 100644
--- a/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/transport_wrap.go
+++ b/ci/resources/stemcell-version-bump/vendor/golang.org/x/net/http2/transport_wrap.go
@@ -237,32 +237,40 @@ type ClientConn struct {
 }
 
 func (cc *ClientConn) roundTrip(req *http.Request) (*http.Response, error) {
-	err := func() error {
+	haveReservation, err := func() (bool, error) {
 		cc.mu.Lock()
 		defer cc.mu.Unlock()
 		if cc.doNotReuse {
-			return errClientConnUnusable
-		}
-		cc.roundTrips++
-		if cc.reserved > 0 {
-			// We've already reserved a concurrency slot for this request.
-			cc.reserved--
-		} else if cc.cc.Reserve() != nil {
-			// We don't seem to have an available concurrency slot,
-			// so bump the pending count (requests waiting for a slot).
-			cc.pending++
+			return false, errClientConnUnusable
 		}
+
 		// ClientConn.Shutdown will not shut down the conn while
 		// cc.starting > 0 or cc.cc.InFlight() > 0.
 		//
 		// The starting state covers the gap between us deciding to
 		// start sending the request, and actually sending it.
 		cc.starting++
-		return nil
+
+		cc.roundTrips++
+		if cc.reserved == 0 {
+			// We do not have a concurrency slot reserved for this request.
+			return false, nil
+		}
+		cc.reserved--
+		return true, nil
 	}()
 	if err != nil {
 		return nil, err
 	}
+	// If we have no reservation, try to acquire one.
+	// (This must be done without cc.mu held, since Reserve may call back to the state hook.)
+	if !haveReservation && cc.cc.Reserve() != nil {
+		// We could not acquire a concurrency slot, so bump the pending count
+		// (requests waiting for a slot).
+		cc.mu.Lock()
+		cc.pending++
+		cc.mu.Unlock()
+	}
 	resp, err := cc.cc.RoundTrip(req)
 	cc.mu.Lock()
 	cc.starting--
@@ -293,16 +301,21 @@ func (cc *ClientConn) ping(ctx context.Context) error {
 }
 
 func (cc *ClientConn) reserveNewRequest() bool {
+	if err := cc.cc.Reserve(); err != nil {
+		return false
+	}
+	reserved := true
 	cc.mu.Lock()
-	defer cc.mu.Unlock()
 	if cc.doNotReuse {
-		return false
+		reserved = false
+	} else {
+		cc.reserved++
 	}
-	if err := cc.cc.Reserve(); err != nil {
-		return false
+	cc.mu.Unlock()
+	if !reserved {
+		cc.cc.Release()
 	}
-	cc.reserved++
-	return true
+	return reserved
 }
 
 func (cc *ClientConn) setDoNotReuse() {
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
index 29d332e7b..333448127 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
@@ -150,8 +150,18 @@ var (
 	// throttling limit if unforeseen issues arise, and it will be removed in a
 	// future release.
 	//
-	// TODO: Remove this env var once v1.83.0 is release.
+	// TODO: Remove this env var once v1.83.0 is released.
 	ControlBufferThrottleLimit = uint64FromEnv("GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT", 100, 1, 10000)
+
+	// EnableReceiveBufferCompaction enables the compaction of data buffers
+	// to reduce the number of buffers in the receive buffer.
+	//
+	// This environment variable serves as an escape hatch to disable the
+	// feature if unforeseen issues arise, and it will be removed in a future
+	// release.
+	//
+	// TODO: Remove this env var once v1.85.0 is released.
+	EnableReceiveBufferCompaction = boolFromEnv("GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION", true)
 )
 
 func boolFromEnv(envVar string, def bool) bool {
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go
index 2d83b2ece..00aeca419 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go
@@ -26,12 +26,26 @@ import (
 	"slices"
 	"sort"
 	"sync"
+
+	"google.golang.org/grpc/internal"
 )
 
 const (
 	goPageSize = 4 * 1024 // 4KiB. N.B. this must be a power of 2.
 )
 
+var (
+	// BufferPoolingThreshold is the minimum size of a buffer that can be pooled.
+	// This is used to determine whether to pool buffers or allocate them directly.
+	BufferPoolingThreshold = 1 << 10
+)
+
+func init() {
+	internal.SetBufferPoolingThresholdForTesting = func(threshold int) {
+		BufferPoolingThreshold = threshold
+	}
+}
+
 var uintSize = bits.UintSize // use a variable for mocking during tests.
 
