diff --git a/.konflux/olm-catalog/bundle/kodata/tekton-chains/0.0.0-nightly/00-chains.yaml b/.konflux/olm-catalog/bundle/kodata/tekton-chains/0.0.0-nightly/00-chains.yaml
index 466ce90d8..e99175dad 100644
--- a/.konflux/olm-catalog/bundle/kodata/tekton-chains/0.0.0-nightly/00-chains.yaml
+++ b/.konflux/olm-catalog/bundle/kodata/tekton-chains/0.0.0-nightly/00-chains.yaml
@@ -63,8 +63,8 @@ metadata:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-chains
-    pipeline.tekton.dev/release: "v20241217-5fc7735e5a"
-    version: "v20241217-5fc7735e5a"
+    pipeline.tekton.dev/release: "v20241219-5fc7735e5a"
+    version: "v20241219-5fc7735e5a"
 spec:
   replicas: 1
   selector:
@@ -84,13 +84,13 @@ spec:
         app.kubernetes.io/instance: default
         app.kubernetes.io/part-of: tekton-chains
         # # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: "v20241217-5fc7735e5a"
-        version: "v20241217-5fc7735e5a"
+        pipeline.tekton.dev/release: "v20241219-5fc7735e5a"
+        version: "v20241219-5fc7735e5a"
     spec:
       serviceAccountName: tekton-chains-controller
       containers:
         - name: tekton-chains-controller
-          image: ghcr.io/tektoncd/chains/controller-92006fd957c0afd31de6a40b3e33b39f:v20241217-5fc7735e5a@sha256:cac167c9d4294977ff9e0c1b199e9da8249cfa255d73fd0c13849043b80b48bc
+          image: ghcr.io/tektoncd/chains/controller-92006fd957c0afd31de6a40b3e33b39f:v20241219-5fc7735e5a@sha256:5a6ad4108551996dc4936d5cf0d10aa18055fc138d444d979c8f9d735248ee8d
           volumeMounts:
             - name: signing-secrets
               mountPath: /etc/signing-secrets
@@ -342,7 +342,7 @@ data:
   # this ConfigMap such that even if we don't have access to
   # other resources in the namespace, we can still access
   # this ConfigMap.
-  version: "v20241217-5fc7735e5a"
+  version: "v20241219-5fc7735e5a"
 
 ---
 # Copyright 2023 Tekton Authors LLC
diff --git a/.konflux/olm-catalog/bundle/kodata/tekton-pipeline/0.0.0-nightly/00-pipelines.yaml b/.konflux/olm-catalog/bundle/kodata/tekton-pipeline/0.0.0-nightly/00-pipelines.yaml
index e0fc4c712..a75c8ef59 100644
--- a/.konflux/olm-catalog/bundle/kodata/tekton-pipeline/0.0.0-nightly/00-pipelines.yaml
+++ b/.konflux/olm-catalog/bundle/kodata/tekton-pipeline/0.0.0-nightly/00-pipelines.yaml
@@ -584,8 +584,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -639,8 +639,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -707,8 +707,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -786,8 +786,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -999,8 +999,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -1072,8 +1072,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -1154,8 +1154,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   preserveUnknownFields: false
@@ -1264,8 +1264,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
-    version: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
+    version: "v20241219-1d36a66097"
 spec:
   group: tekton.dev
   versions:
@@ -1316,7 +1316,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
 # The data is populated at install time.
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -1327,7 +1327,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
 webhooks:
   - admissionReviewVersions: ["v1"]
     clientConfig:
@@ -1346,7 +1346,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
 webhooks:
   - admissionReviewVersions: ["v1"]
     clientConfig:
@@ -1365,7 +1365,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
 webhooks:
   - admissionReviewVersions: ["v1"]
     clientConfig:
@@ -1835,7 +1835,7 @@ data:
   # this ConfigMap such that even if we don't have access to
   # other resources in the namespace we still can have access to
   # this ConfigMap.
-  version: "v20241217-c2c3085de6"
+  version: "v20241219-1d36a66097"
 
