diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5d1be6c7..c60e4bf2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
     - name: setupGo
       uses: actions/setup-go@v5.3.0
       with:
-        go-version: '=1.22.10'
+        go-version: '=1.23.0'
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 3bda8f3a..2d705332 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -21,7 +21,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@5a083d0e9a84784eb32078397cf5459adecb4c40 # tag=v3.5.0
       with:
-        go-version: 1.22.10
+        go-version: 1.23.0
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/e2e-image-publish.yaml b/.github/workflows/e2e-image-publish.yaml
index c181edca..26b8cd39 100644
--- a/.github/workflows/e2e-image-publish.yaml
+++ b/.github/workflows/e2e-image-publish.yaml
@@ -19,7 +19,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: "=1.22.10"
+          go-version: "=1.23.0"
       - name: Docker login
         uses: docker/login-action@v3
         with:
diff --git a/.github/workflows/e2e-short.yaml b/.github/workflows/e2e-short.yaml
index 3958055b..3413c7d5 100644
--- a/.github/workflows/e2e-short.yaml
+++ b/.github/workflows/e2e-short.yaml
@@ -41,7 +41,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: "=1.22.10"
+          go-version: "=1.23.0"
       - name: Cache Docker layers
         uses: actions/cache@v4
         with:
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 853c8ece..902bd049 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -23,11 +23,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5.3.0
         with:
-          go-version: '=1.22.10'
+          go-version: '=1.23.0'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6.2.0
         with:
-          version: v1.56.2
+          version: v1.60.2
           working-directory: ${{matrix.working-directory}}
           args: --timeout=5m0s
           skip-cache: true
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index ea5c98ea..f4a13294 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -19,6 +19,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5.3.0
         with:
-          go-version: 1.22.10
+          go-version: 1.23.0
       - name: Lint
         run: make lint
diff --git a/.github/workflows/nightly-test-release.yaml b/.github/workflows/nightly-test-release.yaml
index a5a0c7a4..85052974 100644
--- a/.github/workflows/nightly-test-release.yaml
+++ b/.github/workflows/nightly-test-release.yaml
@@ -73,7 +73,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: '=1.22.10'
+          go-version: '=1.23.0'
       - name: Package operator chart
         run: RELEASE_TAG=${{ env.RELEASE_TAG }} CHART_PACKAGE_DIR=${RELEASE_DIR} REGISTRY=${{ env.PROD_REGISTRY }} ORG=${{ env.PROD_ORG }} make release
 
diff --git a/.github/workflows/release-workflow.yaml b/.github/workflows/release-workflow.yaml
index 89cbb232..dc88edb5 100644
--- a/.github/workflows/release-workflow.yaml
+++ b/.github/workflows/release-workflow.yaml
@@ -60,7 +60,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: '=1.22.10'
+          go-version: '=1.23.0'
       - name: Get prod multiarch image digest
         run: | 
           docker pull ${{ env.CONTROLLER_IMG }}:${{ env.TAG }}
diff --git a/.github/workflows/release_build/action.yaml b/.github/workflows/release_build/action.yaml
index b5681fc4..49280f31 100644
--- a/.github/workflows/release_build/action.yaml
+++ b/.github/workflows/release_build/action.yaml
@@ -36,7 +36,7 @@ runs:
     - name: setupGo
       uses: actions/setup-go@v4
       with:
-        go-version: "=1.22.10"
+        go-version: "=1.23.0"
     - name: Docker login to ghcr registry
       uses: docker/login-action@v3
       with:
diff --git a/.github/workflows/run-e2e-suite.yaml b/.github/workflows/run-e2e-suite.yaml
index e9cc86a1..0673b0f8 100644
--- a/.github/workflows/run-e2e-suite.yaml
+++ b/.github/workflows/run-e2e-suite.yaml
@@ -85,7 +85,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: "=1.22.10"
+          go-version: "=1.23.0"
       - name: Docker login
         uses: docker/login-action@v3
         with:
diff --git a/.github/workflows/test_chart.yaml b/.github/workflows/test_chart.yaml
index 9763d7f5..e7da2366 100644
--- a/.github/workflows/test_chart.yaml
+++ b/.github/workflows/test_chart.yaml
@@ -45,7 +45,7 @@ jobs:
       - name: setupGo
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: '=1.22.10'
+          go-version: '=1.23.0'
 
