diff --git a/charts/substrate/templates/rustfs.yaml b/charts/substrate/templates/rustfs.yaml
index edaad3cfa8..0a7966e731 100644
--- a/charts/substrate/templates/rustfs.yaml
+++ b/charts/substrate/templates/rustfs.yaml
@@ -98,6 +98,10 @@ kind: Job
 metadata:
   name: {{ include "substrate.fullname" (list "rustfs-bucket-init" .) }}
   namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 10
   template:
diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml
index ee420bbad9..9ff3751c07 100644
--- a/charts/substrate/values.yaml
+++ b/charts/substrate/values.yaml
@@ -67,8 +67,8 @@ image:
   tag: ""
 
 images:
-  postgres: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
-  rustfs: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
-  awsCli: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
+  postgres: postgres:18.6-alpine3.24@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2
+  rustfs: rustfs/rustfs:v1.0.0-rc.5@sha256:b7014e0ce2bc703c1316b3ef760e29dfae61fe4a50d1a66fa89638e0f8ea211f
+  awsCli: amazon/aws-cli:2.36.43@sha256:d948ee299a7ffcaec0d6052a00b9f4c513c61cacfaedfe68b098c85808394441
   agentgateway: ghcr.io/agentgateway/agentgateway:v0.0.0-alpha.9f9744cf
-  busybox: busybox:1.36
+  busybox: busybox:1.38.0@sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616
diff --git a/hack/microvm-assets/stage-to-rustfs.sh b/hack/microvm-assets/stage-to-rustfs.sh
index e0d3af4a10..09c3370a59 100755
--- a/hack/microvm-assets/stage-to-rustfs.sh
+++ b/hack/microvm-assets/stage-to-rustfs.sh
@@ -46,7 +46,7 @@ KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
 
 # Keep in sync with the rustfs-bucket-init Job in
 # manifests/ate-install/kind/rustfs.yaml, which creates the bucket we upload into.
-AWS_CLI_IMAGE="amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73"
+AWS_CLI_IMAGE="amazon/aws-cli:2.36.43@sha256:d948ee299a7ffcaec0d6052a00b9f4c513c61cacfaedfe68b098c85808394441"
 
 ASSETS=(cloud-hypervisor virtiofsd vmlinux rootfs.img configuration-clh.toml)
 
diff --git a/manifests/ate-install/kind/rustfs.yaml b/manifests/ate-install/kind/rustfs.yaml
index 3185390d00..411c2bca7b 100644
--- a/manifests/ate-install/kind/rustfs.yaml
+++ b/manifests/ate-install/kind/rustfs.yaml
@@ -62,7 +62,7 @@ spec:
         fsGroup: 10001
       containers:
       - name: rustfs
-        image: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
+        image: rustfs/rustfs:v1.0.0-rc.5@sha256:b7014e0ce2bc703c1316b3ef760e29dfae61fe4a50d1a66fa89638e0f8ea211f
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9000
@@ -95,6 +95,10 @@ kind: Job
 metadata:
   name: rustfs-bucket-init
   namespace: ate-system
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 10
   template:
@@ -102,7 +106,7 @@ spec:
       restartPolicy: OnFailure
       containers:
       - name: create-bucket
-        image: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
+        image: amazon/aws-cli:2.36.43@sha256:d948ee299a7ffcaec0d6052a00b9f4c513c61cacfaedfe68b098c85808394441
         env:
         - name: AWS_ACCESS_KEY_ID
           value: rustfsadmin
diff --git a/manifests/ate-install/postgres/postgres.yaml b/manifests/ate-install/postgres/postgres.yaml
index 14a11ea473..931f4dfbf5 100644
--- a/manifests/ate-install/postgres/postgres.yaml
+++ b/manifests/ate-install/postgres/postgres.yaml
@@ -120,7 +120,7 @@ spec:
       initContainers:
       - name: tls-reloader
         restartPolicy: Always
-        image: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
+        image: postgres:18.6-alpine3.24@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2
         securityContext:
           runAsUser: 70
         command:
@@ -143,7 +143,7 @@ spec:
             memory: 32Mi
       containers:
       - name: postgres
-        image: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
+        image: postgres:18.6-alpine3.24@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2
         lifecycle:
           postStart:
             exec:
diff --git a/manifests/ate-install/rustfs.yaml b/manifests/ate-install/rustfs.yaml
index d6be308128..313ac754d0 100644
--- a/manifests/ate-install/rustfs.yaml
+++ b/manifests/ate-install/rustfs.yaml
@@ -65,7 +65,7 @@ spec:
         fsGroup: 10001
       containers:
       - name: rustfs
-        image: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
+        image: rustfs/rustfs:v1.0.0-rc.5@sha256:b7014e0ce2bc703c1316b3ef760e29dfae61fe4a50d1a66fa89638e0f8ea211f
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9000
@@ -98,6 +98,10 @@ kind: Job
 metadata:
   name: rustfs-bucket-init
   namespace: ate-system
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 10
   template:
@@ -105,7 +109,7 @@ spec:
       restartPolicy: OnFailure
       containers:
       - name: create-bucket
-        image: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
+        image: amazon/aws-cli:2.36.43@sha256:d948ee299a7ffcaec0d6052a00b9f4c513c61cacfaedfe68b098c85808394441
         env:
         - name: AWS_ACCESS_KEY_ID
           value: "rustfsadmin"