 ---
 # Copyright 2020 Tekton Authors LLC
@@ -2266,12 +2266,12 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
 spec:
   replicas: 1
   selector:
@@ -2286,13 +2286,13 @@ spec:
         app.kubernetes.io/name: controller
         app.kubernetes.io/component: controller
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c2c3085de6"
+        app.kubernetes.io/version: "v20241219-1d36a66097"
         app.kubernetes.io/part-of: tekton-pipelines
         # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+        pipeline.tekton.dev/release: "v20241219-1d36a66097"
         # labels below are related to istio and should not be used for resource lookup
         app: tekton-pipelines-controller
-        version: "v20241217-c2c3085de6"
+        version: "v20241219-1d36a66097"
     spec:
       affinity:
         nodeAffinity:
@@ -2306,11 +2306,11 @@ spec:
       serviceAccountName: tekton-pipelines-controller
       containers:
         - name: tekton-pipelines-controller
-          image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v20241217-c2c3085de6@sha256:2035c52f6e87e44491ba5c4ba24eeef8aedbc02bc01f34ad977d2dd96530b4ce
+          image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v20241219-1d36a66097@sha256:e26f55871c2397e6a13dd11f38804d4d55251c8df2afb21fe21271d8c2fbfab0
           args: [
             # These images are built on-demand by `ko resolve` and are replaced
             # by image references by digest.
-            "-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v20241217-c2c3085de6@sha256:c2416132ea3ae62224b28e107da6ce976adeaff00bf94180373be0d84c5a3fab", "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v20241217-c2c3085de6@sha256:7deb2b7b06099480243af4629d6576396a039ac2a8f41b9891ec263fa382aa92", "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v20241217-c2c3085de6@sha256:8b42cbd6f4d4282886ef42708b5763528c448ba3709d734c7d3656ae26cb82e7", "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v20241217-c2c3085de6@sha256:08374670ee463e6f307baf2b7e555d2baffc49b513e137264e330b03383f259b",
+            "-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v20241219-1d36a66097@sha256:c31370b77d22f08206548334c808659b382f12c77cba00ffc0fcb9e462ccb14d", "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v20241219-1d36a66097@sha256:535c9ad6f6c8f2c05b25921fdcaf1e40ad8c90b0b7534b558e9367e3c125ec5c", "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v20241219-1d36a66097@sha256:2e58477fc8ac3a6d60b49503529e5087e5767baed672acee7575a111a97e1209", "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v20241219-1d36a66097@sha256:128b1ec8d962a5c6dd2150ae476af445278651c1b2c765890c3608bc6673f68d",
             # The shell image must allow root in order to create directories and copy files to PVCs.
             # cgr.dev/chainguard/busybox as of April 14 2022
             # image shall not contains tag, so it will be supported on a runtime like cri-o
@@ -2399,13 +2399,13 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
     app: tekton-pipelines-controller
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
   name: tekton-pipelines-controller
   namespace: tekton-pipelines
 spec:
@@ -2449,12 +2449,12 @@ metadata:
     app.kubernetes.io/name: events
     app.kubernetes.io/component: events
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
 spec:
   replicas: 1
   selector:
@@ -2469,13 +2469,13 @@ spec:
         app.kubernetes.io/name: events
         app.kubernetes.io/component: events
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c2c3085de6"
+        app.kubernetes.io/version: "v20241219-1d36a66097"
         app.kubernetes.io/part-of: tekton-pipelines
         # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+        pipeline.tekton.dev/release: "v20241219-1d36a66097"
         # labels below are related to istio and should not be used for resource lookup
         app: tekton-events-controller
-        version: "v20241217-c2c3085de6"
+        version: "v20241219-1d36a66097"
     spec:
       affinity:
         nodeAffinity:
@@ -2489,7 +2489,7 @@ spec:
       serviceAccountName: tekton-events-controller
       containers:
         - name: tekton-events-controller
-          image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v20241217-c2c3085de6@sha256:91484095bcee6ff43c6ad2fa0577a63d13e0b69243e0e14ee9ad6b016b49552c
+          image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v20241219-1d36a66097@sha256:198274e68a2cd7b950093a344df65bf641f24611140a2860cabfbbd78fa6a6f6
           args: []
           volumeMounts:
             - name: config-logging
@@ -2566,13 +2566,13 @@ metadata:
     app.kubernetes.io/name: events
     app.kubernetes.io/component: events
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
     app: tekton-events-controller
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
   name: tekton-events-controller
   namespace: tekton-pipelines
 spec:
@@ -3179,12 +3179,12 @@ metadata:
     app.kubernetes.io/name: resolvers
     app.kubernetes.io/component: resolvers
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
 spec:
   replicas: 1
   selector:
@@ -3199,13 +3199,13 @@ spec:
         app.kubernetes.io/name: resolvers
         app.kubernetes.io/component: resolvers
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c2c3085de6"
+        app.kubernetes.io/version: "v20241219-1d36a66097"
         app.kubernetes.io/part-of: tekton-pipelines
         # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+        pipeline.tekton.dev/release: "v20241219-1d36a66097"
         # labels below are related to istio and should not be used for resource lookup
         app: tekton-pipelines-resolvers
-        version: "v20241217-c2c3085de6"
+        version: "v20241219-1d36a66097"
     spec:
       affinity:
         podAntiAffinity:
@@ -3222,7 +3222,7 @@ spec:
       serviceAccountName: tekton-pipelines-resolvers
       containers:
         - name: controller
-          image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v20241217-c2c3085de6@sha256:86dd1c362e10e0feb7b1c44ee57115a2e213062b1d3f4007467e27676dbb7d9d
+          image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v20241219-1d36a66097@sha256:00bc2f465b775c2790c55136edac591752132e545006bef72628c269a59e7b98
           resources:
             requests:
               cpu: 100m
@@ -3294,13 +3294,13 @@ metadata:
     app.kubernetes.io/name: resolvers
     app.kubernetes.io/component: resolvers
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
     app: tekton-pipelines-remote-resolvers
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
   name: tekton-pipelines-remote-resolvers
   namespace: tekton-pipelines-resolvers
 spec:
@@ -3344,12 +3344,12 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
 spec:
   minReplicas: 1
   maxReplicas: 5
@@ -3392,12 +3392,12 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
 spec:
   selector:
     matchLabels:
@@ -3411,13 +3411,13 @@ spec:
         app.kubernetes.io/name: webhook
         app.kubernetes.io/component: webhook
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c2c3085de6"
+        app.kubernetes.io/version: "v20241219-1d36a66097"
         app.kubernetes.io/part-of: tekton-pipelines
         # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+        pipeline.tekton.dev/release: "v20241219-1d36a66097"
         # labels below are related to istio and should not be used for resource lookup
         app: tekton-pipelines-webhook
-        version: "v20241217-c2c3085de6"
+        version: "v20241219-1d36a66097"
     spec:
       affinity:
         nodeAffinity:
@@ -3444,7 +3444,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v20241217-c2c3085de6@sha256:08f6a420d1b078da60c7ae5d805ee719f5143d1d2f4a31f5aa09184d4233b2cd
+          image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v20241219-1d36a66097@sha256:4b1c353e7b8149ba824ba91a226efd4109025a009ce02317898e410d9016e931
           # Resource request required for autoscaler to take any action for a metric
           resources:
             requests:
@@ -3539,13 +3539,13 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c2c3085de6"
+    app.kubernetes.io/version: "v20241219-1d36a66097"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: "v20241217-c2c3085de6"
+    pipeline.tekton.dev/release: "v20241219-1d36a66097"
     # labels below are related to istio and should not be used for resource lookup
     app: tekton-pipelines-webhook
-    version: "v20241217-c2c3085de6"
+    version: "v20241219-1d36a66097"
   name: tekton-pipelines-webhook
   namespace: tekton-pipelines
 spec:
diff --git a/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/00-triggers.yaml b/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/00-triggers.yaml
index 0b0c9e9e6..3b239e487 100644
--- a/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/00-triggers.yaml
+++ b/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/00-triggers.yaml
@@ -398,8 +398,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Cluster
@@ -454,8 +454,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Cluster
@@ -524,8 +524,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Namespaced
@@ -630,8 +630,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Namespaced
@@ -686,8 +686,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Namespaced
@@ -758,8 +758,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Namespaced
@@ -832,8 +832,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
-    version: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
+    version: "v20241219-ed98593e35"
 spec:
   group: triggers.tekton.dev
   scope: Namespaced
@@ -908,7 +908,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 # The data is populated at install time.
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -919,7 +919,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 webhooks:
   - admissionReviewVersions:
       - v1
@@ -939,7 +939,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 webhooks:
   - admissionReviewVersions:
       - v1
@@ -959,7 +959,7 @@ metadata:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 webhooks:
   - admissionReviewVersions:
       - v1
@@ -1167,7 +1167,7 @@ data:
   # this ConfigMap such that even if we don't have access to
   # other resources in the namespace we still can have access to
   # this ConfigMap.
-  version: "v20241217-c6d2a8dfae"
+  version: "v20241219-ed98593e35"
 
