diff --git a/scripts/megalinter-scan-counts.sh b/scripts/megalinter-scan-counts.sh
index 024fa66771..a15057bf8e 100755
--- a/scripts/megalinter-scan-counts.sh
+++ b/scripts/megalinter-scan-counts.sh
@@ -69,8 +69,8 @@ set -euo pipefail
 #
 # scripts/update-vendored-operators.sh pins the same Checkov version and refuses to run, including in
 # CI's --validate-committed step, while its pin differs from this one. Bump both together.
-readonly CI_CHECKOV_VERSION='3.3.9'
-readonly CI_TRIVY_VERSION='0.73.0'
+readonly CI_CHECKOV_VERSION='3.3.15'
+readonly CI_TRIVY_VERSION='0.74.0'
 
 # The MegaLinter release those two versions came from. It is not a local concept — nothing here runs
 # MegaLinter — but it is what makes the pair above checkable: MegaLinter bundles both scanners AND
@@ -81,7 +81,7 @@ readonly CI_TRIVY_VERSION='0.73.0'
 # Nothing in THIS repository selects it: the MegaLinter action is pinned in devantler-tech/actions,
 # so all three constants go stale here when that pin moves, silently and in both directions.
 # scripts/check-megalinter-version-drift.sh is the CI-side guard that catches it (#2853).
-readonly CI_MEGALINTER_VERSION='10.0.0'
+readonly CI_MEGALINTER_VERSION='10.1.0'
 
 # The frameworks MegaLinter's checkov run reports, and their current contribution to the CI total.
 #
diff --git a/scripts/update-vendored-operators.sh b/scripts/update-vendored-operators.sh
index 83545dcdf4..0d9899c405 100755
--- a/scripts/update-vendored-operators.sh
+++ b/scripts/update-vendored-operators.sh
@@ -30,7 +30,7 @@ readonly cert_approver_image_digest='sha256:445a8e5584f659701092d2ec8b625da8929d
 # refresh cannot miss a rule that the non-blocking CI scan knows. Every mode,
 # --validate-committed included, refuses to run while the two differ, so a bump
 # of either pin fails CI until the other moves with it.
-readonly checkov_version='3.3.9'
+readonly checkov_version='3.3.15'
 # CKV2_K8S_6 only understands networking.k8s.io NetworkPolicy. An isolated
 # bundle scan cannot see that cilium-network-policy.yaml protects every CDI
 # endpoint; the full-repository CI scan remains unskipped and owns graph checks.