diff --git a/RESULTS.md b/RESULTS.md
index cde57a3..a3a2ba2 100644
--- a/RESULTS.md
+++ b/RESULTS.md
@@ -18,6 +18,29 @@ registry at the same time.
 - Helm repository (oci://ghcr.io/stefanprodan/charts/podinfo)
 - App manifests (Deployment scaled to zero, Service Account, Service, Ingress)
 
+
+## Flux v2.4.0
+
+| Objects | Type          | Flux component       | Duration | Max Memory |
+|---------|---------------|----------------------|----------|------------|
+| 100     | OCIRepository | source-controller    | 25s      | 38Mi       |
+| 100     | Kustomization | kustomize-controller | 27s      | 32Mi       |
+| 100     | HelmChart     | source-controller    | 25s      | 40Mi       |
+| 100     | HelmRelease   | helm-controller      | 28s      | 190Mi      |
+| 500     | OCIRepository | source-controller    | 45s      | 65Mi       |
+| 500     | Kustomization | kustomize-controller | 2m4s     | 122Mi      |
+| 500     | HelmChart     | source-controller    | 45s      | 68Mi       |
+| 500     | HelmRelease   | helm-controller      | 2m44s    | 240Mi      |
+| 1000    | OCIRepository | source-controller    | 1m30s    | 67Mi       |
+| 1000    | Kustomization | kustomize-controller | 4m15s    | 175Mi      |
+| 1000    | HelmChart     | source-controller    | 1m30s    | 110Mi      |
+| 1000    | HelmRelease   | helm-controller      | 8m1s     | 400Mi      |
+
+### Observations
+
+Compared to Flux v2.3, the memory consumption of kustomize-controller
+and helm-controller has slight improved when reconciling over 500 apps.
+
 ## Flux v2.3.0
 