 ---
 # Copyright 2023 Tekton Authors LLC
@@ -1412,11 +1412,11 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
     app: tekton-triggers-controller
-    version: "v20241217-c6d2a8dfae"
+    version: "v20241219-ed98593e35"
   name: tekton-triggers-controller
   namespace: tekton-pipelines
 spec:
@@ -1455,10 +1455,10 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
     # tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 spec:
   replicas: 1
   selector:
@@ -1473,18 +1473,18 @@ spec:
         app.kubernetes.io/name: controller
         app.kubernetes.io/component: controller
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+        app.kubernetes.io/version: "v20241219-ed98593e35"
         app.kubernetes.io/part-of: tekton-triggers
         app: tekton-triggers-controller
-        triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+        triggers.tekton.dev/release: "v20241219-ed98593e35"
         # version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-        version: "v20241217-c6d2a8dfae"
+        version: "v20241219-ed98593e35"
     spec:
       serviceAccountName: tekton-triggers-controller
       containers:
         - name: tekton-triggers-controller
-          image: "ghcr.io/tektoncd/triggers/controller-f656ca31de179ab913fa76abc255c315:v20241217-c6d2a8dfae@sha256:09bb0ecd8f5f42801e6913480f901aa46f4b4ce703aa13f8fea01cdb948cda3e"
-          args: ["-logtostderr", "-stderrthreshold", "INFO", "-el-image", "ghcr.io/tektoncd/triggers/eventlistenersink-7ad1faa98cddbcb0c24990303b220bb8:v20241217-c6d2a8dfae@sha256:e4a4ef308ccd7e17c88d7c3cdb1c065413db46d1154bd6af4b307806e0c0789c", "-el-port", "8080", "-el-security-context=true", "-el-read-only-root-filesystem=true", "-el-events", "disable", "-el-readtimeout", "5", "-el-writetimeout", "40", "-el-idletimeout", "120", "-el-timeouthandler", "30", "-el-httpclient-readtimeout", "30", "-el-httpclient-keep-alive", "30", "-el-httpclient-tlshandshaketimeout", "10", "-el-httpclient-responseheadertimeout", "10", "-el-httpclient-expectcontinuetimeout", "1", "-period-seconds", "10", "-failure-threshold", "3"]
+          image: "ghcr.io/tektoncd/triggers/controller-f656ca31de179ab913fa76abc255c315:v20241219-ed98593e35@sha256:f517a359d1c403f51649e8a0514763f9bc9af98837ab905fd3c37ec4166dd976"
+          args: ["-logtostderr", "-stderrthreshold", "INFO", "-el-image", "ghcr.io/tektoncd/triggers/eventlistenersink-7ad1faa98cddbcb0c24990303b220bb8:v20241219-ed98593e35@sha256:352de2911c9cefa004eab8570b387b30444c313a55b9e20623f9ea871303ddb1", "-el-port", "8080", "-el-security-context=true", "-el-read-only-root-filesystem=true", "-el-events", "disable", "-el-readtimeout", "5", "-el-writetimeout", "40", "-el-idletimeout", "120", "-el-timeouthandler", "30", "-el-httpclient-readtimeout", "30", "-el-httpclient-keep-alive", "30", "-el-httpclient-tlshandshaketimeout", "10", "-el-httpclient-responseheadertimeout", "10", "-el-httpclient-expectcontinuetimeout", "1", "-period-seconds", "10", "-failure-threshold", "3"]
           env:
             - name: SYSTEM_NAMESPACE
               valueFrom:
@@ -1539,11 +1539,11 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
     app: tekton-triggers-webhook
-    version: "v20241217-c6d2a8dfae"
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    version: "v20241219-ed98593e35"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 spec:
   ports:
     - name: https-webhook
@@ -1579,10 +1579,10 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/component: webhook
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
     # tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 spec:
   replicas: 1
   selector:
@@ -1597,19 +1597,19 @@ spec:
         app.kubernetes.io/name: webhook
         app.kubernetes.io/component: webhook
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+        app.kubernetes.io/version: "v20241219-ed98593e35"
         app.kubernetes.io/part-of: tekton-triggers
         app: tekton-triggers-webhook
-        triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+        triggers.tekton.dev/release: "v20241219-ed98593e35"
         # version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-        version: "v20241217-c6d2a8dfae"
+        version: "v20241219-ed98593e35"
     spec:
       serviceAccountName: tekton-triggers-webhook
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: "ghcr.io/tektoncd/triggers/webhook-dd1edc925ee1772a9f76e2c1bc291ef6:v20241217-c6d2a8dfae@sha256:f7ebd42dc74654a396fab9479aeaf00fe61dd6885fab8be07a86adbaf14aff80"
+          image: "ghcr.io/tektoncd/triggers/webhook-dd1edc925ee1772a9f76e2c1bc291ef6:v20241219-ed98593e35@sha256:aaa81a77f28416974e05a5e46290ad36e92ae51c220a4dca26d6172b3867154e"
           env:
             - name: SYSTEM_NAMESPACE
               valueFrom:
diff --git a/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/01-interceptors.yaml b/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/01-interceptors.yaml
index 4b7c6ba8c..20074f761 100644
--- a/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/01-interceptors.yaml
+++ b/.konflux/olm-catalog/bundle/kodata/tekton-trigger/0.0.0-nightly/01-interceptors.yaml
@@ -22,7 +22,7 @@ metadata:
     app.kubernetes.io/component: interceptors
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 # The data is populated at install time.
 
