diff --git a/Cargo.lock b/Cargo.lock
index 0fd0a99cb9664..c3615837e513d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -275,6 +275,12 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "arrayvec"
 version = "0.5.2"
@@ -1724,7 +1730,7 @@ dependencies = [
  "bitflags 2.13.2",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "regex",
@@ -3350,7 +3356,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -3558,6 +3564,15 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22"
+dependencies = [
+ "encoding_rs",
+]
+
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -4263,6 +4278,16 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "granit-parser"
+version = "0.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d03f81ad4732830d85cfd417a9f62cde6dadda4354d37d078a6084a19560aa2d"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+]
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -5048,7 +5073,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -5330,9 +5355,9 @@ checksum = "25b4b06f56a445e20f50c52894e412b2a3c5f2be97d03dd4326c6c768558dee1"
 dependencies = [
  "async-trait",
  "futures",
- "k8s-openapi",
- "kube",
- "kube-runtime",
+ "k8s-openapi 0.27.0",
+ "kube 3.1.0",
+ "kube-runtime 3.1.0",
  "prometheus",
  "rand 0.9.4",
  "serde",
@@ -5355,6 +5380,18 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "k8s-openapi"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c6922f6afe80418dd6019818af5d0d34584c371780ff09b9752370c25b4abb"
+dependencies = [
+ "base64 0.22.1",
+ "jiff",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "keyed_priority_queue"
 version = "0.4.1"
@@ -5370,11 +5407,22 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acc5a6a69da2975ed9925d56b5dcfc9cc739b66f37add06785b7c9f6d1e88741"
 dependencies = [
- "k8s-openapi",
- "kube-client",
- "kube-core",
+ "k8s-openapi 0.27.0",
+ "kube-client 3.1.0",
+ "kube-core 3.1.0",
+]
+
+[[package]]
+name = "kube"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "208d7fe1380066abb194812a8a8e303cb896a33bb3d7b3177b71bd03ff39bf18"
+dependencies = [
+ "k8s-openapi 0.28.0",
+ "kube-client 4.2.0",
+ "kube-core 4.2.0",
  "kube-derive",
- "kube-runtime",
+ "kube-runtime 4.2.0",
 ]
 
 [[package]]
@@ -5382,6 +5430,39 @@ name = "kube-client"
 version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fcaf2d1f1a91e1805d4cd82e8333c022767ae8ffd65909bbef6802733a7dd40"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "either",
+ "futures",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "jiff",
+ "jsonpath-rust",
+ "k8s-openapi 0.27.0",
+ "kube-core 3.1.0",
+ "pem 3.0.6",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-util",
+ "tower 0.5.3",
+ "tower-http",
+ "tracing",
+]
+
+[[package]]
+name = "kube-client"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31e940a73033a7c5c7918b5ece7851d84571b58be25e937198da37fa13f116d3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -5396,14 +5477,15 @@ dependencies = [
  "hyper-util",
  "jiff",
  "jsonpath-rust",
- "k8s-openapi",
- "kube-core",
+ "k8s-openapi 0.28.0",
+ "kube-core 4.2.0",
  "pem 3.0.6",
  "rustls",
+ "rustls-platform-verifier",
  "secrecy",
  "serde",
+ "serde-saphyr",
  "serde_json",
- "serde_yaml",
  "thiserror 2.0.21",
  "tokio",
  "tokio-util",
@@ -5423,7 +5505,25 @@ dependencies = [
  "http 1.5.0",
  "jiff",
  "json-patch",
- "k8s-openapi",
+ "k8s-openapi 0.27.0",
+ "serde",
+ "serde-value",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "kube-core"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d2353c118cf3462c352ee0b5bd5b0cf17990af456dfd8662d136ff9812eeb4"
+dependencies = [
+ "derive_more",
+ "form_urlencoded",
+ "http 1.5.0",
+ "jiff",
+ "json-patch",
+ "k8s-openapi 0.28.0",
  "schemars 1.2.2",
  "serde",
  "serde-value",
@@ -5433,9 +5533,9 @@ dependencies = [
 
