diff --git a/.gitmodules b/.gitmodules
index 87a3514a99..8c526a5b28 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -14,15 +14,3 @@
 [submodule "src/code.cloudfoundry.org/credhub-cli"]
 	path = src/code.cloudfoundry.org/credhub-cli
 	url = https://github.com/cloudfoundry-incubator/credhub-cli/
-[submodule "src/garden"]
-	path = src/garden
-	url = https://github.com/cloudfoundry/garden
-[submodule "src/guardian"]
-	path = src/guardian
-	url = https://github.com/cloudfoundry/guardian
-[submodule "src/grootfs"]
-	path = src/grootfs
-	url = https://github.com/cloudfoundry/grootfs
-[submodule "src/idmapper"]
-	path = src/idmapper
-	url = https://github.com/cloudfoundry/idmapper
diff --git a/src/code.cloudfoundry.org/go.mod b/src/code.cloudfoundry.org/go.mod
index 37ac28491b..011d41e4db 100644
--- a/src/code.cloudfoundry.org/go.mod
+++ b/src/code.cloudfoundry.org/go.mod
@@ -3,15 +3,13 @@ module code.cloudfoundry.org
 go 1.26.5
 
 replace (
-	code.cloudfoundry.org/garden => ../garden
-	code.cloudfoundry.org/grootfs => ../grootfs
-	code.cloudfoundry.org/guardian => ../guardian
-	code.cloudfoundry.org/idmapper => ../idmapper
+	code.cloudfoundry.org/guardian => github.com/cloudfoundry/guardian v0.0.0-20260731120748-50a535ff5c03
 	github.com/cactus/go-statsd-client => github.com/cactus/go-statsd-client v2.0.2-0.20150911070441-6fa055a7b594+incompatible
+	github.com/cilium/ebpf => github.com/cilium/ebpf v0.17.3
 )
 