 ---
@@ -49,10 +49,10 @@ metadata:
     app.kubernetes.io/name: core-interceptors
     app.kubernetes.io/component: interceptors
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
     # tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
 spec:
   replicas: 1
   selector:
@@ -67,17 +67,17 @@ spec:
         app.kubernetes.io/name: core-interceptors
         app.kubernetes.io/component: interceptors
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+        app.kubernetes.io/version: "v20241219-ed98593e35"
         app.kubernetes.io/part-of: tekton-triggers
         app: tekton-triggers-core-interceptors
-        triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+        triggers.tekton.dev/release: "v20241219-ed98593e35"
         # version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-        version: "v20241217-c6d2a8dfae"
+        version: "v20241219-ed98593e35"
     spec:
       serviceAccountName: tekton-triggers-core-interceptors
       containers:
         - name: tekton-triggers-core-interceptors
-          image: "ghcr.io/tektoncd/triggers/interceptors-3176d6a3f314c3655b30bfd36e421dd5:v20241217-c6d2a8dfae@sha256:36a45a097e02aa79a6b82ef20e08d7df54244a2bf32629a545e6753d8cc6715b"
+          image: "ghcr.io/tektoncd/triggers/interceptors-3176d6a3f314c3655b30bfd36e421dd5:v20241219-ed98593e35@sha256:5a8494b15fac4ff7726694a1825126d412dbf445957ac7e4013992d4a19437d8"
           ports:
             - containerPort: 8443
           args: ["-logtostderr", "-stderrthreshold", "INFO"]
@@ -125,11 +125,11 @@ metadata:
     app.kubernetes.io/name: tekton-triggers-core-interceptors
     app.kubernetes.io/component: interceptors
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: "v20241217-c6d2a8dfae"
+    app.kubernetes.io/version: "v20241219-ed98593e35"
     app.kubernetes.io/part-of: tekton-triggers
-    triggers.tekton.dev/release: "v20241217-c6d2a8dfae"
+    triggers.tekton.dev/release: "v20241219-ed98593e35"
     app: tekton-triggers-core-interceptors
-    version: "v20241217-c6d2a8dfae"
+    version: "v20241219-ed98593e35"
   name: tekton-triggers-core-interceptors
   namespace: tekton-pipelines
 spec:
diff --git a/head b/head
index b7ab18fee..61ae9fa31 100644
--- a/head
+++ b/head
@@ -1 +1 @@
-b9a5614346b3c48e58c125b9093fe25e0a6b1eb4
+a98ed25f242ba10da27a48fc2cd876a290656701
diff --git a/upstream/DEVELOPMENT.md b/upstream/DEVELOPMENT.md
index 3307780b6..780455cc8 100644
--- a/upstream/DEVELOPMENT.md
+++ b/upstream/DEVELOPMENT.md
@@ -65,7 +65,7 @@ This project extends Kubernetes (aka
 - Install via
   [official installation docs](https://github.com/tektoncd/pipeline/blob/master/docs/install.md)
   or continue though [getting started for development](#getting-started)
-- [Tekton Pipeline "Hello World" tutorial](https://github.com/tektoncd/pipeline/blob/master/docs/tutorial.md) -
+- [Tekton Pipeline "Hello World" tutorial](https://tekton.dev/docs/getting-started) -
   Define `Tasks`, `Pipelines`, and `PipelineResources`, see what happens when
   they are run
 
