diff --git a/.github/workflows/dependabot-deps.yaml b/.github/workflows/dependabot-deps.yaml
index 08b73f2a93..4573a188a0 100644
--- a/.github/workflows/dependabot-deps.yaml
+++ b/.github/workflows/dependabot-deps.yaml
@@ -14,7 +14,7 @@ jobs:
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
           path: ./src/github.com/${{ github.repository }}
diff --git a/.tekton/bundle-build.yaml b/.tekton/bundle-build.yaml
index 1eb75768dc..c3fd62e5fb 100755
--- a/.tekton/bundle-build.yaml
+++ b/.tekton/bundle-build.yaml
@@ -1,7 +1,6 @@
 apiVersion: tekton.dev/v1
 kind: Pipeline
 metadata:
-  creationTimestamp:
   labels:
     pipelines.openshift.io/runtime: generic
     pipelines.openshift.io/strategy: docker
@@ -11,23 +10,13 @@ spec:
   description: |
     This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.
 
-    _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
+    _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
     This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_
-  finally:
-  - name: show-sbom
-    params:
-    - name: IMAGE_URL
-      value: $(tasks.build-image-index.results.IMAGE_URL)
-    taskRef:
-      params:
-      - name: name
-        value: show-sbom
-      - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:86c069cac0a669797e8049faa8aa4088e70ff7fcd579d5bdc37626a9e0488a05
-      - name: kind
-        value: task
-      resolver: bundles
   params:
+  - default: "false"
+    description: Add built image into an OCI image index
+    name: build-image-index
+    type: string
   - default: --all-projects --org=3e1a4cca-ebfb-495f-b64c-3cc960d566b4 --exclude=test*,vendor,third_party
     description: Append arguments to Snyk code command.
     name: snyk-args
@@ -37,7 +26,8 @@ spec:
     name: build-source-image
     type: string
   - default: "false"
-    description: 'Enable in-development package managers. WARNING: the behavior may change at any time without notice. Use at your own risk.'
+    description: 'Enable in-development package managers. WARNING: the behavior may
+      change at any time without notice. Use at your own risk.'
     name: prefetch-input-dev-package-managers
   - default: []
     description: Additional image tags
@@ -54,17 +44,15 @@ spec:
     name: output-image
     type: string
   - default: .
-    description: Path to the source code of an application's component from where to build image.
+    description: Path to the source code of an application's component from where
+      to build image.
     name: path-context
     type: string
   - default: Dockerfile
-    description: Path to the Dockerfile inside the context specified by parameter path-context
+    description: Path to the Dockerfile inside the context specified by parameter
+      path-context
     name: dockerfile
     type: string
-  - default: "false"
-    description: Force rebuild image
-    name: rebuild
-    type: string
   - default: "false"
     description: Skip checks against built image
     name: skip-checks
@@ -74,16 +62,22 @@ spec:
     name: hermetic
     type: string
   - default: ""
-    description: Build dependencies to be prefetched by Cachi2
+    description: Build dependencies to be prefetched
     name: prefetch-input
     type: string
   - default: ""
-    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
+    description: Image tag expiration time, time values could be something like 1h,
+      2d, 3w for hours, days, and weeks, respectively.
     name: image-expires-after
-  - default: "true"
-    description: Add built image into an OCI image index
-    name: build-image-index
     type: string
+  - default: docker
+    description: The format for the resulting image's mediaType. Valid values are
+      oci or docker.
+    name: buildah-format
+    type: string
+  - default: "false"
+    description: Enable cache proxy configuration
+    name: enable-cache-proxy
   - default: []
     description: Array of --build-arg values ("arg=value" strings) for buildah
     name: build-args
@@ -93,12 +87,14 @@ spec:
     name: build-args-file
     type: string
   - default: "false"
-    description: Whether to enable privileged mode, should be used only with remote VMs
+    description: Whether to enable privileged mode, should be used only with remote
+      VMs
     name: privileged-nested
     type: string
   - default:
     - linux/x86_64
-    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
+    description: List of platforms to build the container images on. The available
+      set of values is determined by the configuration of the multi-platform-controller.