 require (
-	code.cloudfoundry.org/archiver v0.80.0
+	code.cloudfoundry.org/archiver v0.81.0
 	code.cloudfoundry.org/bbs v1.11.0
 	code.cloudfoundry.org/bbs/encryption v1.9.0
 	code.cloudfoundry.org/bbs/format v1.9.0
@@ -27,11 +25,11 @@ require (
 	code.cloudfoundry.org/dockerdriver v0.99.0
 	code.cloudfoundry.org/durationjson v0.82.0
 	code.cloudfoundry.org/eventhub v0.82.0
-	code.cloudfoundry.org/garden v0.0.0-20260722020902-0d62a2590a0f
+	code.cloudfoundry.org/garden v0.0.0-20260729020900-a0441c36f7b5
 	code.cloudfoundry.org/go-loggregator/v9 v9.2.1
 	code.cloudfoundry.org/goshims v0.107.0
 	code.cloudfoundry.org/guardian v0.0.0-20260722021324-599e660ac834
-	code.cloudfoundry.org/lager/v3 v3.79.0
+	code.cloudfoundry.org/lager/v3 v3.80.0
 	code.cloudfoundry.org/localip v0.82.0
 	code.cloudfoundry.org/locket v1.5.0
 	code.cloudfoundry.org/routing-api v0.7.0
@@ -80,7 +78,7 @@ require (
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sys v0.47.0
 	golang.org/x/time v0.15.0
-	google.golang.org/grpc v1.82.1
+	google.golang.org/grpc v1.83.0
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -222,7 +220,7 @@ require (
 	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/tools v0.48.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 // indirect
 	gorm.io/driver/mysql v1.6.0 // indirect
 	gorm.io/driver/postgres v1.6.0 // indirect
 	gorm.io/gorm v1.31.2 // indirect
diff --git a/src/code.cloudfoundry.org/go.sum b/src/code.cloudfoundry.org/go.sum
index 686c7c4762..aa33b00ccc 100644
--- a/src/code.cloudfoundry.org/go.sum
+++ b/src/code.cloudfoundry.org/go.sum
@@ -594,8 +594,8 @@ cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoIS
 cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
 cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
 cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
-code.cloudfoundry.org/archiver v0.80.0 h1:QghPcLMZKk3KATnfBQcjlXoFemAZPcl897WdifBx4mU=
-code.cloudfoundry.org/archiver v0.80.0/go.mod h1:teFJOAko+bWVrZClYPoqTEFxF/8Pn7r6U8DWHAD6qRs=
+code.cloudfoundry.org/archiver v0.81.0 h1:rgKXuUH0mwlB8yep+qNIKqjcoKbevWY0G8O2ToNPRuk=
+code.cloudfoundry.org/archiver v0.81.0/go.mod h1:j0ICCxoNIpveqUrxceaMWBhi3yRGxFhFVlFafWMjBfE=
 code.cloudfoundry.org/bbs v1.11.0 h1:w8Q+ORAmTW+nmHwWROrfCqtM5U2p7rOfmIDNqWJLQKM=
 code.cloudfoundry.org/bbs v1.11.0/go.mod h1:AZp+BWN9K/9A5KiQ7KT+F5V8nWDkBFN4ieGAg40OFXI=
 code.cloudfoundry.org/bbs/encryption v1.9.0 h1:1IiWKO4nqJonCi0JeoIVobPsTE8FRhbB9Fq1MRTikEA=
@@ -630,14 +630,16 @@ code.cloudfoundry.org/durationjson v0.82.0 h1:Mk6NQUxM7voITbJzy9vqooCP+R6slZ/P3T
 code.cloudfoundry.org/durationjson v0.82.0/go.mod h1:2ta2CwA+djptmVLDiMk0euVr2szlz35e68mfkvhJMdw=
 code.cloudfoundry.org/eventhub v0.82.0 h1:nRyUCUzUiQZHGdrZcT5jqSjUUC1Vz11zAbZpV6W2h/Y=
 code.cloudfoundry.org/eventhub v0.82.0/go.mod h1:yT3TSOxgQCHAnkezTEvlsermZY2QIj6upmkRzzYxKvE=
+code.cloudfoundry.org/garden v0.0.0-20260729020900-a0441c36f7b5 h1:XkYjJPCMKYr7sg2N+AoTmI0ydyoGGGF5H5HeNLfrWhw=
+code.cloudfoundry.org/garden v0.0.0-20260729020900-a0441c36f7b5/go.mod h1:G6RXuzjLFtbH+so/mHseQwDG6LQEaR75GAGlzzrRjQo=
 code.cloudfoundry.org/go-diodes v0.0.0-20260720065427-59f65622c841 h1:zvumGkVYJgjVJZo/BCcc2HSMVO2BLvrX0wCg+KLvT20=
 code.cloudfoundry.org/go-diodes v0.0.0-20260720065427-59f65622c841/go.mod h1:czNfbIZFq2IWuL5+OYO/zlEzOL3rbWPfOVIuymG9la4=
 code.cloudfoundry.org/go-loggregator/v9 v9.2.1 h1:S6Lgg5UJbhh2bt2TGQxs6R00CF8PrUA3GFPYDxy56Fk=
 code.cloudfoundry.org/go-loggregator/v9 v9.2.1/go.mod h1:FTFFruqGeOhVCDFvyLgl8EV8YW63NNwRzLhxJcporu8=
 code.cloudfoundry.org/goshims v0.107.0 h1:inbML8AaLXVELnqbrOXDuYkM66duK8qb1vQg/IFis44=
 code.cloudfoundry.org/goshims v0.107.0/go.mod h1:uICsJV2LXpBvmAgjoaNm3T+EixSJwD80Ng8MtD30Nto=
-code.cloudfoundry.org/lager/v3 v3.79.0 h1:smCMi1gjwx41bYoP5Czgi+wzEecC58rS6HKDxBMWM9g=
-code.cloudfoundry.org/lager/v3 v3.79.0/go.mod h1:7ugnISYee5tuV8vCot1Gn+oIhssl4KErf5TlPwtU7qk=
+code.cloudfoundry.org/lager/v3 v3.80.0 h1:TYFCcCQ2lG+kEN+3NJiUvXRhWTsW5Ju14xmV429YaT0=
+code.cloudfoundry.org/lager/v3 v3.80.0/go.mod h1:08ujODr8WeHIekdvjPTMDGTXpbc5lpbPpFbkOTJw6v8=
 code.cloudfoundry.org/localip v0.82.0 h1:ZAJAB4R1v1wUAqaoDHNERi6e7gFKmWMdAvbj3PYJfl4=
 code.cloudfoundry.org/localip v0.82.0/go.mod h1:bj+jelfPgqSusGYmOcQSXp+O1JUdr/n8Fkm7GN4JkOs=
 code.cloudfoundry.org/locket v1.5.0 h1:KM443ZrNUTmPn/xjsNvsG13eCult//etG48FxLYyDcY=
@@ -802,6 +804,8 @@ github.com/cloudfoundry/dropsonde v1.1.0 h1:nerhj8K0heOsv/U/Ddou5Esw56YlNeHHJH6M
 github.com/cloudfoundry/dropsonde v1.1.0/go.mod h1:OrkxsBrAvM8X0Ve9vaSNKLR+/Jeohu3+J0M4JEaTmnM=
 github.com/cloudfoundry/go-socks5 v0.0.0-20250423223041-4ad5fea42851 h1:oy59UYcspoP44ggE8DM3kjxl1+sTFd802bbZlBBhBMk=
 github.com/cloudfoundry/go-socks5 v0.0.0-20250423223041-4ad5fea42851/go.mod h1:72EEm1oq5oXqGfu9XGtaRPWEcAFYd/P10cMNln0QhA8=
+github.com/cloudfoundry/guardian v0.0.0-20260731120748-50a535ff5c03 h1:lh+M/xiuPAjo9rpG1VW85S9JM0wxxSZcIZliRodciUA=
+github.com/cloudfoundry/guardian v0.0.0-20260731120748-50a535ff5c03/go.mod h1:EPDWErc/hL71FwVrGq5ukQhBhjohyiA4mSIdenbIfv0=
 github.com/cloudfoundry/socks5-proxy v0.2.183 h1:QgkOB5Od0pzRtyZPQotD6USsxuo13GyhmrAiA0nzjkg=
 github.com/cloudfoundry/socks5-proxy v0.2.183/go.mod h1:tnJUhAsMqnBPAt+p+SsNsaAo4lrqxYlpDHD+uURZX4s=
 github.com/cloudfoundry/sonde-go v0.0.0-20260720065356-6728909ed72b h1:QoG349bugPqkb8XqPgZbf6VWyAuh3ONbTJ5aKazvbeQ=
@@ -2108,8 +2112,8 @@ google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOl
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 h1:4namukbyF7JY83aWHQwi9J5ugNTnDReLJ9ZcpqOpRB4=
 google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772/go.mod h1:1brfde68Npq6+WA75c1EHWPijZEG1kMus61ygPZfn4A=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772 h1:zuslGE3FGxH0hC6veLvSLME3TZzun9MQzjYwo1CBN+k=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 h1:mJiOtnGp0k/BcSgdu03G2NwnscCfCH+h2QKUBZr18KI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -2152,8 +2156,8 @@ google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5v
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
 google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
+google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/examples v0.0.0-20230512210959-5dcfb37c0b43/go.mod h1:irORyHPQXotoshbRTZVFvPDcfTfFHL23efQeop+H45M=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
diff --git a/src/code.cloudfoundry.org/inigo/bin/test.bash b/src/code.cloudfoundry.org/inigo/bin/test.bash
index b0fabb0975..30162783a9 100755
--- a/src/code.cloudfoundry.org/inigo/bin/test.bash
+++ b/src/code.cloudfoundry.org/inigo/bin/test.bash
@@ -81,7 +81,6 @@ setup_diego_release() {
   pushd ${DIEGO_RELEASE_PATH}
 