diff --git a/upstream/tekton/build-publish-images-manifests.yaml b/upstream/tekton/build-publish-images-manifests.yaml
index 5913f1810..16cec0608 100644
--- a/upstream/tekton/build-publish-images-manifests.yaml
+++ b/upstream/tekton/build-publish-images-manifests.yaml
@@ -10,6 +10,9 @@ spec:
   - name: images
     description: List of cmd/<kubeDistro>/* paths to be published as images
     default: "operator webhook proxy-webhook"
+  - name: koExtraArgs
+    description: Extra args to be passed to ko
+    default: "--preserve-import-paths"
   - name: versionTag
     description: The vX.Y.Z version that the artifacts should be tagged with (including `v`)
   - name: imageRegistry
@@ -20,6 +23,9 @@ spec:
   - name: imageRegistryRegions
     description: The target image registry regions
     default: "us eu asia"
+  - name: imageRegistryUser
+    description: Username to be used to login to the container registry
+    default: "_json_key"
   - name: releaseAsLatest
     description: Whether to tag and publish this release as Pipelines' latest
     default: "true"
@@ -54,6 +60,8 @@ spec:
       value: "$(workspaces.release-secret.path)/$(params.serviceAccountPath)"
     - name: CONTAINER_REGISTRY
       value: "$(params.imageRegistry)/$(params.imageRegistryPath)"
+    - name: CONTAINER_REGISTRY_USER
+      value: "$(params.imageRegistryUser)"
     - name: REGIONS
       value: "$(params.imageRegistryRegions)"
     - name: OUTPUT_RELEASE_DIR
@@ -62,17 +70,19 @@ spec:
       value: "$(params.kubeDistro)"
     - name: FILENAME_PREFIX
       value: "$(params.releaseFilePrefix)"
+    - name: KO_EXTRA_ARGS
+      value: "$(params.koExtraArgs)"
   steps:
 
   - name: container-registy-auth
-    image: gcr.io/go-containerregistry/crane:debug@sha256:ff0e08eeae8097d28b2381c7f7123bf542757abc68d11bff58fb882b72843785
+    image: cgr.dev/chainguard/crane:latest-dev@sha256:6fc6fcdeb173c7951f038e6a7b230f586c1be05a011d9e6f9db6c614ec412c2f
     script: |
-      #!/busybox/sh
+      #!/bin/sh
       set -ex
 
       # Login to the container registry
-      DOCKER_CONFIG=$(cat ${CONTAINER_REGISTY_CREDENTIALS} | \
-        crane auth login -u _json_key --password-stdin $(params.imageRegistry) 2>&1 | \
+      DOCKER_CONFIG=$(cat ${CONTAINER_REGISTRY_CREDENTIALS} | \
+        crane auth login -u ${CONTAINER_REGISTRY_USER} --password-stdin $(params.imageRegistry) 2>&1 | \
         sed 's,^.*logged in via \(.*\)$,\1,g')
 
       # Auth with account credentials for all regions.
@@ -81,10 +91,10 @@ spec:
         HOSTNAME=${region}.$(params.imageRegistry)
         cat ${CONTAINER_REGISTY_CREDENTIALS} | crane auth login -u _json_key --password-stdin ${HOSTNAME}
       done
-      cp ${DOCKER_CONFIG} /workspace/docker-config.json
+      cp ${DOCKER_CONFIG} /workspace/${KUBE_DISTRO}-docker-config.json
 
   - name: run-kustomize-ko
-    image: gcr.io/tekton-releases/dogfooding/ko-gcloud:v20240920-6c2a999d36@sha256:1756ca55a09b360028695792e638a7cc366292d7aef44c926a8cb765085664c8
+    image: ghcr.io/tektoncd/plumbing/ko-gcloud:v20240920-6c2a999d36@sha256:1756ca55a09b360028695792e638a7cc366292d7aef44c926a8cb765085664c8
     env:
     - name: KO_DOCKER_REPO
       value: $(params.imageRegistry)/$(params.imageRegistryPath)
@@ -99,7 +109,7 @@ spec:
       # Setup docker-auth
       DOCKER_CONFIG=~/.docker
       mkdir -p ${DOCKER_CONFIG}
-      cp /workspace/docker-config.json ${DOCKER_CONFIG}/config.json
+      cp /workspace/${KUBE_DISTRO}-docker-config.json ${DOCKER_CONFIG}/config.json
 
       # Change to directory with our .ko.yaml
       cd ${PROJECT_ROOT}
@@ -127,31 +137,62 @@ spec:
       # Publish images and create release.yaml
       mkdir -p $OUTPUT_RELEASE_DIR
 
-      kustomize build ${PROJECT_ROOT}/config/${KUBE_DISTRO}/overlays/default | ko resolve --platform=$(params.platforms) --preserve-import-paths -t $(params.versionTag) -f - > $OUTPUT_RELEASE_DIR/${FILENAME_PREFIX}release.yaml
+      # Make a local git tag to make git status happy :)
+      # The real "tagging" will happen with the "create-release" pipeline.
+      git tag $(params.versionTag)-${KUBE_DISTRO}
+
+      kustomize build ${PROJECT_ROOT}/config/${KUBE_DISTRO}/overlays/default | \
+        ko resolve \
+          --image-label=org.opencontainers.image.source=https://$(params.package) \
+          --platform=$(params.platforms) ${KO_EXTRA_ARGS} \
+          -t $(params.versionTag) \
+          -f - > $OUTPUT_RELEASE_DIR/${FILENAME_PREFIX}release.yaml
+
       # Publish images and create release.notags.yaml
       # This is useful if your container runtime doesn't support the `image-reference:tag@digest` notation
       # This is currently the case for `cri-o` (and most likely others)
-      kustomize build ${PROJECT_ROOT}/config/${KUBE_DISTRO}/overlays/default | ko resolve --platform=$(params.platforms) --preserve-import-paths -f - > $OUTPUT_RELEASE_DIR/${FILENAME_PREFIX}release.notags.yaml
+      kustomize build ${PROJECT_ROOT}/config/${KUBE_DISTRO}/overlays/default | \
+        ko resolve \
+          --image-label=org.opencontainers.image.source=https://$(params.package) \
+          --platform=$(params.platforms) ${KO_EXTRA_ARGS} \
+          -f - > $OUTPUT_RELEASE_DIR/${FILENAME_PREFIX}release.notags.yaml
 