 [[package]]
 name = "kube-derive"
-version = "3.1.0"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6b9b97e121fce957f9cafc6da534abc4276983ab03190b76c09361e2df849fa"
+checksum = "92141c19e1fa83bf91633c1234c66b03375c29aa8ca5486331ddb47e3a3da9c0"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -5460,8 +5560,35 @@ dependencies = [
  "hashbrown 0.16.1",
  "hostname",
  "json-patch",
- "k8s-openapi",
- "kube-client",
+ "k8s-openapi 0.27.0",
+ "kube-client 3.1.0",
+ "parking_lot",
+ "pin-project",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "kube-runtime"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eb064ef71c7bea55e934a443960da9e9ec31fbb2ba63e47e4aeca32603d5cc7"
+dependencies = [
+ "ahash 0.8.12",
+ "async-broadcast",
+ "async-stream",
+ "backon",
+ "educe",
+ "futures",
+ "hashbrown 0.16.1",
+ "hostname",
+ "json-patch",
+ "k8s-openapi 0.28.0",
+ "kube-client 4.2.0",
  "parking_lot",
  "pin-project",
  "serde",
@@ -6670,8 +6797,8 @@ dependencies = [
  "hex",
  "humantime",
  "indexmap 2.14.2",
- "k8s-openapi",
- "kube",
+ "k8s-openapi 0.27.0",
+ "kube 4.2.0",
  "mz-ore",
  "mz-repr",
  "mz-server-core",
@@ -6971,8 +7098,8 @@ dependencies = [
  "clap",
  "csv-async",
  "futures",
- "k8s-openapi",
- "kube",
+ "k8s-openapi 0.27.0",
+ "kube 4.2.0",
  "mz-build-info",
  "mz-cloud-resources",
  "mz-ore",
@@ -7572,7 +7699,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "k8s-controller",
- "k8s-openapi",
+ "k8s-openapi 0.27.0",
  "mz-metrics",
  "mz-ore",
  "prometheus",
@@ -7673,8 +7800,8 @@ dependencies = [
  "fail",
  "futures",
  "hex",
- "k8s-openapi",
- "kube",
+ "k8s-openapi 0.27.0",
+ "kube 4.2.0",
  "maplit",
  "mz-cloud-resources",
  "mz-orchestrator",
@@ -7753,8 +7880,8 @@ dependencies = [
  "http 1.5.0",
  "humantime",
  "k8s-controller",
- "k8s-openapi",
- "kube",
+ "k8s-openapi 0.27.0",
+ "kube 4.2.0",
  "maplit",
  "mz-alloc",
  "mz-alloc-default",
@@ -9270,6 +9397,12 @@ dependencies = [
  "cidr",
 ]
 
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -11212,7 +11345,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -12035,7 +12168,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -12094,7 +12227,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -12486,6 +12619,25 @@ dependencies = [
  "typeid",
 ]
 
+[[package]]
+name = "serde-saphyr"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bd22781911de0ca6debda95f073c8f18bec65d1a94f1fa9573f3102e514cea4"
+dependencies = [
+ "ahash 0.8.12",
+ "annotate-snippets",
+ "base64 0.22.1",
+ "encoding_rs_io",
+ "getrandom 0.3.3",
+ "granit-parser",
+ "nohash-hasher",
+ "num-traits",
+ "serde_core",
+ "smallvec",
+ "zmij",
+]
+
 [[package]]
 name = "serde-value"
 version = "0.7.0"
@@ -12821,9 +12973,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.16.2"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 dependencies = [
  "serde",
 ]
@@ -13224,7 +13376,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -13243,7 +13395,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index c2dc47fad41b6..c0836dec8422e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -397,7 +397,7 @@ jsonwebtoken = { version = "11.1.0", features = ["aws_lc_rs"] }
 junit-report = "0.9.1"
 k8s-controller = "0.13.0"
 k8s-openapi = { version = "0.27.0", features = ["schemars", "v1_34"] }
-kube = { version = "3.1.0", default-features = false, features = ["aws-lc-rs", "client", "derive", "runtime", "rustls-tls"] }
+kube = { version = "4.2.0", default-features = false, features = ["aws-lc-rs", "client", "derive", "runtime", "rustls-tls"] }
 launchdarkly-server-sdk = { version = "3.3.0", default-features = false, features = ["hyper-rustls-native-roots", "crypto-aws-lc-rs"] }
 launchdarkly-sdk-transport = "0.1.4"
 lgalloc = "0.6.0"