   export CODE_CLOUDFOUNDRY_ORG_MODULE="$PWD/src/code.cloudfoundry.org"
-  export GUARDIAN_MODULE="$PWD/src/guardian"
   popd
 }
 
@@ -168,7 +167,7 @@ export REP_GOPATH=${CODE_CLOUDFOUNDRY_ORG_MODULE}
 export ROUTE_EMITTER_GOPATH=${CODE_CLOUDFOUNDRY_ORG_MODULE}
 export SSHD_GOPATH=${CODE_CLOUDFOUNDRY_ORG_MODULE}
 export SSH_PROXY_GOPATH=${CODE_CLOUDFOUNDRY_ORG_MODULE}
-export GARDEN_GOPATH=${GUARDIAN_MODULE}
+export GARDEN_GOPATH=${CODE_CLOUDFOUNDRY_ORG_MODULE}
 
 # used for routing to apps; same logic that Garden uses.
 EXTERNAL_ADDRESS=$(ip route get 8.8.8.8 | sed 's/.*src\s\(.*\)\suid.*/\1/;tx;d;:x')
diff --git a/src/code.cloudfoundry.org/inigo/bin/test.ps1 b/src/code.cloudfoundry.org/inigo/bin/test.ps1
index c5c2375cb5..ff5c22408e 100644
--- a/src/code.cloudfoundry.org/inigo/bin/test.ps1
+++ b/src/code.cloudfoundry.org/inigo/bin/test.ps1
@@ -88,7 +88,6 @@ Setup-DnsNames
 Setup-TempDirContainerAccess
 
 $env:CODE_CLOUDFOUNDRY_ORG_MODULE="$env:DIEGO_RELEASE_PATH/src/code.cloudfoundry.org"
-$env:GUARDIAN_MODULE="$env:DIEGO_RELEASE_PATH/src/guardian"
 $env:ROUTER_GOPATH="$env:ROUTING_RELEASE_PATH\src\code.cloudfoundry.org"
 $env:ROUTING_API_GOPATH=$env:ROUTER_GOPATH
 $env:APP_LIFECYCLE_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
@@ -101,7 +100,7 @@ $env:REP_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
 $env:ROUTE_EMITTER_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
 $env:SSHD_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
 $env:SSH_PROXY_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
-$env:GARDEN_GOPATH=${env:GUARDIAN_MODULE}
+$env:GARDEN_GOPATH=${env:CODE_CLOUDFOUNDRY_ORG_MODULE}
 