 // bufferPool is a copy of the public bufferPool interface used to avoid
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/handler_server.go
index a8356c9ad..9cd8d28d3 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/handler_server.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/handler_server.go
@@ -424,7 +424,7 @@ func (ht *serverHandlerTransport) HandleStreams(ctx context.Context, startStream
 		st:               ht,
 		headerWireLength: 0, // won't have access to header wire length until golang/go#18997.
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(ht.bufferPool)
 	s.readRequester = s
 	s.trReader = transportReader{
 		reader:        recvBufferReader{ctx: s.ctx, ctxDone: s.ctx.Done(), recv: &s.buf},
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_client.go
index c19b45080..10d197741 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_client.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -500,7 +500,7 @@ func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr, handler s
 		headerChan:   make(chan struct{}),
 		statsHandler: handler,
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(t.bufferPool)
 	s.Stream.wq.init(defaultWriteQuota, s.done)
 	s.readRequester = s
 	// The client side stream context should have exactly the same life cycle with the user provided context.
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_server.go
index be8ae9f9c..82e13e64a 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_server.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -407,7 +407,7 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade
 		st:               t,
 		headerWireLength: int(frame.Header().Length),
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(t.bufferPool)
 	var (
 		// if false, content-type was missing or invalid
 		isGRPC      = false
@@ -522,6 +522,12 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade
 		delete(mdata, "host")
 	}
 
+	// If :authority is still missing, i.e. no host or :authority header is
+	// present, reject the request as invalid.
+	if len(mdata[":authority"]) == 0 {
+		t.writeEarlyAbort(streamID, s.contentSubtype, status.New(codes.Internal, "no host or :authority header present"), http.StatusBadRequest, !frame.StreamEnded())
+		return nil
+	}
 	if frame.StreamEnded() {
 		// s is just created by the caller. No lock needed.
 		s.state = streamReadDone
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/transport.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/transport.go
index d2e49538f..5fc901e5c 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/transport.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -30,11 +30,14 @@ import (
 	"sync"
 	"sync/atomic"
 	"time"
+	"unsafe"
 
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/envconfig"
+	imem "google.golang.org/grpc/internal/mem"
 	"google.golang.org/grpc/internal/transport/internal"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/mem"
@@ -45,7 +48,30 @@ import (
 	"google.golang.org/grpc/tap"
 )
 
-const logLevel = 2
+const (
+	logLevel = 2
+	// recvMsgSize estimates the memory overhead of a recvMsg in the backlog.
+	// It accounts for the recvMsg struct itself and the slice header of the
+	// underlying buffer's data.
+	recvMsgSize = int(unsafe.Sizeof(recvMsg{}) + unsafe.Sizeof([]byte{}))
+
+	// utilizationFactor controls when we consider memory utilization acceptable.
+	// When backlogHeapSize / payloadSize <= utilizationFactor (meaning at least
+	// 50% of the heap memory is actual payload data), compaction is skipped.
+	utilizationFactor = 2
+)
+
+var (
+	// compactionThreshold is approx 57KB (on 64-bit systems). It allows
+	// accumulating up to 1024 1-byte payloads before triggering compaction.
+	//
+	// Because individual payloads <= 1024 bytes are allocated on the heap
+	// outside mem.BufferPool, waiting for at least 1024 bytes to accumulate
+	// ensures that compaction coalesces those small heap allocations into a
+	// single large buffer from mem.BufferPool, enabling buffer reuse while
+	// avoiding frequent copying for small bursts of frames.
+	compactionThreshold = imem.BufferPoolingThreshold * (recvMsgSize + 1)
+)
 
