diff --git a/Makefile b/Makefile
index 5360a065e..1eec42184 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ ARTIFACTS := _out
 TOOLS ?= ghcr.io/siderolabs/tools:v1.8.0-alpha.0
 
 PKGS_PREFIX ?= ghcr.io/siderolabs
-PKGS ?= v1.8.0-alpha.0-8-gca6249b
+PKGS ?= v1.8.0-alpha.0-10-g28c5696
 EXTRAS ?= v1.8.0-alpha.0
 
 PKG_FHS ?= $(PKGS_PREFIX)/fhs:$(PKGS)
diff --git a/go.mod b/go.mod
index 004fe5056..d4af7d275 100644
--- a/go.mod
+++ b/go.mod
@@ -54,7 +54,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/containerd/cgroups/v3 v3.0.3
-	github.com/containerd/containerd v1.7.15
+	github.com/containerd/containerd v1.7.16
 	github.com/containerd/typeurl/v2 v2.1.1
 	github.com/containernetworking/cni v1.2.0
 	github.com/containernetworking/plugins v1.4.1
diff --git a/go.sum b/go.sum
index 9ce711569..3a005123d 100644
--- a/go.sum
+++ b/go.sum
@@ -159,8 +159,8 @@ github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD9
 github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
 github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGDJ9kip0=
 github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
-github.com/containerd/containerd v1.7.15 h1:afEHXdil9iAm03BmhjzKyXnnEBtjaLJefdU7DV0IFes=
-github.com/containerd/containerd v1.7.15/go.mod h1:ISzRRTMF8EXNpJlTzyr2XMhN+j9K302C21/+cr3kUnY=
+github.com/containerd/containerd v1.7.16 h1:7Zsfe8Fkj4Wi2My6DXGQ87hiqIrmOXolm72ZEkFU5Mg=
+github.com/containerd/containerd v1.7.16/go.mod h1:NL49g7A/Fui7ccmxV6zkBWwqMgmMxFWzujYCc+JLt7k=
 github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
 github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/containerd/errdefs v0.1.0 h1:m0wCRBiu1WJT/Fr+iOoQHMQS/eP5myQ8lCv4Dz5ZURM=
diff --git a/hack/cloud-image-uploader/aws.go b/hack/cloud-image-uploader/aws.go
index 46d45a880..2ac202525 100644
--- a/hack/cloud-image-uploader/aws.go
+++ b/hack/cloud-image-uploader/aws.go
@@ -17,8 +17,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
 	"github.com/google/uuid"
+	"github.com/klauspost/compress/zstd"
 	"github.com/siderolabs/go-retry/retry"
-	"github.com/ulikunitz/xz"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -167,7 +167,7 @@ func (au *AWSUploader) registerAMIArch(ctx context.Context, region string, svc *
 
 		defer source.Close() //nolint:errcheck
 
-		image, err := xz.NewReader(source)
+		image, err := zstd.NewReader(source)
 		if err != nil {
 			return err
 		}
diff --git a/hack/cloud-image-uploader/azure.go b/hack/cloud-image-uploader/azure.go
index 384873d29..63e8b6fa0 100644
--- a/hack/cloud-image-uploader/azure.go
+++ b/hack/cloud-image-uploader/azure.go
@@ -26,9 +26,9 @@ import (
 	"github.com/Azure/go-autorest/autorest"
 	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/blang/semver/v4"
+	"github.com/klauspost/compress/zstd"
 	"github.com/siderolabs/gen/channel"
 	"github.com/siderolabs/gen/xslices"
-	"github.com/ulikunitz/xz"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -146,7 +146,7 @@ func (azu *AzureUploader) uploadAzureBlob(ctx context.Context, arch string) erro
 	defer source.Close() //nolint:errcheck
 
 	// calculate totalSize
-	file, err := xz.NewReader(source)
+	file, err := zstd.NewReader(source)
 	if err != nil {
 		return fmt.Errorf("azure: error extracting file from xz: %w", err)
 	}
@@ -163,7 +163,7 @@ func (azu *AzureUploader) uploadAzureBlob(ctx context.Context, arch string) erro
 		return fmt.Errorf("azure: error seeking back: %w", err)
 	}
 