 # used for routing to apps; same logic that Garden uses.
 $ipAddressObject = Find-NetRoute -RemoteIPAddress "8.8.8.8" | Select-Object IpAddress
diff --git a/src/code.cloudfoundry.org/inigo/cell/cell_suite_test.go b/src/code.cloudfoundry.org/inigo/cell/cell_suite_test.go
index 5190619443..155f88a4e2 100644
--- a/src/code.cloudfoundry.org/inigo/cell/cell_suite_test.go
+++ b/src/code.cloudfoundry.org/inigo/cell/cell_suite_test.go
@@ -248,12 +248,8 @@ func CompileTestedExecutables() world.BuiltExecutables {
 
 	builtExecutables := world.BuiltExecutables{}
 
-	cwd, err := os.Getwd()
+	builtExecutables["garden"], err = gexec.Build("code.cloudfoundry.org/guardian/cmd/gdn", "-race", "-a", "-tags", "daemon")
 	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(os.Getenv("GARDEN_GOPATH"))).To(Succeed())
-	builtExecutables["garden"], err = gexec.Build("./cmd/gdn", "-race", "-a", "-tags", "daemon")
-	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(cwd)).To(Succeed())
 
 	builtExecutables["auctioneer"], err = gexec.Build("code.cloudfoundry.org/auctioneer/cmd/auctioneer", "-race")
 	Expect(err).NotTo(HaveOccurred())
@@ -274,6 +270,8 @@ func CompileTestedExecutables() world.BuiltExecutables {
 	Expect(err).NotTo(HaveOccurred())
 
 	if runtime.GOOS != "windows" {
+		cwd, err := os.Getwd()
+		Expect(err).NotTo(HaveOccurred())
 		Expect(os.Chdir(os.Getenv("ROUTER_GOPATH"))).To(Succeed())
 		builtExecutables["router"], err = gexec.Build("code.cloudfoundry.org/gorouter/cmd/gorouter", "-race")
 		Expect(err).NotTo(HaveOccurred())
diff --git a/src/code.cloudfoundry.org/inigo/executor/executor_suite_test.go b/src/code.cloudfoundry.org/inigo/executor/executor_suite_test.go
index dbbe764284..710b6badcf 100644
--- a/src/code.cloudfoundry.org/inigo/executor/executor_suite_test.go
+++ b/src/code.cloudfoundry.org/inigo/executor/executor_suite_test.go
@@ -120,12 +120,8 @@ func CompileTestedExecutables() world.BuiltExecutables {
 
 	builtExecutables := world.BuiltExecutables{}
 
-	cwd, err := os.Getwd()
+	builtExecutables["garden"], err = gexec.Build("code.cloudfoundry.org/guardian/cmd/gdn", "-race", "-a", "-tags", "daemon")
 	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(os.Getenv("GARDEN_GOPATH"))).To(Succeed())
-	builtExecutables["garden"], err = gexec.Build("./cmd/gdn", "-race", "-a", "-tags", "daemon")
-	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(cwd)).To(Succeed())
 
 	return builtExecutables
 }
diff --git a/src/code.cloudfoundry.org/inigo/volman/volman_suite_test.go b/src/code.cloudfoundry.org/inigo/volman/volman_suite_test.go
index 775555eb26..1af4a15f45 100644
--- a/src/code.cloudfoundry.org/inigo/volman/volman_suite_test.go
+++ b/src/code.cloudfoundry.org/inigo/volman/volman_suite_test.go
@@ -219,11 +219,8 @@ func CompileTestedExecutables() world.BuiltExecutables {
 
 	builtExecutables := world.BuiltExecutables{}
 
+	builtExecutables["garden"], err = gexec.Build("code.cloudfoundry.org/guardian/cmd/gdn", "-race", "-a", "-tags", "daemon")
 	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(os.Getenv("GARDEN_GOPATH"))).To(Succeed())
-	builtExecutables["garden"], err = gexec.Build("./cmd/gdn", "-race", "-a", "-tags", "daemon")
-	Expect(err).NotTo(HaveOccurred())
-	Expect(os.Chdir(cwd)).To(Succeed())
 