 | Objects | Type          | Flux component       | Duration | Max Memory |
diff --git a/manifests/bases/helm-controller/kustomization.yaml b/manifests/bases/helm-controller/kustomization.yaml
index 5f08e84..49b556b 100644
--- a/manifests/bases/helm-controller/kustomization.yaml
+++ b/manifests/bases/helm-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/helm-controller/releases/download/v1.0.1/helm-controller.crds.yaml
-- https://github.com/fluxcd/helm-controller/releases/download/v1.0.1/helm-controller.deployment.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.1.0/helm-controller.crds.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.1.0/helm-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/helm-controller/labels.yaml b/manifests/bases/helm-controller/labels.yaml
index 29c577f..57ae0f9 100644
--- a/manifests/bases/helm-controller/labels.yaml
+++ b/manifests/bases/helm-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: helm-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/manifests/bases/image-automation-controller/kustomization.yaml b/manifests/bases/image-automation-controller/kustomization.yaml
index e5b6e3e..ba69753 100644
--- a/manifests/bases/image-automation-controller/kustomization.yaml
+++ b/manifests/bases/image-automation-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/image-automation-controller/releases/download/v0.38.0/image-automation-controller.crds.yaml
-- https://github.com/fluxcd/image-automation-controller/releases/download/v0.38.0/image-automation-controller.deployment.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v0.39.0/image-automation-controller.crds.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v0.39.0/image-automation-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/image-automation-controller/labels.yaml b/manifests/bases/image-automation-controller/labels.yaml
index 88ddf5a..80923fb 100644
--- a/manifests/bases/image-automation-controller/labels.yaml
+++ b/manifests/bases/image-automation-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: image-automation-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/manifests/bases/image-reflector-controller/kustomization.yaml b/manifests/bases/image-reflector-controller/kustomization.yaml
index 2cd1f1e..68d5a92 100644
--- a/manifests/bases/image-reflector-controller/kustomization.yaml
+++ b/manifests/bases/image-reflector-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.32.0/image-reflector-controller.crds.yaml
-- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.32.0/image-reflector-controller.deployment.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.33.0/image-reflector-controller.crds.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.33.0/image-reflector-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/image-reflector-controller/labels.yaml b/manifests/bases/image-reflector-controller/labels.yaml
index ee3a2f4..43bb70e 100644
--- a/manifests/bases/image-reflector-controller/labels.yaml
+++ b/manifests/bases/image-reflector-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: image-reflector-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/manifests/bases/kustomize-controller/kustomization.yaml b/manifests/bases/kustomize-controller/kustomization.yaml
index 8104b19..d97d337 100644
--- a/manifests/bases/kustomize-controller/kustomization.yaml
+++ b/manifests/bases/kustomize-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/kustomize-controller/releases/download/v1.3.0/kustomize-controller.crds.yaml
-- https://github.com/fluxcd/kustomize-controller/releases/download/v1.3.0/kustomize-controller.deployment.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.4.0/kustomize-controller.crds.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.4.0/kustomize-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/kustomize-controller/labels.yaml b/manifests/bases/kustomize-controller/labels.yaml
index 86e93ee..bcb2bfb 100644
--- a/manifests/bases/kustomize-controller/labels.yaml
+++ b/manifests/bases/kustomize-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: kustomize-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/manifests/bases/notification-controller/kustomization.yaml b/manifests/bases/notification-controller/kustomization.yaml
index 28481fd..7bb063f 100644
--- a/manifests/bases/notification-controller/kustomization.yaml
+++ b/manifests/bases/notification-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/notification-controller/releases/download/v1.3.0/notification-controller.crds.yaml
-- https://github.com/fluxcd/notification-controller/releases/download/v1.3.0/notification-controller.deployment.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.4.0/notification-controller.crds.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.4.0/notification-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/notification-controller/labels.yaml b/manifests/bases/notification-controller/labels.yaml
index 4f6fdf0..6b45c77 100644
--- a/manifests/bases/notification-controller/labels.yaml
+++ b/manifests/bases/notification-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: notification-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/manifests/bases/source-controller/kustomization.yaml b/manifests/bases/source-controller/kustomization.yaml
index 040e367..1991d6c 100644
--- a/manifests/bases/source-controller/kustomization.yaml
+++ b/manifests/bases/source-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
-- https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
diff --git a/manifests/bases/source-controller/labels.yaml b/manifests/bases/source-controller/labels.yaml
index a7d9e0a..e2d3f4a 100644
--- a/manifests/bases/source-controller/labels.yaml
+++ b/manifests/bases/source-controller/labels.yaml
@@ -4,6 +4,7 @@ metadata:
   name: labels
 labels:
   app.kubernetes.io/component: source-controller
+  app.kubernetes.io/part-of: flux
 fieldSpecs:
   - path: metadata/labels
     create: true
diff --git a/timoni/modules/flux-hr-bench/cue.mod/gen/helm.toolkit.fluxcd.io/helmrelease/v2/types_gen.cue b/timoni/modules/flux-hr-bench/cue.mod/gen/helm.toolkit.fluxcd.io/helmrelease/v2/types_gen.cue
index 134448f..0f6bfe5 100644
--- a/timoni/modules/flux-hr-bench/cue.mod/gen/helm.toolkit.fluxcd.io/helmrelease/v2/types_gen.cue
+++ b/timoni/modules/flux-hr-bench/cue.mod/gen/helm.toolkit.fluxcd.io/helmrelease/v2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://raw.githubusercontent.com/fluxcd/helm-controller/v1.0.0/config/crd/bases/helm.toolkit.fluxcd.io_helmreleases.yaml
+//timoni:generate timoni vendor crd -f https://raw.githubusercontent.com/fluxcd/helm-controller/v1.1.0/config/crd/bases/helm.toolkit.fluxcd.io_helmreleases.yaml
 
 package v2
 
@@ -47,8 +47,8 @@ import "strings"
 
 // HelmReleaseSpec defines the desired state of a Helm release.
 #HelmReleaseSpec: {
-	// Chart defines the template of the v1beta2.HelmChart that should
-	// be created
+	// Chart defines the template of the v1.HelmChart that should be
+	// created
 	// for this HelmRelease.
 	chart?: {
 		// ObjectMeta holds the template for metadata like labels and
@@ -75,7 +75,7 @@ import "strings"
 			}
 		}
 
