diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b6ee64157..4cfb6f109 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -14,6 +14,6 @@ repos:
     - id: check-merge-conflict
     - id: end-of-file-fixer
 - repo: https://github.com/renovatebot/pre-commit-hooks
-  rev: 37.152.1
+  rev: 37.154.0
   hooks:
     - id: renovate-config-validator
diff --git a/helm-dependencies.yaml b/helm-dependencies.yaml
index f93c4bfd6..1488a26ba 100644
--- a/helm-dependencies.yaml
+++ b/helm-dependencies.yaml
@@ -39,7 +39,7 @@ dependencies:
     version: 1.13.3
     repository: https://charts.fluxcd.io
   - name: ingress-nginx
-    version: 4.9.0
+    version: 4.9.1
     repository: https://kubernetes.github.io/ingress-nginx
   - name: k8gb
     version: v0.12.2
@@ -57,7 +57,7 @@ dependencies:
     version: 2.34.0
     repository: https://charts.konghq.com
   - name: kube-prometheus-stack
-    version: 56.1.0
+    version: 56.2.1
     repository: https://prometheus-community.github.io/helm-charts
   - name: linkerd2-cni
     version: 30.12.2
@@ -72,7 +72,7 @@ dependencies:
     version: 30.12.10
     repository: https://helm.linkerd.io/stable
   - name: loki
-    version: 5.41.8
+    version: 5.42.0
     repository: https://grafana.github.io/helm-charts
   - name: promtail
     version: 6.15.4
@@ -99,7 +99,7 @@ dependencies:
     version: 2.14.2
     repository: https://bitnami-labs.github.io/sealed-secrets
   - name: thanos
-    version: 12.22.0
+    version: 12.22.1
     repository: https://charts.bitnami.com/bitnami
   - name: tigera-operator
     version: v3.27.0
diff --git a/ingress-nginx.tf b/ingress-nginx.tf
index 56fdf14ce..1e869f340 100644
--- a/ingress-nginx.tf
+++ b/ingress-nginx.tf
@@ -14,6 +14,8 @@ locals {
       linkerd-viz-enabled    = false
       linkerd-viz-namespace  = "linkerd-viz"
       allowed_cidrs          = ["0.0.0.0/0"]
+      extra_ns_labels        = {}
+      extra_ns_annotations   = {}
     },
     var.ingress-nginx
   )
@@ -43,10 +45,15 @@ resource "kubernetes_namespace" "ingress-nginx" {
   count = local.ingress-nginx["enabled"] ? 1 : 0
 
   metadata {
-    labels = {
+    labels = merge({
       name                               = local.ingress-nginx["namespace"]
       "${local.labels_prefix}/component" = "ingress"
-    }
+      },
+    local.ingress-nginx["extra_ns_labels"])
+
+    annotations = merge(
+      local.ingress-nginx["extra_ns_annotations"]
+    )
 
     name = local.ingress-nginx["namespace"]
   }
diff --git a/modules/aws/ingress-nginx.tf b/modules/aws/ingress-nginx.tf
index b0993dd34..dce4ae89f 100644
--- a/modules/aws/ingress-nginx.tf
+++ b/modules/aws/ingress-nginx.tf
@@ -17,6 +17,8 @@ locals {
       linkerd-viz-namespace  = "linkerd-viz"
       ingress_cidrs          = ["0.0.0.0/0"]
       allowed_cidrs          = ["0.0.0.0/0"]
+      extra_ns_labels        = {}
+      extra_ns_annotations   = {}
     },
     var.ingress-nginx
   )
@@ -134,10 +136,15 @@ resource "kubernetes_namespace" "ingress-nginx" {
   count = local.ingress-nginx["enabled"] ? 1 : 0
 
   metadata {
-    labels = {
+    labels = merge({
       name                               = local.ingress-nginx["namespace"]
       "${local.labels_prefix}/component" = "ingress"
-    }
+      },
+    local.ingress-nginx["extra_ns_labels"])
+
+    annotations = merge(
+      local.ingress-nginx["extra_ns_annotations"]
+    )
 
     name = local.ingress-nginx["namespace"]
   }
diff --git a/modules/google/ingress-nginx.tf b/modules/google/ingress-nginx.tf
index 129b46f18..5fe7df90f 100644
--- a/modules/google/ingress-nginx.tf
+++ b/modules/google/ingress-nginx.tf
@@ -13,6 +13,8 @@ locals {
       default_network_policy = true
       ingress_cidrs          = ["0.0.0.0/0"]
       allowed_cidrs          = ["0.0.0.0/0"]
+      extra_ns_labels        = {}
+      extra_ns_annotations   = {}
     },
     var.ingress-nginx
   )
@@ -71,10 +73,15 @@ resource "kubernetes_namespace" "ingress-nginx" {
   count = local.ingress-nginx["enabled"] ? 1 : 0
 
   metadata {
-    labels = {
+    labels = merge({
       name                               = local.ingress-nginx["namespace"]
       "${local.labels_prefix}/component" = "ingress"
-    }
+      },
+    local.ingress-nginx["extra_ns_labels"])
+
+    annotations = merge(
+      local.ingress-nginx["extra_ns_annotations"]
+    )
 
     name = local.ingress-nginx["namespace"]
   }
diff --git a/modules/scaleway/ingress-nginx.tf b/modules/scaleway/ingress-nginx.tf
index 617b53607..65fe31bb6 100644
--- a/modules/scaleway/ingress-nginx.tf
+++ b/modules/scaleway/ingress-nginx.tf
@@ -14,6 +14,8 @@ locals {
       linkerd-viz-namespace  = "linkerd-viz"
       ingress_cidrs          = ["0.0.0.0/0"]
       allowed_cidrs          = ["0.0.0.0/0"]
+      extra_ns_labels        = {}
+      extra_ns_annotations   = {}
     },
     var.ingress-nginx
   )
@@ -51,10 +53,15 @@ resource "kubernetes_namespace" "ingress-nginx" {
   count = local.ingress-nginx["enabled"] ? 1 : 0
 
   metadata {
-    labels = {
+    labels = merge({
       name                               = local.ingress-nginx["namespace"]
       "${local.labels_prefix}/component" = "ingress"
-    }
+      },
+    local.ingress-nginx["extra_ns_labels"])
+
+    annotations = merge(
+      local.ingress-nginx["extra_ns_annotations"]
+    )
 
     name = local.ingress-nginx["namespace"]
   }