 	builtExecutables["local-driver"], err = gexec.Build("code.cloudfoundry.org/localdriver/cmd/localdriver", "-race")
 	Expect(err).NotTo(HaveOccurred())
diff --git a/src/code.cloudfoundry.org/vendor/code.cloudfoundry.org/guardian/rundmc/containerizer.go b/src/code.cloudfoundry.org/vendor/code.cloudfoundry.org/guardian/rundmc/containerizer.go
index 910b7bcf3a..7643e361b5 100644
--- a/src/code.cloudfoundry.org/vendor/code.cloudfoundry.org/guardian/rundmc/containerizer.go
+++ b/src/code.cloudfoundry.org/vendor/code.cloudfoundry.org/guardian/rundmc/containerizer.go
@@ -384,6 +384,7 @@ func (c *Containerizer) Info(log lager.Logger, handle string) (spec.ActualContai
 		Stopped:    c.states.IsStopped(handle),
 		Limits: garden.Limits{
 			CPU: garden.CPULimits{
+				//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 				LimitInShares: cpuShares,
 			},
 			Memory: garden.MemoryLimits{
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn.go
index c4bca5203e..b27c7e84a3 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn.go
@@ -24,12 +24,10 @@ import (
 	"fmt"
 	"math"
 	"net/url"
-	"os"
 	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 
 	"google.golang.org/grpc/balancer"
@@ -1573,26 +1571,13 @@ func (ac *addrConn) createTransport(ctx context.Context, addr resolver.Address,
 // to the provided transport.GoAwayInfo, as specified by gRFC A94:
 // https://github.com/grpc/proposal/blob/master/A94-grpc-subchannel-disconnections-metrics.md
 func disconnectErrorString(info transport.GoAwayInfo) string {
-	err := info.Err
-	var sysErr syscall.Errno
-	switch {
-	case info.Reason != transport.GoAwayInvalid:
+	if info.Reason != transport.GoAwayInvalid {
 		return fmt.Sprintf("GOAWAY %s", info.GoAwayCode.String())
-	case err == nil:
-		return "unknown"
-	case errors.Is(err, context.Canceled):
-		return "subchannel shutdown"
-	case errors.Is(err, syscall.ECONNRESET):
-		return "connection reset"
-	case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
-		return "connection timed out"
-	case errors.Is(err, syscall.ECONNABORTED):
-		return "connection aborted"
-	case errors.As(err, &sysErr):
-		return "socket error"
-	default:
+	}
+	if info.Err == nil {
 		return "unknown"
 	}
+	return disconnectErrorLabel(info.Err)
 }
 
 // startHealthCheck starts the health checking stream (RPC) to watch the health
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go
new file mode 100644
index 0000000000..f0fcd88423
--- /dev/null
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go
@@ -0,0 +1,48 @@
+//go:build !plan9
+
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"os"
+	"syscall"
+)
+
+// disconnectErrorLabel returns the grpc.disconnect_error metric label for a
+// transport error, as specified by gRFC A94.
+func disconnectErrorLabel(err error) string {
+	var sysErr syscall.Errno
+	switch {
+	case errors.Is(err, context.Canceled):
+		return "subchannel shutdown"
+	case errors.Is(err, syscall.ECONNRESET):
+		return "connection reset"
+	case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
+		return "connection timed out"
+	case errors.Is(err, syscall.ECONNABORTED):
+		return "connection aborted"
+	case errors.As(err, &sysErr):
+		return "socket error"
+	default:
+		return "unknown"
+	}
+}
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go
new file mode 100644
index 0000000000..930b12664c
--- /dev/null
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go
@@ -0,0 +1,39 @@
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"os"
+)
+
+// disconnectErrorLabel returns the grpc.disconnect_error metric label for a
+// transport error, as specified by gRFC A94. syscall.Errno does not exist on
+// plan9, so only the portable classifications are available.
+func disconnectErrorLabel(err error) string {
+	switch {
+	case errors.Is(err, context.Canceled):
+		return "subchannel shutdown"
+	case errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
+		return "connection timed out"
+	default:
+		return "unknown"
+	}
+}
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/envconfig/xds.go
index a2312f8eac..e4b6919138 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/envconfig/xds.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/envconfig/xds.go
@@ -69,9 +69,8 @@ var (
 	// https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
 	XDSSPIFFEEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE", false)
 
-	// XDSHTTPConnectEnabled is true if gRPC should parse custom Metadata
-	// configuring use of an HTTP CONNECT proxy via xDS from cluster resources.
-	// For more details, see:
+	// XDSHTTPConnectEnabled controls support for dynamic HTTP CONNECT proxying
+	// configured via the xDS control plane. For more details, see:
 	// https://github.com/grpc/proposal/blob/master/A86-xds-http-connect.md
 	XDSHTTPConnectEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT", false)
 
@@ -88,7 +87,7 @@ var (
 	// XDSORCAToLRSPropEnabled controls whether ORCA metrics are explicitly
 	// filtered and prefix-propagated to the LRS server. For more details, see:
 	// https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md
-	XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", false)
+	XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", true)
 
 	// XDSClientExtProcEnabled indicates whether ExtProc filter is enabled on
 	// the client side. For more details, see:
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
index 9b6d8a1fa3..d4999fcca8 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
@@ -20,10 +20,15 @@ package grpcsync
 
 import (
 	"context"
+	"errors"
 
 	"google.golang.org/grpc/internal/buffer"
 )
 
+// ErrSerializerClosed is returned by ScheduleAndWait if the CallbackSerializer
+// was closed before the callback could be scheduled.
+var ErrSerializerClosed = errors.New("callback serializer is closed")
+
 // CallbackSerializer provides a mechanism to schedule callbacks in a
 // synchronized manner. It provides a FIFO guarantee on the order of execution
 // of scheduled callbacks. New callbacks can be scheduled by invoking the
@@ -77,6 +82,27 @@ func (cs *CallbackSerializer) ScheduleOr(f func(ctx context.Context), onFailure
 	}
 }
 