 func init() {
 	internal.TimeNowFunc = func() int64 { return time.Now().UnixNano() }
@@ -71,23 +97,31 @@ type recvBuffer struct {
 	c       chan recvMsg
 	mu      sync.Mutex
 	backlog []recvMsg
-	err     error
+	// uncompactedSuffixLen tracks the number of consecutive data messages at
+	// the tail of backlog that have not been compacted.
+	uncompactedSuffixLen int
+	// uncompactedBytes tracks the total payload bytes across the trailing
+	// uncompactedSuffixLen messages.
+	uncompactedBytes int
+	err              error
+	bufPool          mem.BufferPool
 }
 
 // init allows a recvBuffer to be initialized in-place, which is useful
 // for resetting a buffer or for avoiding a heap allocation when the buffer
 // is embedded in another struct.
-func (b *recvBuffer) init() {
+func (b *recvBuffer) init(pool mem.BufferPool) {
 	b.c = make(chan recvMsg, 1)
+	b.bufPool = pool
 }
 
 func (b *recvBuffer) put(r recvMsg) {
 	b.mu.Lock()
+	defer b.mu.Unlock()
 	if b.err != nil {
 		// drop the buffer on the floor. Since b.err is not nil, any subsequent reads
 		// will always return an error, making this buffer inaccessible.
 		r.buffer.Free()
-		b.mu.Unlock()
 		// An error had occurred earlier, don't accept more
 		// data or errors.
 		return
@@ -96,13 +130,70 @@ func (b *recvBuffer) put(r recvMsg) {
 	if len(b.backlog) == 0 {
 		select {
 		case b.c <- r:
-			b.mu.Unlock()
 			return
 		default:
 		}
 	}
 	b.backlog = append(b.backlog, r)
-	b.mu.Unlock()
+	b.compactBacklogLocked(r)
+}
+
+func (b *recvBuffer) compactBacklogLocked(r recvMsg) {
+	if !envconfig.EnableReceiveBufferCompaction {
+		return
+	}
+	if r.buffer == nil {
+		b.uncompactedBytes = 0
+		b.uncompactedSuffixLen = 0
+		return
+	}
+
+	b.uncompactedSuffixLen++
+	b.uncompactedBytes += r.buffer.Len()
+	backlogHeapSize := b.uncompactedSuffixLen*recvMsgSize + b.uncompactedBytes
+
+	// If the memory overhead is less than 50% of the heap usage (e.g., because
+	// a large DATA frame arrived), the average message size in the suffix is
+	// large enough that memory bloat is not a concern. Reset suffix tracking.
+	if backlogHeapSize <= utilizationFactor*b.uncompactedBytes {
+		b.uncompactedBytes = 0
+		b.uncompactedSuffixLen = 0
+		return
+	}
+	// Avoid compacting too frequently for short bursts of small frames.
+	// Wait until we have accumulated at least ~1024 small messages (~57 KB).
+	if backlogHeapSize <= compactionThreshold {
+		// Still can accumulate more payloads.
+		return
+	}
+
+	// Since the memory utilization is less than 50%, the average payload size
+	// of each recvMsg must be less than recvMsgSize (approx 56 bytes).
+	// In the worst case for bytes copied (where the average payload is just
+	// below recvMsgSize), compaction will occur once every:
+	//   compactionThreshold / (recvMsgSize + avg_payload) = ~520 messages,
+	// copying ~29KB of data.
+
+	start := 0
+	newBuf := b.bufPool.Get(b.uncompactedBytes)
+	startIdx := len(b.backlog) - b.uncompactedSuffixLen
+
+	for i := startIdx; i < len(b.backlog); i++ {
+		m := b.backlog[i]
+		b.backlog[i] = recvMsg{}
+		start += copy((*newBuf)[start:], m.buffer.ReadOnlyData())
+		m.buffer.Free()
+	}
+	b.backlog[startIdx] = recvMsg{
+		buffer: mem.NewBuffer(newBuf, b.bufPool),
+	}
+	b.backlog = b.backlog[:startIdx+1]
+	// After compaction, the suffix is replaced with a single message containing
+	// the combined payload. The new utilization is close to 1.0 (overhead of
+	// one recvMsg relative to the large compacted payload), which is well
+	// below the utilization factor of 2.
+	b.uncompactedBytes = 0
+	b.uncompactedSuffixLen = 0
 }
 
