diff --git a/.github/workflows/update_protobufs.yml b/.github/workflows/update_protobufs.yml
index 7ce767370..f1c92b860 100644
--- a/.github/workflows/update_protobufs.yml
+++ b/.github/workflows/update_protobufs.yml
@@ -17,9 +17,9 @@ jobs:
 
       - name: Download nanopb
         run: |
-          wget https://jpa.kapsi.fi/nanopb/download/nanopb-0.4.8-linux-x86.tar.gz
-          tar xvzf nanopb-0.4.8-linux-x86.tar.gz
-          mv nanopb-0.4.8-linux-x86 nanopb-0.4.8
+          wget https://jpa.kapsi.fi/nanopb/download/nanopb-0.4.9-linux-x86.tar.gz
+          tar xvzf nanopb-0.4.9-linux-x86.tar.gz
+          mv nanopb-0.4.9-linux-x86 nanopb-0.4.9
 
       - name: Re-generate protocol buffers
         run: |
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 9ed720c3f..ea4045a16 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -11,7 +11,7 @@ lint:
     - trufflehog@3.82.6
     - yamllint@1.35.1
     - bandit@1.7.10
-    - checkov@3.2.255
+    - checkov@3.2.256
     - terrascan@1.19.1
     - trivy@0.55.2
     #- trufflehog@3.63.2-rc0
@@ -28,7 +28,7 @@ lint:
     - shellcheck@0.10.0
     - black@24.8.0
     - git-diff-check
-    - gitleaks@8.19.3
+    - gitleaks@8.20.0
     - clang-format@16.0.3
     - prettier@3.3.3
   ignore:
diff --git a/bin/regen-protos.bat b/bin/regen-protos.bat
index f28ef0025..7fa8f333d 100644
--- a/bin/regen-protos.bat
+++ b/bin/regen-protos.bat
@@ -1 +1 @@
-cd protobufs && ..\nanopb-0.4.8\generator-bin\protoc.exe --experimental_allow_proto3_optional "--nanopb_out=-S.cpp -v:..\src\mesh\generated" -I=..\protobufs\ ..\protobufs\meshtastic\*.proto
+cd protobufs && ..\nanopb-0.4.9\generator-bin\protoc.exe --experimental_allow_proto3_optional "--nanopb_out=-S.cpp -v:..\src\mesh\generated" -I=..\protobufs\ ..\protobufs\meshtastic\*.proto
diff --git a/bin/regen-protos.sh b/bin/regen-protos.sh
index 2e60784e3..12546bfdc 100755
--- a/bin/regen-protos.sh
+++ b/bin/regen-protos.sh
@@ -2,10 +2,10 @@
 
 set -e
 
-echo "This script requires https://jpa.kapsi.fi/nanopb/download/ version 0.4.8 to be located in the"
+echo "This script requires https://jpa.kapsi.fi/nanopb/download/ version 0.4.9 to be located in the"
 echo "firmware root directory if the following step fails, you should download the correct"
-echo "prebuilt binaries for your computer into nanopb-0.4.8"
+echo "prebuilt binaries for your computer into nanopb-0.4.9"
 
 # the nanopb tool seems to require that the .options file be in the current directory!
 cd protobufs
-../nanopb-0.4.8/generator-bin/protoc --experimental_allow_proto3_optional "--nanopb_out=-S.cpp -v:../src/mesh/generated/" -I=../protobufs meshtastic/*.proto
+../nanopb-0.4.9/generator-bin/protoc --experimental_allow_proto3_optional "--nanopb_out=-S.cpp -v:../src/mesh/generated/" -I=../protobufs meshtastic/*.proto