diff --git a/build/config/versions.env b/build/config/versions.env
index 950bae32..4729f88c 100644
--- a/build/config/versions.env
+++ b/build/config/versions.env
@@ -55,7 +55,7 @@ V_SHADOW=4.16.0
 # --- compression / core libs ---
 V_BZIP2=1.0.8
 V_ZSTD=1.5.6
-V_EXPAT=2.8.5
+V_EXPAT=2.9.0
 V_LIBFFI=3.5.2
 V_LIBXCRYPT=4.5.2
 
@@ -73,7 +73,7 @@ V_GPERF=3.1
 # --- system utilities ---
 V_ATTR=2.6.0
 V_ACL=2.4.0
-V_IANA_ETC=20240806
+V_IANA_ETC=20260930
 V_LESS=710
 V_GROFF=1.23.0
 V_PROCPS=4.0.7
@@ -106,7 +106,7 @@ V_PERL=5.40.5
 # cmake only builds json-c and is not in the image. The chroot runs Kitware's
 # binary (cmake-bin in sources.lock) to save a long source build; the source
 # tarball is the fallback where that binary cannot run.
-V_CMAKE=4.4.3
+V_CMAKE=4.4.4
 V_JSON_C=0.19-20260627
 V_POPT=1.19
 V_LIBAIO=0.3.113
@@ -114,7 +114,7 @@ V_LIBAIO=0.3.113
 V_LVM2=2.03.42
 