     name: build-platforms
     type: array
   results:
@@ -115,6 +111,59 @@ spec:
     name: CHAINS-GIT_COMMIT
     value: $(tasks.clone-repository.results.commit)
   tasks:
+  - matrix:
+      params:
+      - name: PLATFORM
+        value:
+        - $(params.build-platforms)
+    name: build-images
+    params:
+    - name: IMAGE_APPEND_PLATFORM
+      value: "false"
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: HERMETIC
+      value: $(params.hermetic)
+    - name: PREFETCH_INPUT
+      value: $(params.prefetch-input)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: BUILD_ARGS
+      value:
+      - $(params.build-args[*])
+    - name: BUILD_ARGS_FILE
+      value: $(params.build-args-file)
+    - name: PRIVILEGED_NESTED
+      value: $(params.privileged-nested)
+    - name: SOURCE_URL
+      value: $(tasks.clone-repository.results.url)
+    - name: BUILDAH_FORMAT
+      value: $(params.buildah-format)
+    - name: HTTP_PROXY
+      value: $(tasks.init.results.http-proxy)
+    - name: NO_PROXY
+      value: $(tasks.init.results.no-proxy)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - prefetch-dependencies
+    taskRef:
+      params:
+      - name: name
+        value: buildah-remote-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:9e866d4d0489a6ab84ae263db416c9f86d2d6117ef4444f495a0e97388ae3ac0
+      - name: kind
+        value: task
+      resolver: bundles
   - name: sast-snyk-check
     params:
     - name: ARGS
@@ -192,12 +241,8 @@ spec:
       resolver: bundles
   - name: init
     params:
-    - name: image-url
-      value: $(params.output-image)
-    - name: rebuild
-      value: $(params.rebuild)
-    - name: skip-checks
-      value: $(params.skip-checks)
+    - name: enable-cache-proxy
+      value: $(params.enable-cache-proxy)
     taskRef:
       params:
       - name: name
@@ -228,77 +273,20 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
     workspaces:
     - name: basic-auth
       workspace: git-auth
-  - matrix:
-      params:
-      - name: PLATFORM
-        value:
-        - $(params.build-platforms)
-    name: build-images
-    params:
-    - name: IMAGE
-      value: $(params.output-image)
-    - name: DOCKERFILE
-      value: $(params.dockerfile)
-    - name: CONTEXT
-      value: $(params.path-context)
-    - name: HERMETIC
-      value: $(params.hermetic)
-    - name: PREFETCH_INPUT
-      value: $(params.prefetch-input)
-    - name: IMAGE_EXPIRES_AFTER
-      value: $(params.image-expires-after)
-    - name: COMMIT_SHA
-      value: $(tasks.clone-repository.results.commit)
-    - name: BUILD_ARGS
-      value:
-      - $(params.build-args[*])
-    - name: BUILD_ARGS_FILE
-      value: $(params.build-args-file)
-    - name: PRIVILEGED_NESTED
-      value: $(params.privileged-nested)
-    - name: SOURCE_ARTIFACT
-      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-    - name: CACHI2_ARTIFACT
-      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-    - name: IMAGE_APPEND_PLATFORM
-      value: "true"
-    runAfter:
-    - prefetch-dependencies
-    taskRef:
-      params:
-      - name: name
-        value: buildah-remote-oci-ta
-      - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:9e866d4d0489a6ab84ae263db416c9f86d2d6117ef4444f495a0e97388ae3ac0
-      - name: kind
-        value: task
-      resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: build-image-index
     params:
     - name: IMAGE
       value: $(params.output-image)
-    - name: COMMIT_SHA
-      value: $(tasks.clone-repository.results.commit)
-    - name: IMAGE_EXPIRES_AFTER
-      value: $(params.image-expires-after)
     - name: ALWAYS_BUILD_INDEX
       value: $(params.build-image-index)
     - name: IMAGES
       value:
       - $(tasks.build-images.results.IMAGE_REF[*])
+    - name: BUILDAH_FORMAT
+      value: $(params.buildah-format)
     runAfter:
     - build-images
     taskRef:
@@ -310,21 +298,16 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: build-source-image
     params:
     - name: BINARY_IMAGE
       value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: BINARY_IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
     - name: SOURCE_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
     - name: CACHI2_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-    - name: BINARY_IMAGE_DIGEST
-      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