+// ScheduleAndWait schedules the provided callback function f to be executed in
+// the order it was added and blocks until f has run. If the context passed to
+// NewCallbackSerializer was canceled before this method is called, f is not run
+// and ScheduleAndWait returns ErrSerializerClosed.
+//
+// Callbacks are expected to honor the context when performing any blocking
+// operations, and should return early when the context is canceled.
+func (cs *CallbackSerializer) ScheduleAndWait(f func(ctx context.Context)) error {
+	done := make(chan struct{})
+	var err error
+	cs.ScheduleOr(func(ctx context.Context) {
+		f(ctx)
+		close(done)
+	}, func() {
+		err = ErrSerializerClosed
+		close(done)
+	})
+	<-done
+	return err
+}
+
 func (cs *CallbackSerializer) run(ctx context.Context) {
 	defer close(cs.done)
 
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/config_selector.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
index 6320e9b576..238950bbbf 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
@@ -24,7 +24,6 @@ import (
 	"sync"
 
 	"google.golang.org/grpc/internal/serviceconfig"
-	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/resolver"
 )
 
@@ -52,82 +51,7 @@ type RPCConfig struct {
 	Context      context.Context
 	MethodConfig serviceconfig.MethodConfig // configuration to use for this RPC
 	OnCommitted  func()                     // Called when the RPC has been committed (retries no longer possible)
-	Interceptor  ClientInterceptor
-}
-
-// ClientStream is the same as grpc.ClientStream, but defined here for circular
-// dependency reasons.
-type ClientStream interface {
-	// Header returns the header metadata received from the server if there
-	// is any. It blocks if the metadata is not ready to read.
-	Header() (metadata.MD, error)
-	// Trailer returns the trailer metadata from the server, if there is any.
-	// It must only be called after stream.CloseAndRecv has returned, or
-	// stream.Recv has returned a non-nil error (including io.EOF).
-	Trailer() metadata.MD
-	// CloseSend closes the send direction of the stream. It closes the stream
-	// when non-nil error is met. It is also not safe to call CloseSend
-	// concurrently with SendMsg.
-	CloseSend() error
-	// Context returns the context for this stream.
-	//
-	// It should not be called until after Header or RecvMsg has returned. Once
-	// called, subsequent client-side retries are disabled.
-	Context() context.Context
-	// SendMsg is generally called by generated code. On error, SendMsg aborts
-	// the stream. If the error was generated by the client, the status is
-	// returned directly; otherwise, io.EOF is returned and the status of
-	// the stream may be discovered using RecvMsg.
-	//
-	// SendMsg blocks until:
-	//   - There is sufficient flow control to schedule m with the transport, or
-	//   - The stream is done, or
-	//   - The stream breaks.
-	//
-	// SendMsg does not wait until the message is received by the server. An
-	// untimely stream closure may result in lost messages. To ensure delivery,
-	// users should ensure the RPC completed successfully using RecvMsg.
-	//
-	// It is safe to have a goroutine calling SendMsg and another goroutine
-	// calling RecvMsg on the same stream at the same time, but it is not safe
-	// to call SendMsg on the same stream in different goroutines. It is also
-	// not safe to call CloseSend concurrently with SendMsg.
-	SendMsg(m any) error
-	// RecvMsg blocks until it receives a message into m or the stream is
-	// done. It returns io.EOF when the stream completes successfully. On
-	// any other error, the stream is aborted and the error contains the RPC
-	// status.
-	//
-	// It is safe to have a goroutine calling SendMsg and another goroutine
-	// calling RecvMsg on the same stream at the same time, but it is not
-	// safe to call RecvMsg on the same stream in different goroutines.
-	RecvMsg(m any) error
-}
-
-// ClientInterceptor is an interceptor for gRPC client streams.
-type ClientInterceptor interface {
-	// NewStream creates a ClientStream for an RPC.
-	//
-	// Implementations must delegate stream creation to the provided newStream
-	// function. To intercept or override stream behavior, implementations
-	// may wrap the ClientStream returned by the delegate.
-	//
-	// Note: RPCInfo.Context is currently unused and will be nil.
-	//
-	// The done function is invoked when the RPC has finished using its
-	// underlying connection or if a connection could not be assigned. Because
-	// interceptors operate at the application layer, RPC operations may
-	// continue on the ClientStream even after done has been called. The
-	// caller must ensure done is non-nil.
-	//
-	// To ensure RPC completion notifications propagate through the entire
-	// interceptor chain, implementations must ensure that the done function
-	// passed to the delegate newStream invokes the done function passed to
-	// NewStream.
-	NewStream(ctx context.Context, ri RPCInfo, done func(), newStream func(ctx context.Context, done func()) (ClientStream, error)) (ClientStream, error)
-	// Close closes the interceptor. Once called, no new calls to NewStream are
-	// accepted. Ongoing calls to NewStream are allowed to complete.
-	Close()
+	Interceptor  any
 }
 
 // ServerInterceptor is an interceptor for incoming RPC's on gRPC server side.
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/client_stream.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/client_stream.go
index ad382b0fda..046f0a5557 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/client_stream.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/client_stream.go
@@ -39,9 +39,8 @@ const nonGRPCDataMaxLen = 1024
 type ClientStream struct {
 	Stream // Embed for common stream functionality.
 