   - name: koparse
-    image: gcr.io/tekton-releases/dogfooding/koparse:v20240910-ec3cf3c749@sha256:5e8a522fc1e587fc00b69a6d73e0bfdf7a29ca143537a5542eb224680d2dbf2f
+    image: ghcr.io/tektoncd/plumbing/koparse@sha256:194c2ab9dce5f778ed757af13c626d6b85f15452e2c2902c79b0d0f5a0adf4d1
     script: |
       set -ex
 
-      IMAGES_PATH=${CONTAINER_REGISTRY}/$(params.package)
+      # Find "--preserve-import-paths" in a list of args
+      function find_preserve_import_path() {
+        for arg in $@; do
+          if [[ "$arg" == "--preserve-import-paths" ]]; then
+            return 0
+          fi
+        done
+        return 1
+      }
+
+      # If "--preserve-import-paths" is used, include "package" in the expected path
+      find_preserve_import_path \
+        $(echo $KO_EXTRA_ARGS) && \
+        PRESERVE_IMPORT_PATH="--preserve-path" || \
+        PRESERVE_IMPORT_PATH="--no-preserve-path"
 
       for cmd in $(params.images)
       do
-        IMAGES="${IMAGES} ${IMAGES_PATH}/cmd/${KUBE_DISTRO}/${cmd}:$(params.versionTag)"
+        IMAGES="${IMAGES} $(params.package)/cmd/${KUBE_DISTRO}/${cmd}:$(params.versionTag)"
       done
 
       # Parse the built images from the release.yaml generated by ko
       koparse \
         --path $OUTPUT_RELEASE_DIR/${FILENAME_PREFIX}release.yaml \
-        --base ${IMAGES_PATH} --images ${IMAGES} > /workspace/built_images
+        --base $(params.package) \
+        --container-registry ${CONTAINER_REGISTRY} \
+        --images ${IMAGES} \
+        ${PRESERVE_IMPORT_PATH} > /workspace/built_images
 
   - name: tag-images
-    image: gcr.io/go-containerregistry/crane:debug@sha256:ff0e08eeae8097d28b2381c7f7123bf542757abc68d11bff58fb882b72843785
+    image: cgr.dev/chainguard/crane:latest-dev@sha256:6fc6fcdeb173c7951f038e6a7b230f586c1be05a011d9e6f9db6c614ec412c2f
     script: |
       #!/busybox/sh
       set -ex
@@ -159,9 +200,7 @@ spec:
       # Setup docker-auth
       DOCKER_CONFIG=~/.docker
       mkdir -p ${DOCKER_CONFIG}
-      cp /workspace/docker-config.json ${DOCKER_CONFIG}/config.json
-
-      REGIONS="us eu asia"
+      cp /workspace/${KUBE_DISTRO}-docker-config.json ${DOCKER_CONFIG}/config.json
 