       - name: Build docker image
         run: make docker-build
diff --git a/.golangci.yml b/.golangci.yml
index c287c43e..fa3fb8b3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -151,6 +151,7 @@ linters:
     - gocritic
     - nlreturn
     - gomnd
+    - mnd
     - ireturn
     - depguard
     - containedctx 
diff --git a/Makefile b/Makefile
index e3cf8a10..11a76704 100644
--- a/Makefile
+++ b/Makefile
@@ -32,7 +32,7 @@ else
 UPDATECLI_OS = Darwin
 endif
 
-GO_VERSION ?= 1.22.10
+GO_VERSION ?= 1.23.0
 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION)
 REPO ?= rancher/turtles
 
@@ -157,7 +157,7 @@ CLUSTERCTL_VER := v1.7.7
 CLUSTERCTL_BIN := clusterctl
 CLUSTERCTL := $(TOOLS_BIN_DIR)/$(CLUSTERCTL_BIN)-$(CLUSTERCTL_VER)
 
-GOLANGCI_LINT_VER := v1.56.2
+GOLANGCI_LINT_VER := v1.60.2
 GOLANGCI_LINT_BIN := golangci-lint
 GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN))
 
diff --git a/charts/rancher-turtles/Chart.yaml b/charts/rancher-turtles/Chart.yaml
index 808f3e70..f883582d 100644
--- a/charts/rancher-turtles/Chart.yaml
+++ b/charts/rancher-turtles/Chart.yaml
@@ -13,7 +13,7 @@ keywords:
 - provisioning
 dependencies:
   - name: cluster-api-operator
-    version: v0.15.1
+    version: v0.16.0
     repository: https://kubernetes-sigs.github.io/cluster-api-operator
     condition: cluster-api-operator.enabled
 annotations:
diff --git a/charts/rancher-turtles/templates/rancher-turtles-components.yaml b/charts/rancher-turtles/templates/rancher-turtles-components.yaml
index 5bbbe689..ade93dd3 100644
--- a/charts/rancher-turtles/templates/rancher-turtles-components.yaml
+++ b/charts/rancher-turtles/templates/rancher-turtles-components.yaml
@@ -2803,6 +2803,12 @@ spec:
                   For example, the infrastructure name `aws` will fetch artifacts from
                   https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases.
                 properties:
+                  oci:
+                    description: |-
+                      OCI to be used for fetching the provider’s components and metadata from an OCI artifact.
+                      You must set `providerSpec.Version` field for operator to pick up desired version of the release from GitHub.
+                      If the providerSpec.Version is missing, latest provider version from clusterctl defaults is used.
+                    type: string
                   selector:
                     description: |-
                       Selector to be used for fetching provider’s components and metadata from
@@ -2862,6 +2868,9 @@ spec:
                       desired version of the release from GitHub.
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: Must specify one and only one of {oci, url, selector}
+                  rule: '[has(self.oci), has(self.url), has(self.selector)].exists_one(x,x)'
               manager:
                 description: Manager defines the properties that can be enabled on
                   the controller manager for the provider.
diff --git a/config/crd/bases/turtles-capi.cattle.io_capiproviders.yaml b/config/crd/bases/turtles-capi.cattle.io_capiproviders.yaml
index 2a0c5130..b0ab12cc 100644
--- a/config/crd/bases/turtles-capi.cattle.io_capiproviders.yaml
+++ b/config/crd/bases/turtles-capi.cattle.io_capiproviders.yaml
@@ -2803,6 +2803,12 @@ spec:
                   For example, the infrastructure name `aws` will fetch artifacts from
                   https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases.
                 properties:
+                  oci:
+                    description: |-
+                      OCI to be used for fetching the provider’s components and metadata from an OCI artifact.
+                      You must set `providerSpec.Version` field for operator to pick up desired version of the release from GitHub.
+                      If the providerSpec.Version is missing, latest provider version from clusterctl defaults is used.
+                    type: string
                   selector:
                     description: |-
                       Selector to be used for fetching provider’s components and metadata from
@@ -2862,6 +2868,9 @@ spec:
                       desired version of the release from GitHub.
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: Must specify one and only one of {oci, url, selector}
+                  rule: '[has(self.oci), has(self.url), has(self.selector)].exists_one(x,x)'
               manager:
                 description: Manager defines the properties that can be enabled on
                   the controller manager for the provider.
diff --git a/exp/clusterclass/go.mod b/exp/clusterclass/go.mod
index bf1ab668..b6e0aecf 100644
--- a/exp/clusterclass/go.mod
+++ b/exp/clusterclass/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/turtles/exp/clusterclass
 