-	ct       *http2Client
-	done     chan struct{} // closed at the end of stream to unblock writers.
-	doneFunc func()        // invoked at the end of stream.
+	ct   *http2Client
+	done chan struct{} // closed at the end of stream to unblock writers.
 
 	headerChan chan struct{} // closed to indicate the end of header metadata.
 	header     metadata.MD   // the received header metadata
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/http2_client.go
index 822c09ba62..c19b45080e 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/http2_client.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -498,7 +498,6 @@ func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr, handler s
 		ct:           t,
 		done:         make(chan struct{}),
 		headerChan:   make(chan struct{}),
-		doneFunc:     callHdr.DoneFunc,
 		statsHandler: handler,
 	}
 	s.Stream.buf.init()
@@ -998,9 +997,6 @@ func (t *http2Client) closeStream(s *ClientStream, err error, rst bool, rstCode
 	t.controlBuf.executeAndPut(addBackStreamQuota, cleanup)
 	// This will unblock write.
 	close(s.done)
-	if s.doneFunc != nil {
-		s.doneFunc()
-	}
 }
 
 // Close kicks off the shutdown process of the transport. This should be called
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/transport.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/transport.go
index 6dfae39849..d2e49538f0 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/transport.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -594,8 +594,6 @@ type CallHdr struct {
 
 	PreviousAttempts int // value of grpc-previous-rpc-attempts header to set
 
-	DoneFunc func() // called when the stream is finished
-
 	// Authority is used to explicitly override the `:authority` header.
 	//
 	// This value comes from one of two sources:
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/stream.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/stream.go
index 4aac644a83..51aff85dfb 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/stream.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/stream.go
@@ -201,6 +201,15 @@ func endOfClientStream(cc *ClientConn, err error, opts ...CallOption) {
 	}
 }
 
+// clientInterceptor is structurally identical to the ClientInterceptor defined
+// in internal/xds/httpfilter/httpfilter.go. It is defined locally here so that
+// we can type-assert the generic Interceptor field in iresolver.RPCConfig
+// without introducing a dependency on xDS packages.
+type clientInterceptor interface {
+	NewStream(ctx context.Context, ri iresolver.RPCInfo, newStream func(ctx context.Context, opts ...CallOption) (ClientStream, error), opts ...CallOption) (ClientStream, error)
+	Close()
+}
+
 func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
 	if channelz.IsOn() {
 		cc.incrCallsStarted()
@@ -244,8 +253,11 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 
 	mc := &emptyMethodConfig
 	var onCommit func()
-	newStream := func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
-		return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, done, nameResolutionDelayed, opts...)
+	newStream := func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) {
+		if filterOpts != nil {
+			opts = combine(opts, filterOpts)
+		}
+		return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, nameResolutionDelayed, opts...)
 	}
 
 	rpcInfo := iresolver.RPCInfo{Context: ctx, Method: method}
@@ -270,20 +282,24 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 		if rpcConfig.Interceptor != nil {
 			rpcInfo.Context = nil
 			ns := newStream
-			newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
-				cs, err := rpcConfig.Interceptor.NewStream(ctx, rpcInfo, done, ns)
-				if err != nil {
-					return nil, toRPCErr(err)
+			if interceptor, ok := rpcConfig.Interceptor.(clientInterceptor); ok {
+				newStream = func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) {
+					cs, err := interceptor.NewStream(ctx, rpcInfo, ns, filterOpts...)
+					if err != nil {
+						return nil, toRPCErr(err)
+					}
+					return cs, nil
 				}
-				return cs, nil
+			} else {
+				return nil, status.Errorf(codes.Internal, "invalid client interceptor type %T", rpcConfig.Interceptor)
 			}
 		}
 	}
 
