diff --git a/head b/head
index ba5a0f8a896..b54d367ff79 100644
--- a/head
+++ b/head
@@ -1 +1 @@
-c2c3085de6ad2019538f83c0b033d7e9c913be97
+1d36a660975e644ab06d6e95f1fe9bfc09ad32a6
diff --git a/upstream/.github/workflows/codeql-analysis.yml b/upstream/.github/workflows/codeql-analysis.yml
index 81094b656bd..20f28adc392 100644
--- a/upstream/.github/workflows/codeql-analysis.yml
+++ b/upstream/.github/workflows/codeql-analysis.yml
@@ -62,7 +62,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -96,4 +96,4 @@ jobs:
         make -j 4 all
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
diff --git a/upstream/.github/workflows/scorecard.yml b/upstream/.github/workflows/scorecard.yml
index 630864f0318..2be72ed3038 100644
--- a/upstream/.github/workflows/scorecard.yml
+++ b/upstream/.github/workflows/scorecard.yml
@@ -61,6 +61,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
         with:
           sarif_file: results.sarif
diff --git a/upstream/docs/README.md b/upstream/docs/README.md
index 380b9111f7f..eeec94bbe48 100644
--- a/upstream/docs/README.md
+++ b/upstream/docs/README.md
@@ -54,7 +54,7 @@ Tekton Pipelines defines the following entities:
 
 ## Getting started
 
-To get started, complete the [Tekton Pipelines Tutorial](https://github.com/tektoncd/pipeline/blob/main/docs/tutorial.md) and go through our
+To get started, complete the [Tekton Pipelines Tutorial](https://tekton.dev/docs/getting-started) and go through our
 [examples](https://github.com/tektoncd/pipeline/tree/main/examples).
 
 ## Understanding Tekton Pipelines
diff --git a/upstream/docs/tutorial.md b/upstream/docs/tutorial.md
deleted file mode 100644
index 7c4bf373212..00000000000
--- a/upstream/docs/tutorial.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Tekton Pipelines Tutorial
-
-Check our ["Hello Word" example on our documentation
-website](https://tekton.dev/docs/getting-started/).
-
----
-
-Except as otherwise noted, the content of this page is licensed under the
-[Creative Commons Attribution 4.0 License](https://creativecommons.org/licenses/by/4.0/),
-and code samples are licensed under the
-[Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0).
diff --git a/upstream/tekton/publish.yaml b/upstream/tekton/publish.yaml
index c8570b5d860..867e4e6480c 100644
--- a/upstream/tekton/publish.yaml
+++ b/upstream/tekton/publish.yaml
@@ -73,7 +73,7 @@ spec:
   steps:
 
   - name: container-registry-auth
-    image: cgr.dev/chainguard/crane:latest-dev@sha256:6fc6fcdeb173c7951f038e6a7b230f586c1be05a011d9e6f9db6c614ec412c2f
+    image: cgr.dev/chainguard/crane:latest-dev@sha256:8206db4f80fad1a0a29e5721e10d59b942cd825c75b6ea4692d5c81a43c0d130
     script: |
       #!/bin/sh
       set -ex
@@ -92,7 +92,7 @@ spec:
       cp ${DOCKER_CONFIG} /workspace/docker-config.json
 
   - name: create-ko-yaml
-    image: cgr.dev/chainguard/go:latest-dev@sha256:2cc69746dc5469406f0203b863397dccb2ab56e71750dc37951bcf5b04c74218
+    image: cgr.dev/chainguard/go:latest-dev@sha256:05e8da84b607f2c8cf5d3277ff203ec7f5db6d2ae8e7adad3c00b83854f9865c
     script: |
       #!/bin/sh
       set -ex
@@ -232,7 +232,7 @@ spec:
         ${PRESERVE_IMPORT_PATH} > /workspace/built_images
 
   - name: tag-images
-    image: cgr.dev/chainguard/crane:latest-dev@sha256:6fc6fcdeb173c7951f038e6a7b230f586c1be05a011d9e6f9db6c614ec412c2f
+    image: cgr.dev/chainguard/crane:latest-dev@sha256:8206db4f80fad1a0a29e5721e10d59b942cd825c75b6ea4692d5c81a43c0d130
     script: |
       #!/bin/sh
       set -ex