-		// Spec holds the template for the v1beta2.HelmChartSpec for this
+		// Spec holds the template for the v1.HelmChartSpec for this
 		// HelmRelease.
 		spec: {
 			// The name or path the Helm chart is available at in the
@@ -106,7 +106,7 @@ import "strings"
 				apiVersion?: string
 
 				// Kind of the referent.
-				kind?: "HelmRepository" | "GitRepository" | "Bucket"
+				kind: "HelmRepository" | "GitRepository" | "Bucket"
 
 				// Name of the referent.
 				name: strings.MaxRunes(253) & strings.MinRunes(1)
@@ -144,7 +144,7 @@ import "strings"
 			}
 
 			// Version semver expression, ignored for charts from
-			// v1beta2.GitRepository and
+			// v1.GitRepository and
 			// v1beta2.Bucket sources. Defaults to latest when omitted.
 			version?: string | *"*"
 		}
@@ -260,19 +260,15 @@ import "strings"
 		// `Create` or `CreateReplace`. Default is `Create` and if omitted
 		// CRDs are installed but not updated.
 		//
-		//
 		// Skip: do neither install nor replace (update) any CRDs.
 		//
-		//
 		// Create: new CRDs are created, existing CRDs are neither updated
 		// nor deleted.
 		//
-		//
 		// CreateReplace: new CRDs are created, existing CRDs are updated
 		// (replaced)
 		// but not deleted.
 		//
-		//
 		// By default, CRDs are applied (installed) during Helm install
 		// action.
 		// With this option users can opt in to CRD replace existing CRDs
@@ -295,6 +291,11 @@ import "strings"
 		// rendered templates against the Kubernetes OpenAPI Schema.
 		disableOpenAPIValidation?: bool
 
+		// DisableSchemaValidation prevents the Helm install action from
+		// validating
+		// the values against the JSON Schema.
+		disableSchemaValidation?: bool
+
 		// DisableWait disables the waiting for resources to be ready
 		// after a Helm
 		// install has been performed.
@@ -339,7 +340,6 @@ import "strings"
 		// By default,
 		// CRDs are installed if not already present.
 		//
-		//
 		// Deprecated use CRD policy (`crds`) attribute with value `Skip`
 		// instead.
 		skipCRDs?: bool
@@ -391,7 +391,6 @@ import "strings"
 	// destroyed
 	// for each (step of a) Helm action.
 	//
-	//
 	// This can improve performance, but may cause issues with some
 	// Helm charts
 	// that for example do create Custom Resource Definitions during
@@ -400,7 +399,6 @@ import "strings"
 	// to be
 	// available by e.g. post-install hooks.
 	//
-	//
 	// If not set, it defaults to true.
 	persistentClient?: bool
 
@@ -625,19 +623,15 @@ import "strings"
 		// `Create` or `CreateReplace`. Default is `Skip` and if omitted
 		// CRDs are neither installed nor upgraded.
 		//
-		//
 		// Skip: do neither install nor replace (update) any CRDs.
 		//
-		//
 		// Create: new CRDs are created, existing CRDs are neither updated
 		// nor deleted.
 		//
-		//
 		// CreateReplace: new CRDs are created, existing CRDs are updated
 		// (replaced)
 		// but not deleted.
 		//
-		//
 		// By default, CRDs are not applied during Helm upgrade action.
 		// With this
 		// option users can opt-in to CRD upgrade, which is not (yet)
@@ -654,6 +648,11 @@ import "strings"
 		// rendered templates against the Kubernetes OpenAPI Schema.
 		disableOpenAPIValidation?: bool
 
+		// DisableSchemaValidation prevents the Helm upgrade action from
+		// validating
+		// the values against the JSON Schema.
+		disableSchemaValidation?: bool
+
 		// DisableWait disables the waiting for resources to be ready
 		// after a Helm
 		// upgrade has been performed.
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/kustomize.toolkit.fluxcd.io/kustomization/v1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/kustomize.toolkit.fluxcd.io/kustomization/v1/types_gen.cue
index 17c5a79..d0d92cd 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/kustomize.toolkit.fluxcd.io/kustomization/v1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/kustomize.toolkit.fluxcd.io/kustomization/v1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/kustomize-controller/releases/download/v1.3.0/kustomize-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/kustomize-controller/releases/download/v1.4.0/kustomize-controller.crds.yaml
 