       # Tag the images and put them in all the regions
       for IMAGE in $(cat /workspace/built_images)
diff --git a/upstream/tekton/operator-release-pipeline.yaml b/upstream/tekton/operator-release-pipeline.yaml
index f594a0c27..ed13d14a7 100644
--- a/upstream/tekton/operator-release-pipeline.yaml
+++ b/upstream/tekton/operator-release-pipeline.yaml
@@ -16,6 +16,12 @@ spec:
   - name: imageRegistryPath
     description: The path (project) in the image registry
     default: tekton-releases
+  - name: imageRegistryRegions
+    description: The target image registry regions
+    default: "us eu asia"
+  - name: imageRegistryUser
+    description: The user for the image registry credentials
+    default: _json_key
   - name: versionTag
     description: The X.Y.Z version that the artifacts should be tagged with
   - name: releaseBucket
@@ -27,8 +33,16 @@ spec:
   - name: platforms
     description: Platforms to publish for the images (e.g. linux/amd64,linux/arm64)
     default: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
+  - name: koExtraArgs
+    description: Extra args to be passed to ko
+    default: "--preserve-import-paths"
   - name: serviceAccountPath
     description: The path to the service account file within the release-secret workspace
+  - name: serviceAccountImagesPath
+    description: The path to the service account file or credentials within the release-images-secret workspace
+  - name: runTests
+    description: If set to something other than "true", skip the build and test tasks
+    default: "true"
   - name: kubeDistros
     description: The kubernetes platform (e.g. kubernetes or openshift ... ) targeted by a pipeline run
     default: "kubernetes openshift"
@@ -40,6 +54,8 @@ spec:
     description: The workspace where the repo will be cloned.
   - name: release-secret
     description: The secret that contains a service account authorized to push to the imageRegistry and to the output bucket
+  - name: release-images-secret
+    description: The secret that contains a service account authorized to push to the imageRegistry
   results:
   - name: commit-sha
     description: the sha of the commit that was released
@@ -59,11 +75,16 @@ spec:
   tasks:
   - name: git-clone
     taskRef:
-      name: git-clone
+      resolver: hub
+      params:
+        - name: name
+          value: git-clone
+        - name: version
+          value: "0.7"
     workspaces:
-    - name: output
-      workspace: workarea
-      subpath: git
+      - name: output
+        workspace: workarea
+        subpath: git
     params:
     - name: url
       value: https://$(params.package)
@@ -73,7 +94,16 @@ spec:
     runAfter:
     - git-clone
     taskRef:
-      name: prerelease-checks
+      resolver: git
+      params:
+      - name: repo
+        value: plumbing
+      - name: org
+        value: tektoncd
+      - name: revision
+        value: aeed19e5a36f335ebfdc4b96fa78d1ce5bb4f7b8
+      - name: pathInRepo
+        value: tekton/resources/release/base/prerelease_checks.yaml
     params:
     - name: package
       value: $(params.package)
@@ -88,8 +118,17 @@ spec:
   - name: unit-tests
     runAfter:
     - precheck
+    when:
+    - cel: "'$(params.runTests)' == 'true'"
     taskRef:
-      name: golang-test
+      resolver: bundles
+      params:
+      - name: bundle
+        value: ghcr.io/tektoncd/catalog/upstream/tasks/golang-test:0.2
+      - name: name
+        value: golang-test
+      - name: kind
+        value: task
     params:
     - name: package
       value: $(params.package)
@@ -100,10 +139,19 @@ spec:
       workspace: workarea
       subpath: git
   - name: fetch-component-releases
-    taskRef:
-      name: operator-fetch-component-releases
     runAfter:
     - unit-tests
+    taskRef:
+      resolver: git
+      params:
+        - name: repo
+          value: operator
+        - name: org
+          value: tektoncd
+        - name: revision
+          value: $(params.gitRevision)
+        - name: pathInRepo
+          value: tekton/task-fetch-components.yaml
     workspaces:
     - name: source
       workspace: workarea
@@ -116,8 +164,17 @@ spec:
   - name: build-test
     runAfter:
     - fetch-component-releases
+    when:
+      - cel: "'$(params.runTests)' == 'true'"
     taskRef:
-      name: golang-build
+      resolver: bundles
+      params:
+        - name: bundle
+          value: ghcr.io/tektoncd/catalog/upstream/tasks/golang-build:0.3
+        - name: name
+          value: golang-build
+        - name: kind
+          value: task
     params:
     - name: package
       value: $(params.package)
@@ -131,7 +188,16 @@ spec:
     runAfter:
     - build-test
     taskRef:
-      name: publish-operator-release
+      resolver: git
+      params:
+        - name: repo
+          value: operator
+        - name: org
+          value: tektoncd
+        - name: revision
+          value: $(params.gitRevision)
+        - name: pathInRepo
+          value: tekton/build-publish-images-manifests.yaml
     params:
     - name: package
       value: $(params.package)
@@ -141,6 +207,10 @@ spec:
       value: $(params.imageRegistry)
     - name: imageRegistryPath
       value: $(params.imageRegistryPath)
+    - name: imageRegistryUser
+      value: $(params.imageRegistryUser)
+    - name: imageRegistryRegions
+      value: $(params.imageRegistryRegions)
     - name: releaseAsLatest
       value: $(params.releaseAsLatest)
     - name: platforms
@@ -151,6 +221,8 @@ spec:
       value: kubernetes
     - name: releaseFilePrefix
       value: ""
+    - name: koExtraArgs
+      value: $(params.koExtraArgs)
     workspaces:
     - name: source
       workspace: workarea
@@ -164,7 +236,16 @@ spec:
     runAfter:
     - build-test
     taskRef:
-      name: publish-operator-release
+      resolver: git
+      params:
+        - name: repo
+          value: operator
+        - name: org
+          value: tektoncd
+        - name: revision
+          value: $(params.gitRevision)
+        - name: pathInRepo
+          value: tekton/build-publish-images-manifests.yaml
     params:
     - name: package
       value: $(params.package)
@@ -174,6 +255,10 @@ spec:
       value: $(params.imageRegistry)
     - name: imageRegistryPath
       value: $(params.imageRegistryPath)
+    - name: imageRegistryUser
+      value: $(params.imageRegistryUser)
+    - name: imageRegistryRegions
+      value: $(params.imageRegistryRegions)
     - name: releaseAsLatest
       value: $(params.releaseAsLatest)
     - name: platforms
@@ -184,6 +269,8 @@ spec:
       value: openshift
     - name: releaseFilePrefix
       value: "openshift-"
+    - name: koExtraArgs
+      value: $(params.koExtraArgs)
     workspaces:
     - name: source
       workspace: workarea
@@ -198,7 +285,14 @@ spec:
     - publish-images-platform-kubernetes
     - publish-images-platform-openshift
     taskRef:
-      name: gcs-upload
+      resolver: bundles
+      params:
+        - name: bundle
+          value: ghcr.io/tektoncd/catalog/upstream/tasks/gcs-upload:0.3
+        - name: name
+          value: gcs-upload
+        - name: kind
+          value: task
     workspaces:
     - name: credentials
       workspace: release-secret
@@ -222,7 +316,14 @@ spec:
       values:
       - "true"
     taskRef:
-      name: gcs-upload
+      resolver: bundles
+      params:
+        - name: bundle
+          value: ghcr.io/tektoncd/catalog/upstream/tasks/gcs-upload:0.3
+        - name: name
+          value: gcs-upload
+        - name: kind
+          value: task
     workspaces:
     - name: credentials
       workspace: release-secret
diff --git a/upstream/tekton/release-cheat-sheet.md b/upstream/tekton/release-cheat-sheet.md
index 6ef22f724..535d0cd73 100644
--- a/upstream/tekton/release-cheat-sheet.md
+++ b/upstream/tekton/release-cheat-sheet.md
@@ -56,32 +56,13 @@ need a checkout of the operator repo, a terminal window and a text editor.
 
