diff --git a/cmd/commands/root_secrets_scope_test.go b/cmd/commands/root_secrets_scope_test.go
index 8498f3555..cc6157721 100644
--- a/cmd/commands/root_secrets_scope_test.go
+++ b/cmd/commands/root_secrets_scope_test.go
@@ -53,11 +53,16 @@ func TestSecretsRepoScope(t *testing.T) {
 				if err != nil {
 					t.Fatal(err)
 				}
-				// EvalSymlinks accounts for macOS temporary-directory aliases.
+				// EvalSymlinks on both sides accounts for macOS /var vs
+				// /private/var aliases and Windows 8.3 short temp paths.
 				want, err = filepath.EvalSymlinks(want)
 				if err != nil {
 					t.Fatal(err)
 				}
+				got, err = filepath.EvalSymlinks(got)
+				if err != nil {
+					t.Fatal(err)
+				}
 				if got != want {
 					t.Errorf("cwd = %s, want %s", got, want)
 				}
diff --git a/cmd/commands/update_images_test.go b/cmd/commands/update_images_test.go
index 283b8f076..de1a0f2b9 100644
--- a/cmd/commands/update_images_test.go
+++ b/cmd/commands/update_images_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -12,6 +13,9 @@ import (
 )
 
 func TestUpdateImages_DigestIdentity(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("stubs docker with a /bin/sh script, which Windows cannot exec")
+	}
 	dir := t.TempDir()
 	t.Chdir(dir)
 	if err := os.WriteFile(filepath.Join(dir, ".env"), []byte("PROJECT_NAME=test\n"), 0o600); err != nil {
diff --git a/go.mod b/go.mod
index 482abdde8..494e82f60 100644
--- a/go.mod
+++ b/go.mod
@@ -64,7 +64,7 @@ require (
 	go.opentelemetry.io/otel/log v1.47.0 // indirect
 	go.opentelemetry.io/otel/metric v1.47.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
-	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
diff --git a/go.sum b/go.sum
index 845e70e11..067052a30 100644
--- a/go.sum
+++ b/go.sum
@@ -108,8 +108,8 @@ go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6a4efcb0e..2d1c491b6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -191,7 +191,7 @@ go.opentelemetry.io/proto/otlp/collector/trace/v1
 go.opentelemetry.io/proto/otlp/common/v1
 go.opentelemetry.io/proto/otlp/resource/v1
 go.opentelemetry.io/proto/otlp/trace/v1
-# golang.org/x/net v0.60.0
+# golang.org/x/net v0.62.0
 ## explicit; go 1.26.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2