 package v1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1/types_gen.cue
new file mode 100644
index 0000000..2b14538
--- /dev/null
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1/types_gen.cue
@@ -0,0 +1,135 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
+
+package v1
+
+import "strings"
+
+// Bucket is the Schema for the buckets API.
+#Bucket: {
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "source.toolkit.fluxcd.io/v1"
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Bucket"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// BucketSpec specifies the required configuration to produce an
+	// Artifact for
+	// an object storage bucket.
+	spec!: #BucketSpec
+}
+
+// BucketSpec specifies the required configuration to produce an
+// Artifact for
+// an object storage bucket.
+#BucketSpec: {
+	// BucketName is the name of the object storage bucket.
+	bucketName: string
+	certSecretRef?: {
+		// Name of the referent.
+		name: string
+	}
+
+	// Endpoint is the object storage address the BucketName is
+	// located at.
+	endpoint: string
+
+	// Ignore overrides the set of excluded patterns in the
+	// .sourceignore format
+	// (which is the same as .gitignore). If not provided, a default
+	// will be used,
+	// consult the documentation for your version to find out what
+	// those are.
+	ignore?: string
+
+	// Insecure allows connecting to a non-TLS HTTP Endpoint.
+	insecure?: bool
+
+	// Interval at which the Bucket Endpoint is checked for updates.
+	// This interval is approximate and may be subject to jitter to
+	// ensure
+	// efficient use of resources.
+	interval: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
+
+	// Prefix to use for server-side filtering of files in the Bucket.
+	prefix?: string
+
+	// Provider of the object storage bucket.
+	// Defaults to 'generic', which expects an S3 (API) compatible
+	// object
+	// storage.
+	provider?: "generic" | "aws" | "gcp" | "azure" | *"generic"
+	proxySecretRef?: {
+		// Name of the referent.
+		name: string
+	}
+
+	// Region of the Endpoint where the BucketName is located in.
+	region?: string
+	secretRef?: {
+		// Name of the referent.
+		name: string
+	}
+
+	// STS specifies the required configuration to use a Security
+	// Token
+	// Service for fetching temporary credentials to authenticate in a
+	// Bucket provider.
+	//
+	// This field is only supported for the `aws` and `generic`
+	// providers.
+	sts?: {
+		certSecretRef?: {
+			// Name of the referent.
+			name: string
+		}
+
+		// Endpoint is the HTTP/S endpoint of the Security Token Service
+		// from
+		// where temporary credentials will be fetched.
+		endpoint: =~"^(http|https)://.*$"
+
+		// Provider of the Security Token Service.
+		provider: "aws" | "ldap"
+		secretRef?: {
+			// Name of the referent.
+			name: string
+		}
+	}
+
+	// Suspend tells the controller to suspend the reconciliation of
+	// this
+	// Bucket.
+	suspend?: bool
+
+	// Timeout for fetch operations, defaults to 60s.
+	timeout?: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m))+$" | *"60s"
+}
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta1/types_gen.cue
index 276a692..155d154 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta2/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta2/types_gen.cue
index 260a5f4..4076849 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta2/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1beta2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta2
 
@@ -70,6 +70,10 @@ import "strings"
 
 	// BucketName is the name of the object storage bucket.
 	bucketName: string
+	certSecretRef?: {
+		// Name of the referent.
+		name: string
+	}
 
 	// Endpoint is the object storage address the BucketName is
 	// located at.
@@ -100,6 +104,10 @@ import "strings"
 	// object
 	// storage.
 	provider?: "generic" | "aws" | "gcp" | "azure" | *"generic"
+	proxySecretRef?: {
+		// Name of the referent.
+		name: string
+	}
 
 	// Region of the Endpoint where the BucketName is located in.
 	region?: string
@@ -108,6 +116,32 @@ import "strings"
 		name: string
 	}
 
