diff --git a/build/istio/values.yaml b/build/istio/values.yaml
index 58dfb67a5..496c23092 100644
--- a/build/istio/values.yaml
+++ b/build/istio/values.yaml
@@ -5,7 +5,7 @@
 #! These values cannot be changed later when rendering cf-for-k8s templates.
 #! Values related to CF should NOT be in this file.
 
-istio_version: 1.14.2
+istio_version: 1.14.3
 
 fluentbit:
   image: cloudfoundry/cf-k8s-networking-fluentbit@sha256:64d67dc076d4160c351272261d7730c08c1b906a881d1812778b6da93871d4e4
diff --git a/config/istio/istio-generated/xxx-generated-istio.yaml b/config/istio/istio-generated/xxx-generated-istio.yaml
index 5dbce4290..d781cd99f 100644
--- a/config/istio/istio-generated/xxx-generated-istio.yaml
+++ b/config/istio/istio-generated/xxx-generated-istio.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     istio: security
     release: istio
@@ -215,7 +215,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: destinationrules.networking.istio.io
@@ -2692,7 +2692,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: envoyfilters.networking.istio.io
@@ -2931,7 +2931,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: gateways.networking.istio.io
@@ -3186,7 +3186,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiooperators.install.istio.io
 spec:
@@ -3238,7 +3238,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     istio: security
     release: istio
@@ -3331,7 +3331,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: proxyconfigs.networking.istio.io
@@ -3397,7 +3397,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     istio: security
     release: istio
@@ -3496,7 +3496,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: serviceentries.networking.istio.io
@@ -3771,7 +3771,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: sidecars.networking.istio.io
@@ -4140,7 +4140,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     istio: telemetry
     release: istio
@@ -4408,7 +4408,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: virtualservices.networking.istio.io
@@ -5933,7 +5933,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: wasmplugins.extensions.istio.io
@@ -6051,7 +6051,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: workloadentries.networking.istio.io
@@ -6180,7 +6180,7 @@ metadata:
   labels:
     app: istio-pilot
     chart: istio
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     heritage: Tiller
     release: istio
   name: workloadgroups.networking.istio.io
@@ -6504,7 +6504,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: istio-ingressgateway
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: ingressgateway
     istio.io/rev: default
@@ -6518,7 +6518,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: istio-reader
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istio-reader-service-account
   namespace: istio-system
@@ -6528,7 +6528,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod
   namespace: istio-system
@@ -6538,7 +6538,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-service-account
   namespace: istio-system
@@ -6548,7 +6548,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: istio-reader
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istio-reader-clusterrole-istio-system
 rules:
@@ -6646,7 +6646,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: istio-reader
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istio-reader-istio-system
 rules:
@@ -6742,7 +6742,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-clusterrole-istio-system
 rules:
@@ -6946,7 +6946,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-gateway-controller-istio-system
 rules:
@@ -6980,7 +6980,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-istio-system
 rules:
@@ -7182,7 +7182,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: istio-reader
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istio-reader-clusterrole-istio-system
 roleRef:
@@ -7199,7 +7199,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: istio-reader
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istio-reader-istio-system
 roleRef:
@@ -7216,7 +7216,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-clusterrole-istio-system
 roleRef:
@@ -7233,7 +7233,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-gateway-controller-istio-system
 roleRef:
@@ -7250,7 +7250,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-istio-system
 roleRef:
@@ -7267,7 +7267,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio: istiod
     istio.io/rev: default
     release: istio
@@ -7308,7 +7308,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: stats-filter-1.11
   namespace: istio-system
@@ -7432,7 +7432,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: stats-filter-1.12
   namespace: istio-system
@@ -7556,7 +7556,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: stats-filter-1.13
   namespace: istio-system
@@ -7680,7 +7680,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: stats-filter-1.14
   namespace: istio-system
@@ -7804,7 +7804,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: stats-filter-1.15
   namespace: istio-system
@@ -7928,7 +7928,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: tcp-stats-filter-1.11
   namespace: istio-system
@@ -8044,7 +8044,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: tcp-stats-filter-1.12
   namespace: istio-system
@@ -8160,7 +8160,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: tcp-stats-filter-1.13
   namespace: istio-system
@@ -8276,7 +8276,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: tcp-stats-filter-1.14
   namespace: istio-system
@@ -8392,7 +8392,7 @@ apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     istio.io/rev: default
   name: tcp-stats-filter-1.15
   namespace: istio-system
@@ -8558,7 +8558,7 @@ data:
 kind: ConfigMap
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: Pilot
@@ -9700,7 +9700,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.14.2",
+        "tag": "1.14.3",
         "tracer": {
           "datadog": {
             "address": "$(HOST_IP):8126"
@@ -9738,7 +9738,7 @@ data:
 kind: ConfigMap
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: Pilot
@@ -9751,7 +9751,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   labels:
     app: sidecar-injector
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: Pilot
@@ -9906,12 +9906,12 @@ metadata:
     kbld.k14s.io/images: |
       - origins:
         - resolved:
-            tag: 1.14.2
-            url: index.docker.io/istio/proxyv2:1.14.2
-        url: index.docker.io/istio/proxyv2@sha256:e3e729d194a7db9b97629b581b4fedd9a9ed8a17aadea2a8eb3c1ceaaf15e61d
+            tag: 1.14.3
+            url: index.docker.io/istio/proxyv2:1.14.3
+        url: index.docker.io/istio/proxyv2@sha256:b7dc502a51251f7e97ae849382177ebd0ab19668e40f49d6bab5048debfefd48
   labels:
     app: istio-ingressgateway
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: ingressgateway
     istio.io/rev: default
@@ -9934,7 +9934,7 @@ spec:
       labels:
         app: istio-ingressgateway
         chart: gateways
-        cloudfoundry.org/istio_version: 1.14.2
+        cloudfoundry.org/istio_version: 1.14.3
         heritage: Tiller
         install.operator.istio.io/owning-resource: unknown
         istio: ingressgateway
@@ -9947,45 +9947,8 @@ spec:
     spec:
       affinity:
         nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
-              matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
-            weight: 2
-          - preference:
-              matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - arm64
-            weight: 2
-          - preference:
-              matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - ppc64le
-            weight: 2
-          - preference:
-              matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - s390x
-            weight: 2
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
-                - arm64
-                - ppc64le
-                - s390x
+          preferredDuringSchedulingIgnoredDuringExecution: null
+          requiredDuringSchedulingIgnoredDuringExecution: null
       containers:
       - args:
         - proxy
@@ -10045,7 +10008,7 @@ spec:
           value: Kubernetes
         - name: TERMINATION_DRAIN_DURATION_SECONDS
           value: "60"
-        image: index.docker.io/istio/proxyv2@sha256:e3e729d194a7db9b97629b581b4fedd9a9ed8a17aadea2a8eb3c1ceaaf15e61d
+        image: index.docker.io/istio/proxyv2@sha256:b7dc502a51251f7e97ae849382177ebd0ab19668e40f49d6bab5048debfefd48
         lifecycle:
           preStop:
             exec:
@@ -10197,12 +10160,12 @@ metadata:
     kbld.k14s.io/images: |
       - origins:
         - resolved:
-            tag: 1.14.2
-            url: index.docker.io/istio/pilot:1.14.2
-        url: index.docker.io/istio/pilot@sha256:75f5d7d802ddafef82e50ba5ae14962496d22429dc287636e1aa4624cfd10351
+            tag: 1.14.3
+            url: index.docker.io/istio/pilot:1.14.3
+        url: index.docker.io/istio/pilot@sha256:aa89cf6e1f01f9d21f0beadd9179c0448d4d9640a1e39abb0547de9b99a26963
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: pilot
     istio.io/rev: default
@@ -10226,7 +10189,7 @@ spec:
         sidecar.istio.io/inject: "false"
       labels:
         app: istiod
-        cloudfoundry.org/istio_version: 1.14.2
+        cloudfoundry.org/istio_version: 1.14.3
         install.operator.istio.io/owning-resource: unknown
         istio: pilot
         istio.io/rev: default
@@ -10278,7 +10241,7 @@ spec:
           value: "false"
         - name: CLUSTER_ID
           value: Kubernetes
-        image: index.docker.io/istio/pilot@sha256:75f5d7d802ddafef82e50ba5ae14962496d22429dc287636e1aa4624cfd10351
+        image: index.docker.io/istio/pilot@sha256:aa89cf6e1f01f9d21f0beadd9179c0448d4d9640a1e39abb0547de9b99a26963
         name: discovery
         ports:
         - containerPort: 8080
@@ -10349,7 +10312,7 @@ metadata:
     kapp.k14s.io/update-strategy: fallback-on-replace
   labels:
     app: istio-ingressgateway
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: ingressgateway
     istio.io/rev: default
@@ -10371,7 +10334,7 @@ metadata:
     kapp.k14s.io/update-strategy: fallback-on-replace
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: pilot
     istio.io/rev: default
@@ -10390,7 +10353,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: IngressGateways
@@ -10412,7 +10375,7 @@ kind: Role
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod
   namespace: istio-system
@@ -10440,7 +10403,7 @@ kind: Role
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-istio-system
   namespace: istio-system
@@ -10467,7 +10430,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: IngressGateways
@@ -10487,7 +10450,7 @@ kind: RoleBinding
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod
   namespace: istio-system
@@ -10505,7 +10468,7 @@ kind: RoleBinding
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     release: istio
   name: istiod-istio-system
   namespace: istio-system
@@ -10523,7 +10486,7 @@ kind: HorizontalPodAutoscaler
 metadata:
   labels:
     app: istio-ingressgateway
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: ingressgateway
     istio.io/rev: default
@@ -10551,7 +10514,7 @@ kind: HorizontalPodAutoscaler
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: Pilot
@@ -10579,7 +10542,7 @@ metadata:
   annotations: null
   labels:
     app: istio-ingressgateway
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: ingressgateway
     istio.io/rev: default
@@ -10616,7 +10579,7 @@ kind: Service
 metadata:
   labels:
     app: istiod
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
     install.operator.istio.io/owning-resource: unknown
     istio: pilot
     istio.io/rev: default
@@ -10647,14 +10610,14 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
   name: istio-system
 ---
 apiVersion: security.istio.io/v1beta1
 kind: PeerAuthentication
 metadata:
   labels:
-    cloudfoundry.org/istio_version: 1.14.2
+    cloudfoundry.org/istio_version: 1.14.3
   name: default
   namespace: istio-system
 spec:
diff --git a/config/istio/istio-version.star b/config/istio/istio-version.star
index 3811d76f8..7fa377e3e 100644
--- a/config/istio/istio-version.star
+++ b/config/istio/istio-version.star
@@ -1,3 +1,3 @@
 def istio_version():
-  return "1.14.2"
+  return "1.14.3"
 end
diff --git a/config/kpack/_ytt_lib/kpack/release-0.6.1.yaml b/config/kpack/_ytt_lib/kpack/release-0.5.4.yaml
similarity index 89%
rename from config/kpack/_ytt_lib/kpack/release-0.6.1.yaml
rename to config/kpack/_ytt_lib/kpack/release-0.5.4.yaml
index 58ecb9e4d..eafe50a57 100644
--- a/config/kpack/_ytt_lib/kpack/release-0.6.1.yaml
+++ b/config/kpack/_ytt_lib/kpack/release-0.5.4.yaml
@@ -266,39 +266,11 @@ spec:
 ---
 apiVersion: v1
 kind: ConfigMap
-metadata:
-  name: config-logging
-  namespace: kpack
-data:
-  zap-logger-config: |