-	file, err = xz.NewReader(source)
+	file, err = zstd.NewReader(source)
 	if err != nil {
 		return fmt.Errorf("azure: error extracting file from xz: %w", err)
 	}
diff --git a/hack/cloud-image-uploader/go.mod b/hack/cloud-image-uploader/go.mod
index bb8c405b5..9f0bb1bf9 100644
--- a/hack/cloud-image-uploader/go.mod
+++ b/hack/cloud-image-uploader/go.mod
@@ -14,10 +14,10 @@ require (
 	github.com/aws/aws-sdk-go v1.51.25
 	github.com/blang/semver/v4 v4.0.0
 	github.com/google/uuid v1.6.0
+	github.com/klauspost/compress v1.17.8
 	github.com/siderolabs/gen v0.4.8
 	github.com/siderolabs/go-retry v0.3.3
 	github.com/spf13/pflag v1.0.5
-	github.com/ulikunitz/xz v0.5.12
 	golang.org/x/sync v0.7.0
 )
 
diff --git a/hack/cloud-image-uploader/go.sum b/hack/cloud-image-uploader/go.sum
index 32fadba4a..f1c6eb904 100644
--- a/hack/cloud-image-uploader/go.sum
+++ b/hack/cloud-image-uploader/go.sum
@@ -68,6 +68,8 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
+github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -91,8 +93,6 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
-github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
diff --git a/hack/cloud-image-uploader/options.go b/hack/cloud-image-uploader/options.go
index feb704255..c01f31766 100644
--- a/hack/cloud-image-uploader/options.go
+++ b/hack/cloud-image-uploader/options.go
@@ -35,10 +35,10 @@ var DefaultOptions = Options{
 
 // AWSImage returns path to AWS pre-built image.
 func (o *Options) AWSImage(architecture string) string {
-	return filepath.Join(o.ArtifactsPath, fmt.Sprintf("aws-%s.raw.xz", architecture))
+	return filepath.Join(o.ArtifactsPath, fmt.Sprintf("aws-%s.raw.zst", architecture))
 }
 
 // AzureImage returns path to AWS pre-built image.
 func (o *Options) AzureImage(architecture string) string {
-	return filepath.Join(o.ArtifactsPath, fmt.Sprintf("azure-%s.vhd.xz", architecture))
+	return filepath.Join(o.ArtifactsPath, fmt.Sprintf("azure-%s.vhd.zst", architecture))
 }
diff --git a/hack/release.toml b/hack/release.toml
index 97f6b8697..c52acf5e0 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -17,6 +17,9 @@ preface = """\
     [notes.updates]
         title = "Component Updates"
         description = """\
+Linux: 6.6.29
+containerd: 1.7.16
+
 Talos is built with Go 1.22.2.
 """
 
diff --git a/hack/test/e2e-qemu.sh b/hack/test/e2e-qemu.sh
index b089c9983..d655602cb 100755
--- a/hack/test/e2e-qemu.sh
+++ b/hack/test/e2e-qemu.sh
@@ -99,7 +99,7 @@ case "${USE_DISK_IMAGE:-false}" in
   false)
     ;;
   *)
-    xz -d < _out/metal-amd64.raw.xz > _out/metal-amd64.raw
+    zstd -d < _out/metal-amd64.raw.zst > _out/metal-amd64.raw
     QEMU_FLAGS+=("--disk-image-path=_out/metal-amd64.raw")
     ;;
 esac
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index 33a074611..0b2d80d63 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -14,7 +14,7 @@ import (
 
 const (
 	// DefaultKernelVersion is the default Linux kernel version.
-	DefaultKernelVersion = "6.6.28-talos"
+	DefaultKernelVersion = "6.6.29-talos"
 
 	// KernelModulesPath is the default path to the kernel modules without the kernel version.
 	KernelModulesPath = "/lib/modules"
@@ -477,7 +477,7 @@ const (
 	TrustdUserID = 51
 
 	// DefaultContainerdVersion is the default container runtime version.
-	DefaultContainerdVersion = "1.7.15"
+	DefaultContainerdVersion = "1.7.16"
 
 	// SystemContainerdNamespace is the Containerd namespace for Talos services.
 	SystemContainerdNamespace = "system"
diff --git a/pkg/machinery/gendata/data/pkgs b/pkg/machinery/gendata/data/pkgs
index 556a12508..2e299dfea 100644
--- a/pkg/machinery/gendata/data/pkgs
+++ b/pkg/machinery/gendata/data/pkgs
@@ -1 +1 @@
-v1.8.0-alpha.0-8-gca6249b
\ No newline at end of file
+v1.8.0-alpha.0-10-g28c5696
\ No newline at end of file