     runAfter:
     - build-image-index
     taskRef:
@@ -337,10 +320,6 @@ spec:
         value: task
       resolver: bundles
     when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
     - input: $(params.build-source-image)
       operator: in
       values:
@@ -367,7 +346,12 @@ spec:
       operator: in
       values:
       - "false"
-  - name: clair-scan
+  - matrix:
+      params:
+      - name: image-platform
+        value:
+        - $(params.build-platforms)
+    name: clair-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -389,7 +373,12 @@ spec:
       operator: in
       values:
       - "false"
-  - name: clamav-scan
+  - matrix:
+      params:
+      - name: image-arch
+        value:
+        - $(params.build-platforms)
+    name: clamav-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
diff --git a/.tekton/docker-build.yaml b/.tekton/docker-build.yaml
index 5ee8d8218a..11ce1b8966 100755
--- a/.tekton/docker-build.yaml
+++ b/.tekton/docker-build.yaml
@@ -1,7 +1,6 @@
 apiVersion: tekton.dev/v1
 kind: Pipeline
 metadata:
-  creationTimestamp:
   labels:
     pipelines.openshift.io/runtime: generic
     pipelines.openshift.io/strategy: docker
@@ -11,29 +10,16 @@ spec:
   description: |
     This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.
 
-    _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
+    _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
     This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_
-  finally:
-  - name: show-sbom
-    params:
-    - name: IMAGE_URL
-      value: $(tasks.build-image-index.results.IMAGE_URL)
-    taskRef:
-      params:
-      - name: name
-        value: show-sbom
-      - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:86c069cac0a669797e8049faa8aa4088e70ff7fcd579d5bdc37626a9e0488a05
-      - name: kind
-        value: task
-      resolver: bundles
   params:
   - default:
     - linux/x86_64
     - linux/arm64
     - linux/ppc64le
     - linux/s390x
-    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
+    description: List of platforms to build the container images on. The available
+      set of values is determined by the configuration of the multi-platform-controller.
     name: build-platforms
     type: array
   - default: --all-projects --org=3e1a4cca-ebfb-495f-b64c-3cc960d566b4 --exclude=test*,vendor,third_party
@@ -45,7 +31,8 @@ spec:
     name: build-source-image
     type: string
   - default: "false"
-    description: 'Enable in-development package managers. WARNING: the behavior may change at any time without notice. Use at your own risk.'
+    description: 'Enable in-development package managers. WARNING: the behavior may
+      change at any time without notice. Use at your own risk.'
     name: prefetch-input-dev-package-managers
   - default: []
     description: Additional image tags
@@ -62,17 +49,15 @@ spec:
     name: output-image
     type: string
   - default: .
-    description: Path to the source code of an application's component from where to build image.
+    description: Path to the source code of an application's component from where
+      to build image.
     name: path-context
     type: string
   - default: Dockerfile
-    description: Path to the Dockerfile inside the context specified by parameter path-context
+    description: Path to the Dockerfile inside the context specified by parameter
+      path-context
     name: dockerfile
     type: string
-  - default: "false"
-    description: Force rebuild image
-    name: rebuild
-    type: string
   - default: "false"
     description: Skip checks against built image
     name: skip-checks
@@ -82,16 +67,26 @@ spec:
     name: hermetic
     type: string
   - default: ""
-    description: Build dependencies to be prefetched by Cachi2
+    description: Build dependencies to be prefetched
     name: prefetch-input
     type: string
   - default: ""
-    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
+    description: Image tag expiration time, time values could be something like 1h,
+      2d, 3w for hours, days, and weeks, respectively.
     name: image-expires-after
+    type: string
   - default: "true"
     description: Add built image into an OCI image index
     name: build-image-index
     type: string
+  - default: docker
+    description: The format for the resulting image's mediaType. Valid values are
+      oci or docker.