 func (b *recvBuffer) load() {
@@ -110,6 +201,13 @@ func (b *recvBuffer) load() {
 	if len(b.backlog) > 0 {
 		select {
 		case b.c <- b.backlog[0]:
+			// backlog[0] is only part of the tracked uncompacted suffix if the
+			// entire backlog currently consists of the suffix. If an earlier
+			// compaction or reset occurred, backlog[0] is already compacted.
+			if envconfig.EnableReceiveBufferCompaction && b.uncompactedSuffixLen == len(b.backlog) {
+				b.uncompactedSuffixLen--
+				b.uncompactedBytes -= b.backlog[0].buffer.Len()
+			}
 			b.backlog[0] = recvMsg{}
 			b.backlog = b.backlog[1:]
 		default:
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go
index eb42a7fb1..1af2c2065 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go
@@ -32,6 +32,7 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 
 	v3rbacpb "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3"
+	v3routepb "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	rpb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3"
 )
 
@@ -68,36 +69,25 @@ func parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) {
 		}
 
 		// "It is also a validation failure if Permission or Principal has a
-		// header matcher for a grpc- prefixed header name or :scheme." - A41
-		for _, principal := range policy.Principals {
-			name := principal.GetHeader().GetName()
-			if name == ":scheme" || strings.HasPrefix(name, "grpc-") {
-				return nil, fmt.Errorf("rbac: principal header matcher for %v is :scheme or starts with grpc", name)
+		// header matcher for a grpc- prefixed header name or :scheme." - A41.
+		//
+		// "Envoy aliases :authority and Host in its header map implementation,
+		// so they should be treated equivalent for the RBAC matchers; there must
+		// be no behavior change depending on which of the two header names is
+		// used in the RBAC policy." - A41. Any header matcher with value "host"
+		// is rewritten to ":authority", as that is what grpc-go shifts both
+		// headers to in the transport layer.
+		//
+		// Both rules apply to header matchers nested inside and/or/not rules, so
+		// the whole permission and principal trees are walked.
+		for _, principal := range policy.GetPrincipals() {
+			if err := normalizePrincipalHeaders(principal); err != nil {
+				return nil, err
 			}
 		}
-		for _, permission := range policy.Permissions {
-			name := permission.GetHeader().GetName()
-			if name == ":scheme" || strings.HasPrefix(name, "grpc-") {
-				return nil, fmt.Errorf("rbac: permission header matcher for %v is :scheme or starts with grpc", name)
-			}
-		}
-	}
-
-	// "Envoy aliases :authority and Host in its header map implementation, so
-	// they should be treated equivalent for the RBAC matchers; there must be no
-	// behavior change depending on which of the two header names is used in the
-	// RBAC policy." - A41. Loop through config's principals and policies, change
-	// any header matcher with value "host" to :authority", as that is what
-	// grpc-go shifts both headers to in transport layer.
-	for _, policy := range rbacCfg.GetRules().GetPolicies() {
-		for _, principal := range policy.Principals {
-			if principal.GetHeader().GetName() == "host" {
-				principal.GetHeader().Name = ":authority"
-			}
-		}
-		for _, permission := range policy.Permissions {
-			if permission.GetHeader().GetName() == "host" {
-				permission.GetHeader().Name = ":authority"
+		for _, permission := range policy.GetPermissions() {
+			if err := normalizePermissionHeaders(permission); err != nil {
+				return nil, err
 			}
 		}
 	}
@@ -126,6 +116,82 @@ func parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) {
 	return config{chainEngine: ce}, nil
 }
 