-    {
-      "level": "info",
-      "development": false,
-      "outputPaths": ["stdout"],
-      "errorOutputPaths": ["stderr"],
-      "encoding": "json",
-      "encoderConfig": {
-        "timeKey": "ts",
-        "levelKey": "level",
-        "nameKey": "logger",
-        "callerKey": "caller",
-        "messageKey": "msg",
-        "stacktraceKey": "stacktrace",
-        "lineEnding": "",
-        "levelEncoder": "",
-        "timeEncoder": "rfc3339nano",
-        "durationEncoder": "",
-        "callerEncoder": ""
-      }
-    }
----
-apiVersion: v1
-kind: ConfigMap
 metadata:
   name: build-init-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/build-init@sha256:b1debaa42ad0141dcaf18f41e116d1ad52596ffd8fb6c554506157642ee64d6f
+  image: gcr.io/cf-build-service-public/kpack/build-init@sha256:c620cadd6e5787917f22b4d8a84d209571ab1eb159ca44be8276ecfb48689b7d
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -306,7 +278,7 @@ metadata:
   name: build-init-windows-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/build-init-windows@sha256:58e3e097dca779281ce4fe2838fee6f2bb3edba8723b0178ad9520ee1c82e4d0
+  image: gcr.io/cf-build-service-public/kpack/build-init-windows@sha256:b3015d03dd7fdac73d9e987e5edee5faecd77968d36a36ec6f944bfcebe76a8f
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -314,7 +286,7 @@ metadata:
   name: rebase-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/rebase@sha256:611c3e540f3ab88e453f94772df38626dc3cb00ae6ddc3b9f8350fafe4b9c1c3
+  image: gcr.io/cf-build-service-public/kpack/rebase@sha256:c465bbe70c770ef4b92274e4dace4e0fed90eda5789cf1846f0e1ec325e7e9b6
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -322,7 +294,7 @@ metadata:
   name: lifecycle-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/lifecycle@sha256:c7e8d312f79f5cf9918fd5c60191da9d34b750cc4183a159149835b88bf42721
+  image: gcr.io/cf-build-service-public/kpack/lifecycle@sha256:0a021eacdae3166f3f116948562cc6900138a80948345f8e9c240d7cb978289a
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -330,7 +302,7 @@ metadata:
   name: completion-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/completion@sha256:9e36ff4a1f0f00a5344ad37329b3f3ffff3cf7ae31492c7dbfe8e1a7eed3fb31
+  image: gcr.io/cf-build-service-public/kpack/completion@sha256:47a03c66872790ecaf1b53e88430cb165ac4c627c21a5ce5f5cdfc1f6c467c80
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -338,7 +310,7 @@ metadata:
   name: completion-windows-image
   namespace: kpack
 data:
-  image: gcr.io/cf-build-service-public/kpack/completion-windows@sha256:80f4981585dc5331386077bb8fb8a3eef53de591c6c70ec44990ed17bfcd6c9c
+  image: gcr.io/cf-build-service-public/kpack/completion-windows@sha256:46ec332ad95b7ba0440ef094755fb77d9ea5e53a6149a568576bf496256bfff3
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -354,18 +326,15 @@ spec:
     metadata:
       labels:
         app: kpack-controller
-        version: 0.6.1-rc.11
+        version: 0.5.4-rc.4
     spec:
-      priorityClassName: kpack-control-plane
       serviceAccountName: controller
       nodeSelector:
         kubernetes.io/os: linux
       containers:
       - name: controller
-        image: gcr.io/cf-build-service-public/kpack/controller@sha256:49f7ac6765c1d3db77c57419e357e5bf858182d0e93c1d047b69e60aca382631
+        image: gcr.io/cf-build-service-public/kpack/controller@sha256:d2e405dfa45ff53a5efbcee2b7e9b7313663daea2e0a5d1f904f701104255eb2
         env:
-        - name: ENABLE_PRIORITY_CLASSES
-          value: "false"
         - name: CONFIG_LOGGING_NAME
           value: config-logging
         - name: CONFIG_OBSERVABILITY_NAME
@@ -607,31 +576,6 @@ spec:
     - kpack
   scope: Namespaced
 ---
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: kpack-control-plane
-value: 10000
-globalDefault: false
-description: Super High priority class for kpack control plane components
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: kpack-build-high-priority
-value: 1000
-globalDefault: false
-description: High priority class for kpack builds triggered by user changes.
----
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: kpack-build-low-priority
-value: 1
-globalDefault: false
-preemptionPolicy: Never
-description: Low priority class for kpack builds triggered by operator changes.
