diff --git a/.github/workflows/reusable-multi-node.yaml b/.github/workflows/reusable-multi-node.yaml
index 9a23d54e..b78891c8 100644
--- a/.github/workflows/reusable-multi-node.yaml
+++ b/.github/workflows/reusable-multi-node.yaml
@@ -7,6 +7,12 @@ on:
         description: lima template
         type: string
         default: "template://ubuntu-24.04"
+      lima_version:
+        description: lima version
+        type: string
+        # Pinned to v1.2, as a workaround for a regression of `limactl copy` in Lima v2.0
+        # https://github.com/lima-vm/lima/issues/4468
+        default: "v1.2.2"
       container_engine:
         description: container engine
         type: string
@@ -47,13 +53,15 @@ jobs:
       PORT_ETCD: "${{ inputs.etcd_port }}"
       KUBECONFIG: ./kubeconfig
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: lima-vm/lima-actions/setup@v1
         id: lima-actions-setup
+        with:
+          version: "${{ inputs.lima_version }}"
 
       - name: "Cache ~/.cache/lima"
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/lima
           key: lima-${{ steps.lima-actions-setup.outputs.version }}
diff --git a/.github/workflows/reusable-single-node.yaml b/.github/workflows/reusable-single-node.yaml
index 28b70013..cc231031 100644
--- a/.github/workflows/reusable-single-node.yaml
+++ b/.github/workflows/reusable-single-node.yaml
@@ -41,7 +41,12 @@ jobs:
       PORT_ETCD: "${{ inputs.etcd_port }}"
       KUBECONFIG: ./kubeconfig
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Load kernel modules
+        run: |
+          sudo modprobe br_netfilter
+          sudo modprobe iptable_nat
+          sudo modprobe vxlan
       - name: Set up cgroup v2 delegation
         run: |
           sudo mkdir -p /etc/systemd/system/user@.service.d
diff --git a/Dockerfile b/Dockerfile
index 1b699e31..e7b8a567 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
-ARG BASE_IMAGE=docker.io/kindest/node:v1.33.0@sha256:91e9ed777db80279c22d1d1068c091b899b2078506e4a0f797fbf6e397c0b0b2
-ARG CNI_PLUGINS_VERSION=v1.7.1
-ARG HELM_VERSION=v3.17.3
-ARG FLANNEL_VERSION=v0.26.7
+ARG BASE_IMAGE=docker.io/kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f
+ARG CNI_PLUGINS_VERSION=v1.9.0
+ARG HELM_VERSION=v4.0.4
+ARG FLANNEL_VERSION=v0.27.4
 FROM ${BASE_IMAGE}
 COPY Dockerfile.d/SHA256SUMS.d/ /tmp/SHA256SUMS.d
 ARG CNI_PLUGINS_VERSION
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1
deleted file mode 100644
index c9f57e39..00000000
--- a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1
+++ /dev/null
@@ -1,2 +0,0 @@
-1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098  cni-plugins-linux-amd64-v1.7.1.tgz
-119fcb508d1ac2149e49a550752f9cd64d023a1d70e189b59c476e4d2bf7c497  cni-plugins-linux-arm64-v1.7.1.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.9.0 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.9.0
new file mode 100644
index 00000000..b23c1054
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.9.0
@@ -0,0 +1,2 @@
+58c03705426e929658f45a851df15a86d06ef680cacbf3f2dc127731ca265c28  cni-plugins-linux-amd64-v1.9.0.tgz
+2596ef56329dd1269026f46b8df262f09ba43c92dbfb940e1e69fbccccd30a29  cni-plugins-linux-arm64-v1.9.0.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/flannel-v0.26.7 b/Dockerfile.d/SHA256SUMS.d/flannel-v0.26.7
deleted file mode 100644
index 7401f752..00000000
--- a/Dockerfile.d/SHA256SUMS.d/flannel-v0.26.7
+++ /dev/null
@@ -1 +0,0 @@
-11d44653d9177415fbc80a7918d6d734b2473b299d71b345ac57e91f81b6fa7e  flannel.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/flannel-v0.27.4 b/Dockerfile.d/SHA256SUMS.d/flannel-v0.27.4
new file mode 100644
index 00000000..d180cce0
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/flannel-v0.27.4
@@ -0,0 +1 @@
+c1f3c87436192459c1e1bfd23f96a605892f974e47f87324e360a4f43a4268e1  flannel.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/helm-v3.17.3 b/Dockerfile.d/SHA256SUMS.d/helm-v3.17.3
deleted file mode 100644
index 754de9c9..00000000
--- a/Dockerfile.d/SHA256SUMS.d/helm-v3.17.3
+++ /dev/null
@@ -1,2 +0,0 @@
-ee88b3c851ae6466a3de507f7be73fe94d54cbf2987cbaa3d1a3832ea331f2cd  helm-v3.17.3-linux-amd64.tar.gz
-7944e3defd386c76fd92d9e6fec5c2d65a323f6fadc19bfb5e704e3eee10348e  helm-v3.17.3-linux-arm64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/helm-v4.0.4 b/Dockerfile.d/SHA256SUMS.d/helm-v4.0.4
new file mode 100644
index 00000000..d45f856f
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/helm-v4.0.4
@@ -0,0 +1,2 @@
+29454bc351f4433e66c00f5d37841627cbbcc02e4c70a6d796529d355237671c  helm-v4.0.4-linux-amd64.tar.gz
+16b88acc6503d646b7537a298e7389bef469c5cc9ebadf727547abe9f6a35903  helm-v4.0.4-linux-arm64.tar.gz