+	// STS specifies the required configuration to use a Security
+	// Token
+	// Service for fetching temporary credentials to authenticate in a
+	// Bucket provider.
+	//
+	// This field is only supported for the `aws` and `generic`
+	// providers.
+	sts?: {
+		certSecretRef?: {
+			// Name of the referent.
+			name: string
+		}
+
+		// Endpoint is the HTTP/S endpoint of the Security Token Service
+		// from
+		// where temporary credentials will be fetched.
+		endpoint: =~"^(http|https)://.*$"
+
+		// Provider of the Security Token Service.
+		provider: "aws" | "ldap"
+		secretRef?: {
+			// Name of the referent.
+			name: string
+		}
+	}
+
 	// Suspend tells the controller to suspend the reconciliation of
 	// this
 	// Bucket.
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1/types_gen.cue
index cfdca98..4c9b478 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1
 
@@ -84,6 +84,10 @@ import "strings"
 	// ensure
 	// efficient use of resources.
 	interval: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
+
+	// Provider used for authentication, can be 'azure', 'generic'.
+	// When not specified, defaults to 'generic'.
+	provider?: "generic" | "azure"
 	proxySecretRef?: {
 		// Name of the referent.
 		name: string
@@ -106,7 +110,6 @@ import "strings"
 		// Commit SHA to check out, takes precedence over all reference
 		// fields.
 		//
-		//
 		// This can be combined with Branch to shallow clone the branch,
 		// in which
 		// the commit is expected to exist.
@@ -115,7 +118,6 @@ import "strings"
 		// Name of the reference to check out; takes precedence over
 		// Branch, Tag and SemVer.
 		//
-		//
 		// It must be a valid Git reference:
 		// https://git-scm.com/docs/git-check-ref-format#_description
 		// Examples: "refs/heads/main", "refs/tags/v0.1.0",
@@ -151,7 +153,6 @@ import "strings"
 	verify?: {
 		// Mode specifies which Git object(s) should be verified.
 		//
-		//
 		// The variants "head" and "HEAD" both imply the same thing, i.e.
 		// verify
 		// the commit that the HEAD of the Git repository points to. The
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta1/types_gen.cue
index 36cb401..03f1b36 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta2/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta2/types_gen.cue
index e02f178..ac38546 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta2/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/gitrepository/v1beta2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta2
 
@@ -125,7 +125,6 @@ import "strings"
 		// Commit SHA to check out, takes precedence over all reference
 		// fields.
 		//
-		//
 		// This can be combined with Branch to shallow clone the branch,
 		// in which
 		// the commit is expected to exist.
@@ -134,7 +133,6 @@ import "strings"
 		// Name of the reference to check out; takes precedence over
 		// Branch, Tag and SemVer.
 		//
-		//
 		// It must be a valid Git reference:
 		// https://git-scm.com/docs/git-check-ref-format#_description
 		// Examples: "refs/heads/main", "refs/tags/v0.1.0",
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1/types_gen.cue
index 36cf8d9..21b431f 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta1/types_gen.cue
index d572c22..086f821 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta2/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta2/types_gen.cue
index 2246c74..465f79d 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta2/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmchart/v1beta2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta2
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1/types_gen.cue
index dfed3df..425862a 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta1/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta1/types_gen.cue
index 31f037d..e559fc0 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta1/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta1/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta1
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta2/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta2/types_gen.cue
index 08d6c23..f80f03c 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta2/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/helmrepository/v1beta2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta2
 
diff --git a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/ocirepository/v1beta2/types_gen.cue b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/ocirepository/v1beta2/types_gen.cue
index 28abd59..1ee2db8 100644
--- a/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/ocirepository/v1beta2/types_gen.cue
+++ b/timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/ocirepository/v1beta2/types_gen.cue
@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.3.0/source-controller.crds.yaml
+//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
 
 package v1beta2
 
@@ -93,6 +93,10 @@ import "strings"
 	// 'gcp' or 'generic'.
 	// When not specified, defaults to 'generic'.
 	provider?: "generic" | "aws" | "azure" | "gcp" | *"generic"
+	proxySecretRef?: {
+		// Name of the referent.
+		name: string
+	}
 
 	// The OCI reference to pull and monitor for changes,
 	// defaults to the latest tag.