+    name: buildah-format
+    type: string
+  - default: "false"
+    description: Enable cache proxy configuration
+    name: enable-cache-proxy
   - default: []
     description: Array of --build-arg values ("arg=value" strings) for buildah
     name: build-args
@@ -101,7 +96,8 @@ spec:
     name: build-args-file
     type: string
   - default: "false"
-    description: Whether to enable privileged mode, should be used only with remote VMs
+    description: Whether to enable privileged mode, should be used only with remote
+      VMs
     name: privileged-nested
     type: string
   results:
@@ -195,12 +191,8 @@ spec:
       resolver: bundles
   - name: init
     params:
-    - name: image-url
-      value: $(params.output-image)
-    - name: rebuild
-      value: $(params.rebuild)
-    - name: skip-checks
-      value: $(params.skip-checks)
+    - name: enable-cache-proxy
+      value: $(params.enable-cache-proxy)
     taskRef:
       params:
       - name: name
@@ -231,11 +223,6 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
     workspaces:
     - name: basic-auth
       workspace: git-auth
@@ -267,6 +254,14 @@ spec:
       value: $(params.build-args-file)
     - name: PRIVILEGED_NESTED
       value: $(params.privileged-nested)
+    - name: SOURCE_URL
+      value: $(tasks.clone-repository.results.url)
+    - name: BUILDAH_FORMAT
+      value: $(params.buildah-format)
+    - name: HTTP_PROXY
+      value: $(tasks.init.results.http-proxy)
+    - name: NO_PROXY
+      value: $(tasks.init.results.no-proxy)
     - name: SOURCE_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
     - name: CACHI2_ARTIFACT
@@ -284,24 +279,17 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: build-image-index
     params:
     - name: IMAGE
       value: $(params.output-image)
-    - name: COMMIT_SHA
-      value: $(tasks.clone-repository.results.commit)
-    - name: IMAGE_EXPIRES_AFTER
-      value: $(params.image-expires-after)
     - name: ALWAYS_BUILD_INDEX
       value: $(params.build-image-index)
     - name: IMAGES
       value:
       - $(tasks.build-images.results.IMAGE_REF[*])
+    - name: BUILDAH_FORMAT
+      value: $(params.buildah-format)
     runAfter:
     - build-images
     taskRef:
@@ -313,21 +301,16 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: build-source-image
     params:
     - name: BINARY_IMAGE
       value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: BINARY_IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
     - name: SOURCE_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
     - name: CACHI2_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-    - name: BINARY_IMAGE_DIGEST
-      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
     runAfter:
     - build-image-index
     taskRef:
@@ -340,10 +323,6 @@ spec:
         value: task
       resolver: bundles
     when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
     - input: $(params.build-source-image)
       operator: in
       values:
@@ -370,7 +349,12 @@ spec:
       operator: in
       values:
       - "false"
-  - name: clair-scan
+  - matrix:
+      params:
+      - name: image-platform
+        value:
+        - $(params.build-platforms)
+    name: clair-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -392,7 +376,12 @@ spec:
       operator: in
       values:
       - "false"
-  - name: ecosystem-cert-preflight-checks
+  - matrix:
+      params:
+      - name: platform
+        value:
+        - $(params.build-platforms)
+    name: ecosystem-cert-preflight-checks
     params:
     - name: image-url
       value: $(tasks.build-image-index.results.IMAGE_URL)
@@ -412,7 +401,12 @@ spec:
       operator: in
       values:
       - "false"
-  - name: clamav-scan
+  - matrix:
+      params:
+      - name: image-arch
+        value:
+        - $(params.build-platforms)
+    name: clamav-scan
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
diff --git a/.tekton/fbc-builder.yaml b/.tekton/fbc-builder.yaml
index adbe282915..fb4a782f9a 100755
--- a/.tekton/fbc-builder.yaml
+++ b/.tekton/fbc-builder.yaml
@@ -1,7 +1,6 @@
 apiVersion: tekton.dev/v1
 kind: Pipeline
 metadata:
-  creationTimestamp:
   labels:
     pipelines.openshift.io/runtime: fbc
     pipelines.openshift.io/strategy: fbc
@@ -13,33 +12,37 @@ spec:
 
     _Uses `buildah` to create a container image. Its build-time tests are limited to verifying the included catalog and do not scan the image.