-go 1.22.10
+go 1.23.0
 
 require (
 	github.com/go-logr/logr v1.4.2
diff --git a/exp/etcdrestore/go.mod b/exp/etcdrestore/go.mod
index 61d799de..45d7e139 100644
--- a/exp/etcdrestore/go.mod
+++ b/exp/etcdrestore/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/turtles/exp/etcdrestore
 
-go 1.22.10
+go 1.23.0
 
 replace github.com/rancher/turtles => ../..
 
@@ -17,7 +17,7 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/cluster-api v1.9.4
-	sigs.k8s.io/cluster-api-operator v0.15.1
+	sigs.k8s.io/cluster-api-operator v0.16.0
 	sigs.k8s.io/controller-runtime v0.19.4
 )
 
@@ -71,10 +71,10 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/net v0.34.0 // indirect
 	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
 	golang.org/x/tools v0.28.0 // indirect
diff --git a/exp/etcdrestore/go.sum b/exp/etcdrestore/go.sum
index 320cbe6b..ee905d17 100644
--- a/exp/etcdrestore/go.sum
+++ b/exp/etcdrestore/go.sum
@@ -206,8 +206,8 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -216,8 +216,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -228,10 +228,10 @@ golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
@@ -296,8 +296,8 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsA
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/cluster-api v1.9.4 h1:pa2Ho50F9Js/Vv/Jy11TcpmGiqY2ukXCoDj/dY25Y7M=
 sigs.k8s.io/cluster-api v1.9.4/go.mod h1:9DjpPCxJJo7/mH+KceINNJHr9c5X9S9HEp2B8JG3Uv8=
-sigs.k8s.io/cluster-api-operator v0.15.1 h1:oGEqNE7c1Ieqwso/DwjRVD2b/7wFXIjEKAodlwsO6/Q=
-sigs.k8s.io/cluster-api-operator v0.15.1/go.mod h1:0yvW+1BLHcE5/gQfWSin1L4Gj+8wa9y7+vVTXOhUnSg=
+sigs.k8s.io/cluster-api-operator v0.16.0 h1:q19kIYLPCHjXdXGgLjEDAuBslJs8AkIp3JBVkGR9KBE=
+sigs.k8s.io/cluster-api-operator v0.16.0/go.mod h1:2TraYRvf4Os2vuB6HQhSwDMJATmnNAuCuLQZNj460U8=
 sigs.k8s.io/controller-runtime v0.19.4 h1:SUmheabttt0nx8uJtoII4oIP27BVVvAKFvdvGFwV/Qo=
 sigs.k8s.io/controller-runtime v0.19.4/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
diff --git a/go.mod b/go.mod
index 94252c64..552fe345 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/turtles
 