+// normalizePermissionHeaders applies the A41 header-name rules to every header
+// matcher reachable from permission, including those nested inside and/or/not
+// rules.
+func normalizePermissionHeaders(permission *v3rbacpb.Permission) error {
+	switch p := permission.GetRule().(type) {
+	case *v3rbacpb.Permission_Header:
+		return normalizeHeaderMatcher(p.Header)
+	case *v3rbacpb.Permission_AndRules:
+		for _, rule := range p.AndRules.GetRules() {
+			if err := normalizePermissionHeaders(rule); err != nil {
+				return err
+			}
+		}
+	case *v3rbacpb.Permission_OrRules:
+		for _, rule := range p.OrRules.GetRules() {
+			if err := normalizePermissionHeaders(rule); err != nil {
+				return err
+			}
+		}
+	case *v3rbacpb.Permission_NotRule:
+		return normalizePermissionHeaders(p.NotRule)
+	}
+	return nil
+}
+
+// normalizePrincipalHeaders applies the A41 header-name rules to every header
+// matcher reachable from principal, including those nested inside and/or/not
+// ids.
+func normalizePrincipalHeaders(principal *v3rbacpb.Principal) error {
+	switch p := principal.GetIdentifier().(type) {
+	case *v3rbacpb.Principal_Header:
+		return normalizeHeaderMatcher(p.Header)
+	case *v3rbacpb.Principal_AndIds:
+		for _, id := range p.AndIds.GetIds() {
+			if err := normalizePrincipalHeaders(id); err != nil {
+				return err
+			}
+		}
+	case *v3rbacpb.Principal_OrIds:
+		for _, id := range p.OrIds.GetIds() {
+			if err := normalizePrincipalHeaders(id); err != nil {
+				return err
+			}
+		}
+	case *v3rbacpb.Principal_NotId:
+		return normalizePrincipalHeaders(p.NotId)
+	}
+	return nil
+}
+
+// normalizeHeaderMatcher lowercases the name of a header matcher, rejects the
+// names that A41 forbids (:scheme or a grpc- prefixed name) and rewrites a
+// "host" matcher to ":authority".
+func normalizeHeaderMatcher(header *v3routepb.HeaderMatcher) error {
+	// The keys of the metadata the matchers run against are always lowercase,
+	// so a name that contains an uppercase character matches no header at all
+	// and the rule using it never fires. Lowercase the name, as Envoy and
+	// grpc-java do, both to make it match and to keep the checks below from
+	// being evaded by the case of the name.
+	name := header.GetName()
+	lowerName := strings.ToLower(name)
+	if lowerName != name {
+		header.Name = lowerName
+	}
+	if lowerName == ":scheme" {
+		return fmt.Errorf("rbac: header matcher for %q is %q", name, ":scheme")
+	}
+	if strings.HasPrefix(lowerName, "grpc-") {
+		return fmt.Errorf("rbac: header matcher for %q starts with %q", name, "grpc-")
+	}
+	if lowerName == "host" {
+		header.Name = ":authority"
+	}
+	return nil
+}
+
 func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
 	if cfg == nil {
 		return nil, fmt.Errorf("rbac: nil configuration message provided")
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/server/routing.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/server/routing.go
index 67dd7609e..706872585 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/server/routing.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/internal/xds/server/routing.go
@@ -62,11 +62,14 @@ func RouteAndProcess(ctx context.Context) error {
 	if !ok {
 		return errors.New("missing metadata in incoming context")
 	}
-	// A41 added logic to the core grpc implementation to guarantee that once
-	// the RPC gets to this point, there will be a single, unambiguous authority
-	// present in the header map.
+	// A41 added logic to the core grpc implementation to guarantee that once the
+	// RPC gets to this point, there will be a single, unambiguous authority
+	// present in the header map. But add a defensive check to ensure authority
+	// header is present.
 	authority := md.Get(":authority")
-	// authority[0] is safe because of the guarantee mentioned above.
+	if len(authority) == 0 {
+		return rc.statusErrWithNodeID(codes.Internal, "no :authority header present")
+	}
 	vh := findBestMatchingVirtualHostServer(authority[0], rc.vhs)
 	if vh == nil {
 		return rc.statusErrWithNodeID(codes.Unavailable, "the incoming RPC did not match a configured Virtual Host")
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffer_pool.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffer_pool.go
index 3b02b9091..aa121379f 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffer_pool.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffer_pool.go
@@ -59,10 +59,6 @@ func init() {
 	internal.SetDefaultBufferPool = func(pool BufferPool) {
 		defaultBufferPool = pool
 	}
-
-	internal.SetBufferPoolingThresholdForTesting = func(threshold int) {
-		bufferPoolingThreshold = threshold
-	}
 }
 