     This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-fbc-builder?tab=tags)_
-  finally:
-  - name: show-sbom
-    params:
-    - name: IMAGE_URL
-      value: $(tasks.build-image-index.results.IMAGE_URL)
-    taskRef:
-      params:
-      - name: name
-        value: show-sbom
-      - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:86c069cac0a669797e8049faa8aa4088e70ff7fcd579d5bdc37626a9e0488a05
-      - name: kind
-        value: task
-      resolver: bundles
   params:
   - default:
     - linux/x86_64
     - linux/arm64
     - linux/ppc64le
     - linux/s390x
-    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
+    description: List of platforms to build the container images on. The available
+      set of values is determined by the configuration of the multi-platform-controller.
     name: build-platforms
     type: array
   - default: "true"
     description: Build a source image.
     name: build-source-image
     type: string
+  - default: []
+    description: Array of opm command arguments
+    name: opm-args
+    type: array
+  - default: ""
+    description: OPM output path
+    name: opm-output-path
+    type: string
+  - default: ""
+    description: Optional. Relative path to a file (e.g., catalog-template.yml) in
+      which pullspecs should be updated before running opm.
+    name: file-to-update-pullspec
+    type: string
+  - default: .tekton/images-mirror-set.yaml
+    description: Optional, path for ImageDigestMirrorSet file. It defaults to '.tekton/images-mirror-set.yaml'.
+    name: idms-path
+    type: string
   - default: []
     description: Additional image tags
     name: additional-tags
@@ -55,17 +58,15 @@ spec:
     name: output-image
     type: string
   - default: .
-    description: Path to the source code of an application's component from where to build image.
+    description: Path to the source code of an application's component from where
+      to build image.
     name: path-context
     type: string
   - default: Dockerfile
-    description: Path to the Dockerfile inside the context specified by parameter path-context
+    description: Path to the Dockerfile inside the context specified by parameter
+      path-context
     name: dockerfile
     type: string
-  - default: "false"
-    description: Force rebuild image
-    name: rebuild
-    type: string
   - default: "false"
     description: Skip checks against built image
     name: skip-checks
@@ -75,16 +76,21 @@ spec:
     name: hermetic
     type: string
   - default: ""
-    description: Build dependencies to be prefetched by Cachi2
+    description: Build dependencies to be prefetched
     name: prefetch-input
     type: string
   - default: ""
-    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
+    description: Image tag expiration time, time values could be something like 1h,
+      2d, 3w for hours, days, and weeks, respectively.
     name: image-expires-after
+    type: string
   - default: "true"
     description: Add built image into an OCI image index
     name: build-image-index
     type: string
+  - default: "false"
+    description: Enable cache proxy configuration
+    name: enable-cache-proxy
   - default: []
     description: Array of --build-arg values ("arg=value" strings) for buildah
     name: build-args
@@ -107,6 +113,34 @@ spec:
     name: CHAINS-GIT_COMMIT
     value: $(tasks.clone-repository.results.commit)
   tasks:
+  - name: run-opm-command
+    params:
+    - name: OPM_ARGS
+      value:
+      - $(params.opm-args[*])
+    - name: OPM_OUTPUT_PATH
+      value: $(params.opm-output-path)
+    - name: FILE_TO_UPDATE_PULLSPEC
+      value: $(params.file-to-update-pullspec)
+    - name: IDMS_PATH
+      value: $(params.idms-path)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+    - name: ociStorage
+      value: $(params.output-image).opm
+    - name: ociArtifactExpiresAfter
+      value: $(params.image-expires-after)
+    runAfter:
+    - clone-repository
+    taskRef:
+      params:
+      - name: name
+        value: run-opm-command-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-run-opm-command-oci-ta:0.1@sha256:c79858b867713e44927438f6193c49004bf40bfd9248682f20c5a83ea2a9d2f1
+      - name: kind
+        value: task
+      resolver: bundles
   - name: apply-tags
     params:
     - name: ADDITIONAL_TAGS
@@ -128,12 +162,8 @@ spec:
       resolver: bundles
   - name: init
     params:
-    - name: image-url
-      value: $(params.output-image)
-    - name: rebuild
-      value: $(params.rebuild)
-    - name: skip-checks
-      value: $(params.skip-checks)
+    - name: enable-cache-proxy
+      value: $(params.enable-cache-proxy)
     taskRef:
       params:
       - name: name
@@ -164,11 +194,6 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
     workspaces:
     - name: basic-auth
       workspace: git-auth
@@ -177,13 +202,13 @@ spec:
     - name: input
       value: $(params.prefetch-input)
     - name: SOURCE_ARTIFACT