----
 apiVersion: v1
 kind: Service
 metadata:
@@ -750,15 +694,14 @@ spec:
       labels:
         app: kpack-webhook
         role: webhook
-        version: 0.6.1-rc.11
+        version: 0.5.4-rc.4
     spec:
-      priorityClassName: kpack-control-plane
       serviceAccountName: webhook
       nodeSelector:
         kubernetes.io/os: linux
       containers:
       - name: webhook
-        image: gcr.io/cf-build-service-public/kpack/webhook@sha256:30208f7f0d895daad4046c0ac6ab0b373847777878ea68d531878dec992c4376
+        image: gcr.io/cf-build-service-public/kpack/webhook@sha256:79b104eed52cee728f64c2b3a6ddb42f2c93818c9b1e0c7264a6595af53a95d6
         ports:
         - name: https-webhook
           containerPort: 8443
diff --git a/config/kpack/default-buildpacks.yml b/config/kpack/default-buildpacks.yml
index 675577b1e..614fdbffb 100644
--- a/config/kpack/default-buildpacks.yml
+++ b/config/kpack/default-buildpacks.yml
@@ -11,12 +11,12 @@ spec:
   #! Ruby buildpacks releases > 0.11.0 are incompatible without a Procfile
   - image: gcr.io/paketo-buildpacks/ruby@sha256:19254ce071ad2139309280e0f88f19f7b44ff58e684c6ac834f48d1b87b946d5
   - image: gcr.io/paketo-buildpacks/python@sha256:f08de16aa7d8d225ee05543dd21910b67a7004d57290adfed11c6bf47b08ad64
-  - image: gcr.io/paketo-buildpacks/java@sha256:8d2173a4af33ea5389bc1477e336a828cfa2599f6f1e79464a9c9b603f7a584a
+  - image: gcr.io/paketo-buildpacks/java@sha256:70e549b12d5e6bcf50f56c0ebe18c8d3ba578a7d08fba7734eee636681304f9c
   - image: gcr.io/paketo-buildpacks/nodejs@sha256:9288250d56e686444bc5c21f7f333a5a4ebf910485aa2c56df84c181b099b69a
-  - image: gcr.io/paketo-buildpacks/go@sha256:afa5b221be6c70c65d6692d34157ac921677fb3555c8d0034d052dbe07147ddc
-  - image: gcr.io/paketo-buildpacks/dotnet-core@sha256:13f4d9445a07290edcd1a21c2f1ee109e888ecc68cd0344acf5d44eceb414576
+  - image: gcr.io/paketo-buildpacks/go@sha256:1ae4bdae5176370d4893d5200c02c92680bfe52ed6686788d239d9c334eb29a6
+  - image: gcr.io/paketo-buildpacks/dotnet-core@sha256:00c34046d924114155aaa489109a5c943445fa5cccf997ee95cf49b97d3246ef
   - image: gcr.io/paketo-buildpacks/php@sha256:c55493eb80d5b71e98bc2fc3eb051bc533b8d8f93e849b630de600bdb7090859
-  - image: gcr.io/paketo-buildpacks/procfile@sha256:6701ee01a2f358310feff0bb2b26bc7efc197768ae0249f2a40fa5950337e9db
+  - image: gcr.io/paketo-buildpacks/procfile@sha256:ac07bf7e11a43e9e946aaa6f1523a6c2d297ca95b8c022187eac5f5a5c6ddb12
 
 ---
 apiVersion: kpack.io/v1alpha1
diff --git a/vendir.lock.yml b/vendir.lock.yml
index dd83caeeb..d146191c2 100755
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -36,8 +36,8 @@ directories:
   path: config/uaa/_ytt_lib/uaa-k8s-release
 - contents:
   - githubRelease:
-      tag: v0.6.1
-      url: https://api.github.com/repos/pivotal/kpack/releases/72236905
+      tag: v0.5.4
+      url: https://api.github.com/repos/pivotal/kpack/releases/67967835
     path: .
   path: config/kpack/_ytt_lib/kpack
 - contents:
diff --git a/vendir.yml b/vendir.yml
index c80afd019..df6fd6f28 100644
--- a/vendir.yml
+++ b/vendir.yml
@@ -48,7 +48,7 @@ directories:
   - path: .
     githubRelease:
       slug: pivotal/kpack
-      tag: v0.6.1
+      tag: v0.5.4
       disableAutoChecksumValidation: true
     includePaths:
     - release-*.yaml