-	return newStream(ctx, func() {})
+	return newStream(ctx)
 }
 
-func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit, doneFunc func(), nameResolutionDelayed bool, opts ...CallOption) (_ iresolver.ClientStream, err error) {
+func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit func(), nameResolutionDelayed bool, opts ...CallOption) (_ ClientStream, err error) {
 	callInfo := defaultCallInfo()
 	if mc.WaitForReady != nil {
 		callInfo.failFast = !*mc.WaitForReady
@@ -321,7 +337,6 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client
 		Host:           cc.authority,
 		Method:         method,
 		ContentSubtype: callInfo.contentSubtype,
-		DoneFunc:       doneFunc,
 		Authority:      callInfo.authority,
 	}
 	if allowed := callInfo.acceptedResponseCompressors; len(allowed) > 0 {
diff --git a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/version.go b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/version.go
index 53c737feeb..4083c03908 100644
--- a/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/version.go
+++ b/src/code.cloudfoundry.org/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.82.1"
+const Version = "1.83.0"
diff --git a/src/code.cloudfoundry.org/vendor/modules.txt b/src/code.cloudfoundry.org/vendor/modules.txt
index b5f1285345..c31c8ff871 100644
--- a/src/code.cloudfoundry.org/vendor/modules.txt
+++ b/src/code.cloudfoundry.org/vendor/modules.txt
@@ -1,7 +1,7 @@
 # cel.dev/expr v0.25.2
 ## explicit; go 1.23.0
 cel.dev/expr
-# code.cloudfoundry.org/archiver v0.80.0
+# code.cloudfoundry.org/archiver v0.81.0
 ## explicit; go 1.25.0
 code.cloudfoundry.org/archiver/compressor
 code.cloudfoundry.org/archiver/extractor
@@ -110,7 +110,7 @@ code.cloudfoundry.org/durationjson
 # code.cloudfoundry.org/eventhub v0.82.0
 ## explicit; go 1.25.0
 code.cloudfoundry.org/eventhub
-# code.cloudfoundry.org/garden v0.0.0-20260722020902-0d62a2590a0f => ../garden
+# code.cloudfoundry.org/garden v0.0.0-20260729020900-a0441c36f7b5
 ## explicit; go 1.25.0
 code.cloudfoundry.org/garden
 code.cloudfoundry.org/garden/client
@@ -137,7 +137,7 @@ code.cloudfoundry.org/goshims/filepathshim
 code.cloudfoundry.org/goshims/http_wrap
 code.cloudfoundry.org/goshims/osshim
 code.cloudfoundry.org/goshims/osshim/os_fake
-# code.cloudfoundry.org/guardian v0.0.0-20260722021324-599e660ac834 => ../guardian
+# code.cloudfoundry.org/guardian v0.0.0-20260722021324-599e660ac834 => github.com/cloudfoundry/guardian v0.0.0-20260731120748-50a535ff5c03
 ## explicit; go 1.26.3
 code.cloudfoundry.org/guardian/gardener
 code.cloudfoundry.org/guardian/gardener/container-spec
@@ -150,7 +150,7 @@ code.cloudfoundry.org/guardian/rundmc/cgroups
 code.cloudfoundry.org/guardian/rundmc/cgroups/fs
 code.cloudfoundry.org/guardian/rundmc/event
 code.cloudfoundry.org/guardian/rundmc/goci
-# code.cloudfoundry.org/lager/v3 v3.79.0
+# code.cloudfoundry.org/lager/v3 v3.80.0
 ## explicit; go 1.25.0
 code.cloudfoundry.org/lager/v3
 code.cloudfoundry.org/lager/v3/internal/truncate
@@ -1278,10 +1278,10 @@ golang.org/x/tools/internal/versions
 # google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/api/expr/v1alpha1
-# google.golang.org/genproto/googleapis/rpc v0.0.0-20260727163830-6c54dddc4772
+# google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.82.1
+# google.golang.org/grpc v1.83.0
 ## explicit; go 1.25.0
 google.golang.org/grpc
 google.golang.org/grpc/attributes
@@ -1410,8 +1410,6 @@ gorm.io/gorm/logger
 gorm.io/gorm/migrator
 gorm.io/gorm/schema
 gorm.io/gorm/utils
-# code.cloudfoundry.org/garden => ../garden
-# code.cloudfoundry.org/grootfs => ../grootfs
-# code.cloudfoundry.org/guardian => ../guardian
-# code.cloudfoundry.org/idmapper => ../idmapper
+# code.cloudfoundry.org/guardian => github.com/cloudfoundry/guardian v0.0.0-20260731120748-50a535ff5c03
 # github.com/cactus/go-statsd-client => github.com/cactus/go-statsd-client v2.0.2-0.20150911070441-6fa055a7b594+incompatible
+# github.com/cilium/ebpf => github.com/cilium/ebpf v0.17.3
diff --git a/src/garden b/src/garden
deleted file mode 160000
index 0d62a2590a..0000000000
--- a/src/garden
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 0d62a2590a0f7594c780cf4f9b47403181d63c77
diff --git a/src/grootfs b/src/grootfs
deleted file mode 160000
index d3187f35ba..0000000000
--- a/src/grootfs
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit d3187f35ba865d0eb1973c4a2f0c22110f208fc0
diff --git a/src/guardian b/src/guardian
deleted file mode 160000
index 599e660ac8..0000000000
--- a/src/guardian
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 599e660ac834413e5751428dddd816895558d2f8
diff --git a/src/idmapper b/src/idmapper
deleted file mode 160000
index 9c84232f27..0000000000
--- a/src/idmapper
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 9c84232f27618a0a08cf88c5c92724a5ed28ff53