-      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+      value: $(tasks.run-opm-command.results.SOURCE_ARTIFACT)
     - name: ociStorage
       value: $(params.output-image).prefetch
     - name: ociArtifactExpiresAfter
       value: $(params.image-expires-after)
     runAfter:
-    - clone-repository
+    - run-opm-command
     taskRef:
       params:
       - name: name
@@ -224,6 +249,12 @@ spec:
       - $(params.build-args[*])
     - name: BUILD_ARGS_FILE
       value: $(params.build-args-file)
+    - name: SOURCE_URL
+      value: $(tasks.clone-repository.results.url)
+    - name: HTTP_PROXY
+      value: $(tasks.init.results.http-proxy)
+    - name: NO_PROXY
+      value: $(tasks.init.results.no-proxy)
     - name: SOURCE_ARTIFACT
       value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
     - name: CACHI2_ARTIFACT
@@ -241,19 +272,10 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: build-image-index
     params:
     - name: IMAGE
       value: $(params.output-image)
-    - name: COMMIT_SHA
-      value: $(tasks.clone-repository.results.commit)
-    - name: IMAGE_EXPIRES_AFTER
-      value: $(params.image-expires-after)
     - name: ALWAYS_BUILD_INDEX
       value: $(params.build-image-index)
     - name: IMAGES
@@ -270,11 +292,6 @@ spec:
       - name: kind
         value: task
       resolver: bundles
-    when:
-    - input: $(tasks.init.results.build)
-      operator: in
-      values:
-      - "true"
   - name: deprecated-base-image-check
     params:
     - name: IMAGE_URL
diff --git a/.tekton/serverless-bundle-135-pull-request.yaml b/.tekton/serverless-bundle-135-pull-request.yaml
index 98f021e503..8533cadea3 100755
--- a/.tekton/serverless-bundle-135-pull-request.yaml
+++ b/.tekton/serverless-bundle-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: olm-catalog/serverless-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-bundle-135-push.yaml b/.tekton/serverless-bundle-135-push.yaml
index a336a560c8..cf261565f8 100755
--- a/.tekton/serverless-bundle-135-push.yaml
+++ b/.tekton/serverless-bundle-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: olm-catalog/serverless-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-index-135-fbc-414-pull-request.yaml b/.tekton/serverless-index-135-fbc-414-pull-request.yaml
index 77a1b5bb00..a82cfe0854 100755
--- a/.tekton/serverless-index-135-fbc-414-pull-request.yaml
+++ b/.tekton/serverless-index-135-fbc-414-pull-request.yaml
@@ -23,12 +23,12 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.14
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
         - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry:v4.14
     - name: git-url
       value: '{{source_url}}'
@@ -43,6 +43,16 @@ spec:
         - linux/x86_64
     - name: revision
       value: '{{revision}}'
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.14/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.14/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.14/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-414-push.yaml b/.tekton/serverless-index-135-fbc-414-push.yaml
index 3b0da9fd46..f4e27a00ec 100755
--- a/.tekton/serverless-index-135-fbc-414-push.yaml
+++ b/.tekton/serverless-index-135-fbc-414-push.yaml
@@ -22,12 +22,12 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.14
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
         - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry:v4.14
     - name: git-url
       value: '{{source_url}}'
@@ -42,6 +42,16 @@ spec:
         - $(context.pipelineRun.uid)-{{revision}}
         - 1.35.2
         - latest
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.14/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.14/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.14/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-415-pull-request.yaml b/.tekton/serverless-index-135-fbc-415-pull-request.yaml
index 182d518887..6697b945eb 100755
--- a/.tekton/serverless-index-135-fbc-415-pull-request.yaml
+++ b/.tekton/serverless-index-135-fbc-415-pull-request.yaml
@@ -23,13 +23,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.15
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.15
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.15
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -43,6 +43,16 @@ spec:
         - linux/x86_64
     - name: revision
       value: '{{revision}}'
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.15/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.15/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.15/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-415-push.yaml b/.tekton/serverless-index-135-fbc-415-push.yaml
index f55eeeaa98..7194f7ed6a 100755
--- a/.tekton/serverless-index-135-fbc-415-push.yaml
+++ b/.tekton/serverless-index-135-fbc-415-push.yaml
@@ -22,13 +22,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.15
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.15
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.15