 # --- release signatures: only ssh-keygen is built from OpenSSH ---
-V_OPENSSH=10.5p1
+V_OPENSSH=10.6p1
 
 # --- the net zone: NAT, a resolver and DHCP (docs/design/net-zone.md) ---
 V_LIBMNL=1.0.5
diff --git a/sources.lock b/sources.lock
index 0fb416c3..9042b72c 100644
--- a/sources.lock
+++ b/sources.lock
@@ -10,8 +10,8 @@ ae470fec429775653e042015edc928d07c8c3b2fc59765172a330d3d87785f86  bc-1.08.2.tar.
 9bba0214ccf7f1079c5d59210045227bcf619519840ebfa80cd3849cff5a5bf2  bison-3.8.2.tar.xz
 ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269  bzip2-1.0.8.tar.gz
 f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9  cacert-2026-08-13.pem
-d6c83076c575bc00b823522ac974bda66d0af05d6ddc30e739c12385cf32c6cc  cmake-4.4.3-linux-x86_64.tar.gz
-c46400618b4f1f2b43507f24fb22f3ae830c3416cf23b776e16e1d413aa892f0  cmake-4.4.3.tar.gz
+e5bb807f7728cb60cd8b27ebc97a2edb469b68655f21e844a600c3575b76f5bb  cmake-4.4.4-linux-x86_64.tar.gz
+bd24c30d80a7744ae84b845ff080cc8453b06c622ef01066564108e9cefc44cf  cmake-4.4.4.tar.gz
 a480198559733e9b3da999e90543ac6f888a2caa544d8d664c5a1f17e528e210  coreutils-9.12.tar.xz
 3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35  cryptsetup-2.8.8.tar.xz
 fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7  dejavu-fonts-ttf-2.37.tar.bz2
@@ -23,7 +23,7 @@ ccc8bbb3fb66a7e6f0392693533ac9c8bd4e6283dd1f66992e68ec4d4a9cdee7  dwl-v0.8.tar.g
 df76db71366d1d708365fc7a6c60ca48398f14367eb2b8954efc8897147ad871  elfutils-0.191.tar.bz2
 eb69809fc0d1187f2463ab2149c53aa9f42a78e59f14ebea68eae6cb6b4fc1c3  eudev-3.2.15.tar.gz
 908ed4db3a6b3a23a205d8fd4cf2a71089156f2aeae0f54656045aafad2dee32  execline-2.9.9.2.tar.gz
-1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182  expat-2.8.5.tar.xz
+1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051  expat-2.9.0.tar.xz
 fc97f51029bb0e2c9f4e3bffefdaf678f0e039ee872b9de5c002a6d09c784d82  file-5.45.tar.gz
 bfd19cb06cc71f3352d567e90284d8cdac02ac89774bbeadf0b533b0c11432fd  findutils-4.11.0.tar.xz
 e87aae032bf07c26f85ac0ed3250998c37621d95f8bd748b31f15b33c45ee995  flex-2.6.4.tar.gz
@@ -40,7 +40,7 @@ a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898  gmp-6.3.0.tar.
 9aa0cc780dec156b8282844833b342ab7cb08c25d2cd9a1869cdd0df31deff48  gzip-1.15.tar.xz
 b4f819bfc3b0f8ea967018948dbf3a71f174a02886d00ee16121739fcd140d6f  havoc-0.7.0.tar.gz
 f0c64cd7e31d70a5fb3a52e53ab50a61e74c0421a6381eaa45114eec3bde5fe7  hwdata-0.412.tar.gz
-672dbe1ba52b889a46dc07ee3876664ed601983239f82d729d02a002475a5b66  iana-etc-20240806.tar.gz
+ead94c150ba26a30a33c36722b97624fd9ff24c80abcd6303a21af52b24f9e55  iana-etc-20260930.tar.gz
 57b3cf4f77555992881e5ba2a09a63b05aa2c56342a60ed4305b5f45938390b5  inetutils-2.8.tar.gz
 4c2fa124c2cf0afd7ca34d1eeacba6ba048a56f6374e2aab93dafbdbd4eea9c0  iproute2-7.2.0.tar.xz
 6f213700dbf96b5cc4499ca70cb15ecd69c09f405b06785bb4a1a10b572b6276  iputils-20250605.tar.xz
@@ -79,7 +79,7 @@ a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e  mtdev-1.1.7.ta
 355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11  ncurses-6.6.tar.gz
 a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f  nftables-1.1.7.tar.xz
 974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17  ninja-1.13.2.tar.gz
-d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11  openssh-10.5p1.tar.gz
+a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39  openssh-10.6p1.tar.gz
 603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a  openssl-3.5.9.tar.gz
 f87cee69eec2b4fcbf60a396b030ad6aa3415f192aa5f7ee84cad5e11f7f5ae3  patch-2.8.tar.xz
 1fe6f825b487d26c35aa51a35f52fe494d4cfc77b8051f8b1ee3391bf0289bc6  perl-5.40.5.tar.xz
diff --git a/tools/pin-reviews.tsv b/tools/pin-reviews.tsv
index 29d023b8..da6412ef 100644
--- a/tools/pin-reviews.tsv
+++ b/tools/pin-reviews.tsv
@@ -33,7 +33,6 @@ texinfo       7.1      7.3      fine  2026-09-19  NEWS 7.1.1 to 7.3: no security
 libtool       2.4.7    2.6.2    fine  2026-09-19  NEWS 2.5.x and 2.6.x: no security fix.
 gperf         3.1      3.3      fine  2026-09-19  NEWS 3.2 and 3.3: no security fix.
 pkgconf       2.3.0    3.0.7    fine  2026-09-19  NEWS to 3.0.7: no security fix. 3.0 breaks the libpkgconf ABI, moves to meson and changed quoting and sysroot handling twice.
-iana-etc      20240806 20260911 fine  2026-09-19  Data only: /etc/services and /etc/protocols.
 intel-microcode 20260812 20260925 fine  2026-09-27  Release notes 20260925: one functional update, Meteor Lake C0 (06-aa-04, 0x28 to 0x2b), and no security advisory.
 ca-bundle     2026-08-13 2026-09-25 fine  2026-09-27  The 2026-09-25 bundle holds the same 121 certificates, byte for byte; only its header's date and certdata.txt digest differ.
 groff         1.23.0   1.24.2   fine  2026-09-29  NEWS 1.24.0 to 1.24.2: 1.24.2 fixes command injection (CWE-78) in mmroff, pdfmom and pre-grohtml, which the image does not install (build/recipes/groff.sh); man renders for a terminal, never HTML. 1.24.0 has incompatible request-syntax changes; never that one.