-go 1.22.10
+go 1.23.0
 
 require (
 	github.com/blang/semver/v4 v4.0.0
@@ -18,7 +18,7 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/cluster-api v1.9.4
-	sigs.k8s.io/cluster-api-operator v0.15.1
+	sigs.k8s.io/cluster-api-operator v0.16.0
 	sigs.k8s.io/controller-runtime v0.19.4
 	sigs.k8s.io/yaml v1.4.0
 )
@@ -61,10 +61,10 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/net v0.34.0 // indirect
 	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
 	golang.org/x/tools v0.28.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index 3d301090..8c561e8a 100644
--- a/go.sum
+++ b/go.sum
@@ -185,8 +185,8 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -195,8 +195,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -207,10 +207,10 @@ golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
@@ -275,8 +275,8 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsA
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/cluster-api v1.9.4 h1:pa2Ho50F9Js/Vv/Jy11TcpmGiqY2ukXCoDj/dY25Y7M=
 sigs.k8s.io/cluster-api v1.9.4/go.mod h1:9DjpPCxJJo7/mH+KceINNJHr9c5X9S9HEp2B8JG3Uv8=
-sigs.k8s.io/cluster-api-operator v0.15.1 h1:oGEqNE7c1Ieqwso/DwjRVD2b/7wFXIjEKAodlwsO6/Q=
-sigs.k8s.io/cluster-api-operator v0.15.1/go.mod h1:0yvW+1BLHcE5/gQfWSin1L4Gj+8wa9y7+vVTXOhUnSg=
+sigs.k8s.io/cluster-api-operator v0.16.0 h1:q19kIYLPCHjXdXGgLjEDAuBslJs8AkIp3JBVkGR9KBE=
+sigs.k8s.io/cluster-api-operator v0.16.0/go.mod h1:2TraYRvf4Os2vuB6HQhSwDMJATmnNAuCuLQZNj460U8=
 sigs.k8s.io/controller-runtime v0.19.4 h1:SUmheabttt0nx8uJtoII4oIP27BVVvAKFvdvGFwV/Qo=
 sigs.k8s.io/controller-runtime v0.19.4/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
diff --git a/go.work.example b/go.work.example
index 2eebb9c5..6ebcceaf 100644
--- a/go.work.example
+++ b/go.work.example
@@ -1,4 +1,4 @@
-go 1.22.10
+go 1.23.0
 
 use (
 	./rancher-turtles
diff --git a/internal/controllers/helpers.go b/internal/controllers/helpers.go
index 5f20bd21..7e14808b 100644
--- a/internal/controllers/helpers.go
+++ b/internal/controllers/helpers.go
@@ -124,7 +124,6 @@ func namespaceToCapiClusters(ctx context.Context, clusterPredicate predicate.Fun
 		reqs := []ctrl.Request{}
 
 		for _, cluster := range capiClusters.Items {
-			cluster := cluster
 			if !clusterPredicate.Generic(event.GenericEvent{Object: &cluster}) {
 				continue
 			}
diff --git a/internal/sync/provider_sync.go b/internal/sync/provider_sync.go
index fa9162d8..c41bd741 100644
--- a/internal/sync/provider_sync.go
+++ b/internal/sync/provider_sync.go
@@ -117,7 +117,6 @@ func (s *ProviderSync) SyncObjects() {
 	s.Source.Status.Conditions = oldConditions
 
 	for _, condition := range newConditions {
-		condition := condition
 		conditions.Set(s.Source, &condition)
 	}
 
diff --git a/internal/sync/secret_mapper_sync.go b/internal/sync/secret_mapper_sync.go
index 78f1bb92..3ca109c5 100644
--- a/internal/sync/secret_mapper_sync.go
+++ b/internal/sync/secret_mapper_sync.go
@@ -268,7 +268,7 @@ func (s *SecretMapperSync) Get(ctx context.Context) error {
 			continue
 		}
 
-		secret := secret
+		secret := secret //nolint:copyloopvar
 		s.RancherSecret = &secret
 
 		return s.SecretSync.Get(ctx)
@@ -278,7 +278,7 @@ func (s *SecretMapperSync) Get(ctx context.Context) error {
 		turtlesv1.RancherCredentialsSecretCondition,
 		turtlesv1.RancherCredentialSourceMissing,
 		clusterv1.ConditionSeverityError,
-		fmt.Sprintf(missingSource, cmp.Or(
+		"%s", fmt.Sprintf(missingSource, cmp.Or(
 			s.Source.Spec.Credentials.RancherCloudCredential,
 			s.Source.Spec.Credentials.RancherCloudCredentialNamespaceName)),
 	))
@@ -298,7 +298,7 @@ func (s *SecretMapperSync) Sync(ctx context.Context) error {
 			turtlesv1.RancherCredentialsSecretCondition,
 			turtlesv1.RancherCredentialKeyMissing,
 			clusterv1.ConditionSeverityError,
-			fmt.Sprintf(missingKey, err.Error()),
+			"%s", fmt.Sprintf(missingKey, err.Error()),
 		))
 
 		return nil
diff --git a/main.go b/main.go
index 53a2b74e..abafd046 100644
--- a/main.go
+++ b/main.go
@@ -302,7 +302,7 @@ func setupRancherClient(options client.Options) (client.Client, error) {
 
 	setupLog.Info("in-cluster installation of rancher-turtles")
 