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -42,6 +42,16 @@ spec:
         - $(context.pipelineRun.uid)-{{revision}}
         - 1.35.2
         - latest
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.15/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.15/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.15/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-416-pull-request.yaml b/.tekton/serverless-index-135-fbc-416-pull-request.yaml
index a8344606b1..401f554aae 100755
--- a/.tekton/serverless-index-135-fbc-416-pull-request.yaml
+++ b/.tekton/serverless-index-135-fbc-416-pull-request.yaml
@@ -23,13 +23,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.16
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.16
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.16
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -43,6 +43,16 @@ spec:
         - linux/x86_64
     - name: revision
       value: '{{revision}}'
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.16/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.16/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.16/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-416-push.yaml b/.tekton/serverless-index-135-fbc-416-push.yaml
index 8eada5a317..415eb84b62 100755
--- a/.tekton/serverless-index-135-fbc-416-push.yaml
+++ b/.tekton/serverless-index-135-fbc-416-push.yaml
@@ -22,13 +22,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.16
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.16
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.16
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -42,6 +42,16 @@ spec:
         - $(context.pipelineRun.uid)-{{revision}}
         - 1.35.2
         - latest
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.16/catalog-template.yaml"
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.16/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.16/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-417-pull-request.yaml b/.tekton/serverless-index-135-fbc-417-pull-request.yaml
index f1c529365c..dbc4a8959d 100755
--- a/.tekton/serverless-index-135-fbc-417-pull-request.yaml
+++ b/.tekton/serverless-index-135-fbc-417-pull-request.yaml
@@ -23,13 +23,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.17
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.17
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.17
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -43,6 +43,17 @@ spec:
         - linux/x86_64
     - name: revision
       value: '{{revision}}'
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.17/catalog-template.yaml"
+        - --migrate-level=bundle-object-to-csv-metadata
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.17/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.17/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-417-push.yaml b/.tekton/serverless-index-135-fbc-417-push.yaml
index eb53955114..d371a66ab3 100755
--- a/.tekton/serverless-index-135-fbc-417-push.yaml
+++ b/.tekton/serverless-index-135-fbc-417-push.yaml
@@ -22,13 +22,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.17
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.17
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.17
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -42,6 +42,17 @@ spec:
         - $(context.pipelineRun.uid)-{{revision}}
         - 1.35.2
         - latest
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.17/catalog-template.yaml"
+        - --migrate-level=bundle-object-to-csv-metadata
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.17/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.17/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-418-pull-request.yaml b/.tekton/serverless-index-135-fbc-418-pull-request.yaml
index db2d109e28..ee5cb4fa56 100755
--- a/.tekton/serverless-index-135-fbc-418-pull-request.yaml
+++ b/.tekton/serverless-index-135-fbc-418-pull-request.yaml
@@ -23,13 +23,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.18
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.18
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.18
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -43,6 +43,17 @@ spec:
         - linux/x86_64
     - name: revision
       value: '{{revision}}'
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.18/catalog-template.yaml"
+        - --migrate-level=bundle-object-to-csv-metadata
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.18/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.18/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-index-135-fbc-418-push.yaml b/.tekton/serverless-index-135-fbc-418-push.yaml
index 9613fd9ec1..aded795e63 100755
--- a/.tekton/serverless-index-135-fbc-418-push.yaml
+++ b/.tekton/serverless-index-135-fbc-418-push.yaml
@@ -22,13 +22,13 @@ spec:
       value: ./olm-catalog/serverless-operator-index/v4.18
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
-        - OPM_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-ose-operator-registry-rhel9:v4.18
