diff --git a/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl b/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
index a9d20a08ce..aa81fc947b 100644
--- a/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
+++ b/3rdparty/bazel/com_github_medik8s_node_maintainance_operator/source.bzl
@@ -6,10 +6,10 @@ def node_maintainance_operator_deps():
     http_archive(
         name = "com_github_medik8s_node_maintainance_operator",
         urls = [
-            "https://cdn.confidential.cloud/constellation/cas/sha256/df5ea2f9d982dd78770f2549333fd40aaf40e50a28deec9d7892f83cf9d1bdb2",
-            "https://github.com/medik8s/node-maintenance-operator/archive/refs/tags/v0.15.0.tar.gz",
+            "https://cdn.confidential.cloud/constellation/cas/sha256/6ccc7f152e5c595ab24eaadcda77870101eccc482694dc6f0d93be2528406ae2",
+            "https://github.com/medik8s/node-maintenance-operator/archive/refs/tags/v0.17.0.tar.gz",
         ],
-        strip_prefix = "node-maintenance-operator-0.15.0",
+        strip_prefix = "node-maintenance-operator-0.17.0",
         build_file_content = """
 api_v1beta1 = glob(["api/v1beta1/*.go"])
 filegroup(
@@ -19,5 +19,5 @@ filegroup(
 )
         """,
         type = "tar.gz",
-        sha256 = "df5ea2f9d982dd78770f2549333fd40aaf40e50a28deec9d7892f83cf9d1bdb2",
+        sha256 = "6ccc7f152e5c595ab24eaadcda77870101eccc482694dc6f0d93be2528406ae2",
     )
diff --git a/bazel/toolchains/multirun_deps.bzl b/bazel/toolchains/multirun_deps.bzl
index 0db8f32e9f..ee1f3a5847 100644
--- a/bazel/toolchains/multirun_deps.bzl
+++ b/bazel/toolchains/multirun_deps.bzl
@@ -5,11 +5,11 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 def multirun_deps():
     http_archive(
         name = "com_github_ash2k_bazel_tools",
-        sha256 = "c5c2bb097ef427ab021f522828167c6d85c3e9077763629343282c51dbde03db",
-        strip_prefix = "bazel-tools-ad2d84beb4e577bda323c8517533b046ed34e6ad",
+        sha256 = "dc32a65c69c843f1ba2a328b79974163896e5b8ed283cd711abe12bf7cd12ffc",
+        strip_prefix = "bazel-tools-415483a9e13342a6603a710b0296f6d85b8d26bf",
         urls = [
-            "https://cdn.confidential.cloud/constellation/cas/sha256/c5c2bb097ef427ab021f522828167c6d85c3e9077763629343282c51dbde03db",
-            "https://github.com/ash2k/bazel-tools/archive/ad2d84beb4e577bda323c8517533b046ed34e6ad.tar.gz",
+            "https://cdn.confidential.cloud/constellation/cas/sha256/dc32a65c69c843f1ba2a328b79974163896e5b8ed283cd711abe12bf7cd12ffc",
+            "https://github.com/ash2k/bazel-tools/archive/415483a9e13342a6603a710b0296f6d85b8d26bf.tar.gz",
         ],
         type = "tar.gz",
     )
diff --git a/bazel/toolchains/nixpkgs_deps.bzl b/bazel/toolchains/nixpkgs_deps.bzl
index d1df617060..a392ef9baf 100644
--- a/bazel/toolchains/nixpkgs_deps.bzl
+++ b/bazel/toolchains/nixpkgs_deps.bzl
@@ -5,11 +5,11 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 def nixpkgs_deps():
     http_archive(
         name = "io_tweag_rules_nixpkgs",
-        sha256 = "2a555348d7f8593fca2bf3fc6ce53c5d62929de81b6c292e23f16c557c0ae45a",
-        strip_prefix = "rules_nixpkgs-0.11.1",
+        sha256 = "1adb04dc0416915fef427757f4272c4f7dacefeceeefc50f683aec7f7e9b787a",
+        strip_prefix = "rules_nixpkgs-0.12.0",
         urls = [
-            "https://cdn.confidential.cloud/constellation/cas/sha256/2a555348d7f8593fca2bf3fc6ce53c5d62929de81b6c292e23f16c557c0ae45a",
-            "https://github.com/tweag/rules_nixpkgs/releases/download/v0.11.1/rules_nixpkgs-0.11.1.tar.gz",
+            "https://cdn.confidential.cloud/constellation/cas/sha256/1adb04dc0416915fef427757f4272c4f7dacefeceeefc50f683aec7f7e9b787a",
+            "https://github.com/tweag/rules_nixpkgs/releases/download/v0.12.0/rules_nixpkgs-0.12.0.tar.gz",
         ],
         type = "tar.gz",
     )