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 // loadConfigWithContext loads a REST Config from a path using a logic similar to the one used in controller-runtime.
diff --git a/test/go.mod b/test/go.mod
index 57cb1695..04025eec 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/turtles/test
 
-go 1.22.10
+go 1.23.0
 
 replace github.com/rancher/turtles => ../
 
@@ -22,8 +22,8 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/cluster-api v1.9.4
-	sigs.k8s.io/cluster-api-operator v0.15.1
-	sigs.k8s.io/cluster-api-operator/test v0.15.1
+	sigs.k8s.io/cluster-api-operator v0.16.0
+	sigs.k8s.io/cluster-api-operator/test v0.16.0
 	sigs.k8s.io/cluster-api/test v1.9.4
 	sigs.k8s.io/controller-runtime v0.19.4
 	sigs.k8s.io/yaml v1.4.0
@@ -104,7 +104,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
@@ -149,7 +149,7 @@ require (
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
-	golang.org/x/tools v0.28.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
diff --git a/test/go.sum b/test/go.sum
index 4e1bcee7..c203a824 100644
--- a/test/go.sum
+++ b/test/go.sum
@@ -216,8 +216,8 @@ github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
 github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
-github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
@@ -379,8 +379,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -440,10 +440,10 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsA
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/cluster-api v1.9.4 h1:pa2Ho50F9Js/Vv/Jy11TcpmGiqY2ukXCoDj/dY25Y7M=
 sigs.k8s.io/cluster-api v1.9.4/go.mod h1:9DjpPCxJJo7/mH+KceINNJHr9c5X9S9HEp2B8JG3Uv8=
-sigs.k8s.io/cluster-api-operator v0.15.1 h1:oGEqNE7c1Ieqwso/DwjRVD2b/7wFXIjEKAodlwsO6/Q=
-sigs.k8s.io/cluster-api-operator v0.15.1/go.mod h1:0yvW+1BLHcE5/gQfWSin1L4Gj+8wa9y7+vVTXOhUnSg=
-sigs.k8s.io/cluster-api-operator/test v0.15.1 h1:g6QZS+udxw8h1hMS76qVhz2eMqGhQGm+s5/R4HEjkOM=
-sigs.k8s.io/cluster-api-operator/test v0.15.1/go.mod h1:iR0oGy0O2fhmOVCa0ia4smF/z1UmJPuRT0CC4GkssZI=
+sigs.k8s.io/cluster-api-operator v0.16.0 h1:q19kIYLPCHjXdXGgLjEDAuBslJs8AkIp3JBVkGR9KBE=
+sigs.k8s.io/cluster-api-operator v0.16.0/go.mod h1:2TraYRvf4Os2vuB6HQhSwDMJATmnNAuCuLQZNj460U8=
+sigs.k8s.io/cluster-api-operator/test v0.16.0 h1:XWqa7emSE1CJXCQ7U2yJ71cJ7P5Avhux6Y0FPWyQNpo=
+sigs.k8s.io/cluster-api-operator/test v0.16.0/go.mod h1:bo4mf0AVIGn3EnJqlvfH9szdD396TDUoODXugHGXH3w=
 sigs.k8s.io/cluster-api/test v1.9.4 h1:ZZ+IPK/lfyc4d/QPtompt+cxXYC6tGJ4kTHhhocgbIM=
 sigs.k8s.io/cluster-api/test v1.9.4/go.mod h1:dHLUcNc9vBNyQyY6NTcqcfpFvIiXmcL5Iqe2sETFD1c=
 sigs.k8s.io/controller-runtime v0.19.4 h1:SUmheabttt0nx8uJtoII4oIP27BVVvAKFvdvGFwV/Qo=
diff --git a/tilt/project/Tiltfile b/tilt/project/Tiltfile
index 98b130d4..f807bb60 100644
--- a/tilt/project/Tiltfile
+++ b/tilt/project/Tiltfile
@@ -274,7 +274,7 @@ def get_port_forwards(debug):
 
 tilt_helper_dockerfile_header = """
 # Tilt image
-FROM golang:1.22.10 as tilt-helper
+FROM golang:1.23.0 as tilt-helper
 # Support live reloading with Tilt
 RUN go install github.com/go-delve/delve/cmd/dlv@latest
 RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com/tilt-dev/rerun-process-wrapper/master/restart.sh  && \