 2`cd` to root of Operator git checkout.
 
-3. Make sure the release `Task` and `Pipeline` are up-to-date on the
-   cluster. To do that, you can use `kustomize`:
-   
-   ```bash
-   kustomize build tekton | kubectl replace -f -
-   ```
-
-    - [publish-operator-release](https://github.com/tektoncd/operator/blob/main/tekton/build-publish-images-manifests.yaml)
-
-      This task uses [ko](https://github.com/google/ko) to build all container images we release and generate
-      the `release.yaml`
-      ```shell script
-      kubectl apply -f tekton/bases/build-publish-images-manifests.yaml
-      ```
-    - [operator-release](https://github.com/tektoncd/operator/blob/main/tekton/operator-release-pipeline.yaml)
-      ```shell script
-      kubectl apply -f tekton/overlays/versioned-releases/operator-release-pipeline.yaml
-      ```
-
-4. Confirm commit SHA matches what you want to release.
+3. Confirm commit SHA matches what you want to release.
 
     ```bash
     git show $TEKTON_RELEASE_GIT_SHA
     ```
 
-6. Create a workspace template file:
+4. Create a workspace template file:
 
    ```bash
    cat <<EOF > workspace-template.yaml
@@ -94,23 +75,29 @@ need a checkout of the operator repo, a terminal window and a text editor.
    EOF
    ```
 
-7. Execute the release pipeline.
+5. Execute the release pipeline.
 
     ```bash
     tkn --context dogfooding pipeline start operator-release \
+        --filename=tekton/operator-release-pipeline.yaml \
         --serviceaccount=release-right-meow \
-        --param=components=components.yaml \
-        --param=gitRevision="${TEKTON_RELEASE_GIT_SHA}" \
-        --param=versionTag="${TEKTON_RELEASE_VERSION}" \
-        --param=serviceAccountPath=release.json \
-        --param=releaseBucket=gs://tekton-releases/operator \
-        --param=imageRegistry=gcr.io \
-        --param=imageRegistryPath=tekton-releases  \
-        --param=releaseAsLatest=true \
-        --param=platforms=linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
-        --param=kubeDistros="kubernetes openshift" \
-        --param=package=github.com/tektoncd/operator \
+        --param package=github.com/tektoncd/operator \
+        --param components=components.yaml \
+        --param gitRevision="${TEKTON_RELEASE_GIT_SHA}" \
+        --param imageRegistry=ghcr.io \
+        --param imageRegistryPath=tektoncd/operator  \
+        --param imageRegistryRegions="" \
+        --param imageRegistryUser=tekton-robot \
+        --param serviceAccountPath=release.json \
+        --param serviceAccountImagesPath=credentials \
+        --param versionTag="${TEKTON_RELEASE_VERSION}" \
+        --param releaseBucket=gs://tekton-releases/operator \
+        --param koExtraArgs="" \
+        --param releaseAsLatest=true \
+        --param platforms=linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
+        --param kubeDistros="kubernetes openshift" \
         --workspace name=release-secret,secret=release-secret \
+        --workspace name=release-images-secret,secret=ghcr-creds \
         --workspace name=workarea,volumeClaimTemplateFile=workspace-template.yaml \
         --pipeline-timeout 2h0m0s
     ```
diff --git a/upstream/tekton/setup-release-from-scratch.md b/upstream/tekton/setup-release-from-scratch.md
index 96e4534ac..a7ce22f4e 100644
--- a/upstream/tekton/setup-release-from-scratch.md
+++ b/upstream/tekton/setup-release-from-scratch.md
@@ -20,35 +20,14 @@ kubectl apply --filename  https://storage.googleapis.com/tekton-releases/pipelin
 
 ### Install tasks and pipelines
 
-Add all the `Tasks` and `Pipelines` needed for creating to the cluster:,
-
-#### Tasks from Tekton Catalog
-
-- [`golang-test`](https://hub-preview.tekton.dev/detail/45)
-  ```shell script
-    tkn hub install task golang-test
-  ```
-- [`golang-build`](https://hub-preview.tekton.dev/detail/44)
-  ```shell script
-    tkn hub install task golang-build
-  ```
-- [`gcs-upload`](https://hub-preview.tekton.dev/detail/30)
-  ```shell script
-    tkn hub install task gcs-upload
-  ```
-
-#### Tasks and Pipelines from this repository
-
-- [publish-operator-release](https://github.com/tektoncd/operator/blob/main/tekton/build-publish-images-manifests.yaml)
-
-  This task uses [ko](https://github.com/google/ko) to build all container images we release and generate the `release.yaml`
-    ```shell script
-    kubectl apply -f tekton/bases/build-publish-images-manifests.yaml
-    ```
-- [operator-release](https://github.com/tektoncd/operator/blob/main/tekton/operator-release-pipeline.yaml)
-  ```shell script
-  kubectl apply -f tekton/overlays/versioned-releases/operator-release-pipeline.yaml
-  ```
+All the `Tasks` required are fetched via remote resolution.
+The `Pipeline` can be installed on the cluster:
+
+```shell script
+kubectl apply -f tekton/operator-release-pipeline.yaml
+```
+
+or it can be executed from the local file using `tkn pipeline start --filename`.
 
 ### Service account and secrets