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
+        - OPM_IMAGE=registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.18
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
@@ -42,6 +42,17 @@ spec:
         - $(context.pipelineRun.uid)-{{revision}}
         - 1.35.2
         - latest
+    - name: opm-args
+      value:
+        - alpha
+        - render-template
+        - basic
+        - "olm-catalog/serverless-operator-index/v4.18/catalog-template.yaml"
+        - --migrate-level=bundle-object-to-csv-metadata
+    - name: opm-output-path
+      value: olm-catalog/serverless-operator-index/v4.18/catalog/serverless-operator/catalog.yaml
+    - name: file-to-update-pullspec
+      value: olm-catalog/serverless-operator-index/v4.18/catalog/serverless-operator/catalog.yaml
   pipelineRef:
     name: fbc-builder
   taskRunTemplate:
diff --git a/.tekton/serverless-ingress-135-pull-request.yaml b/.tekton/serverless-ingress-135-pull-request.yaml
index 025b18b234..11e9a49a26 100755
--- a/.tekton/serverless-ingress-135-pull-request.yaml
+++ b/.tekton/serverless-ingress-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: serving/ingress/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-ingress-135-push.yaml b/.tekton/serverless-ingress-135-push.yaml
index 6b5d3fbbe1..42b46b61eb 100755
--- a/.tekton/serverless-ingress-135-push.yaml
+++ b/.tekton/serverless-ingress-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: serving/ingress/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-kn-operator-135-pull-request.yaml b/.tekton/serverless-kn-operator-135-pull-request.yaml
index fd19b1a290..86d466276f 100755
--- a/.tekton/serverless-kn-operator-135-pull-request.yaml
+++ b/.tekton/serverless-kn-operator-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: knative-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-kn-operator-135-push.yaml b/.tekton/serverless-kn-operator-135-push.yaml
index e83ce9f9e0..5c228d1086 100755
--- a/.tekton/serverless-kn-operator-135-push.yaml
+++ b/.tekton/serverless-kn-operator-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: knative-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-metadata-webhook-135-pull-request.yaml b/.tekton/serverless-metadata-webhook-135-pull-request.yaml
index 2efdd811d8..02de4d2d31 100755
--- a/.tekton/serverless-metadata-webhook-135-pull-request.yaml
+++ b/.tekton/serverless-metadata-webhook-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: serving/metadata-webhook/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-metadata-webhook-135-push.yaml b/.tekton/serverless-metadata-webhook-135-push.yaml
index d797a0097d..291cc22d3a 100755
--- a/.tekton/serverless-metadata-webhook-135-push.yaml
+++ b/.tekton/serverless-metadata-webhook-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: serving/metadata-webhook/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-must-gather-135-pull-request.yaml b/.tekton/serverless-must-gather-135-pull-request.yaml
index d4a81f4af0..f2e8be7e9a 100755
--- a/.tekton/serverless-must-gather-135-pull-request.yaml
+++ b/.tekton/serverless-must-gather-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: must-gather/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-must-gather-135-push.yaml b/.tekton/serverless-must-gather-135-push.yaml
index e840c8c4d2..48698d946c 100755
--- a/.tekton/serverless-must-gather-135-push.yaml
+++ b/.tekton/serverless-must-gather-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: must-gather/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-openshift-kn-operator-135-pull-request.yaml b/.tekton/serverless-openshift-kn-operator-135-pull-request.yaml
index abc37aba2e..f729b48587 100755
--- a/.tekton/serverless-openshift-kn-operator-135-pull-request.yaml
+++ b/.tekton/serverless-openshift-kn-operator-135-pull-request.yaml
@@ -21,12 +21,12 @@ spec:
       value: openshift-knative-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic
diff --git a/.tekton/serverless-openshift-kn-operator-135-push.yaml b/.tekton/serverless-openshift-kn-operator-135-push.yaml
index 21c5ee4d3c..7b633c374e 100755
--- a/.tekton/serverless-openshift-kn-operator-135-push.yaml
+++ b/.tekton/serverless-openshift-kn-operator-135-push.yaml
@@ -20,12 +20,12 @@ spec:
       value: openshift-knative-operator/Dockerfile
     - name: build-args
       value:
-        - VERSION=1.35.1
-        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
-        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.22
+        - VERSION=1.35.2
+        - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25
         - GO_RUNTIME=registry.access.redhat.com/ubi8/ubi-minimal
         - JAVA_BUILDER=registry.access.redhat.com/ubi8/openjdk-21
         - JAVA_RUNTIME=registry.access.redhat.com/ubi8/openjdk-21-runtime
+        - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts:v4.14
     - name: git-url
       value: '{{source_url}}'
     - name: hermetic