 // DefaultBufferPool returns the current default buffer pool. It is a BufferPool
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffers.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffers.go
index 2b410b16e..9b355d446 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffers.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/mem/buffers.go
@@ -29,6 +29,8 @@ import (
 	"fmt"
 	"sync"
 	"sync/atomic"
+
+	"google.golang.org/grpc/internal/mem"
 )
 
 // A Buffer represents a reference counted piece of data (in bytes) that can be
@@ -63,8 +65,6 @@ type Buffer interface {
 }
 
 var (
-	bufferPoolingThreshold = 1 << 10
-
 	bufferObjectPool = sync.Pool{New: func() any { return new(buffer) }}
 )
 
@@ -72,7 +72,7 @@ var (
 // equal to the threshold for buffer pooling. This is used to determine whether
 // to pool buffers or allocate them directly.
 func IsBelowBufferPoolingThreshold(size int) bool {
-	return size <= bufferPoolingThreshold
+	return size <= mem.BufferPoolingThreshold
 }
 
 type buffer struct {
diff --git a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/version.go b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/version.go
index 4083c0390..835dc07fd 100644
--- a/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/version.go
+++ b/ci/resources/stemcell-version-bump/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.83.0"
+const Version = "1.83.2"
diff --git a/ci/resources/stemcell-version-bump/vendor/modules.txt b/ci/resources/stemcell-version-bump/vendor/modules.txt
index 284c7a7f6..21cb0eb05 100644
--- a/ci/resources/stemcell-version-bump/vendor/modules.txt
+++ b/ci/resources/stemcell-version-bump/vendor/modules.txt
@@ -268,7 +268,7 @@ go.opentelemetry.io/otel/trace
 go.opentelemetry.io/otel/trace/embedded
 go.opentelemetry.io/otel/trace/internal/telemetry
 go.opentelemetry.io/otel/trace/noop
-# golang.org/x/crypto v0.54.0
+# golang.org/x/crypto v0.55.0
 ## explicit; go 1.25.0
 golang.org/x/crypto/chacha20
 golang.org/x/crypto/chacha20poly1305
@@ -277,7 +277,7 @@ golang.org/x/crypto/cryptobyte/asn1
 golang.org/x/crypto/hkdf
 golang.org/x/crypto/internal/alias
 golang.org/x/crypto/internal/poly1305
-# golang.org/x/net v0.57.0
+# golang.org/x/net v0.58.0
 ## explicit; go 1.25.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
@@ -309,7 +309,7 @@ golang.org/x/sys/cpu
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/text v0.40.0
+# golang.org/x/text v0.41.0
 ## explicit; go 1.25.0
 golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
@@ -356,7 +356,7 @@ google.golang.org/genproto/googleapis/api/monitoredres
 google.golang.org/genproto/googleapis/rpc/code
 google.golang.org/genproto/googleapis/rpc/errdetails
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.83.0
+# google.golang.org/grpc v1.83.2
 ## explicit; go 1.25.0
 google.golang.org/grpc
 google.golang.org/grpc/attributes