diff --git a/go.mod b/go.mod
index 3cdfffd2..c35a9303 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/gardener/apiserver-proxy
 go 1.21
 
 require (
-	github.com/gardener/gardener v1.84.0
+	github.com/gardener/gardener v1.86.0
 	github.com/golang/mock v1.6.0
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.29.0
@@ -73,6 +73,6 @@ require (
 	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20231015215740-bf15e44028f9 // indirect
 	sigs.k8s.io/controller-tools v0.13.0 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 0734f775..bd659336 100644
--- a/go.sum
+++ b/go.sum
@@ -70,8 +70,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/gardener/gardener v1.84.0 h1:sfW8RljFT6vaShlHV04RW/99GkTdyiwfsoUDEehVNVE=
-github.com/gardener/gardener v1.84.0/go.mod h1:3XZ+Yn5iHl0acqUIVZ0K78p1OYWp52sRBQOJW6sCRR8=
+github.com/gardener/gardener v1.86.0 h1:r0DjNZbUc2F/feWDrySZ/AU/5LAr0LoKXdraFtPb6NQ=
+github.com/gardener/gardener v1.86.0/go.mod h1:8eHlXs2EkaghrgQwK8qEiVw3dZGpNJaq+I9IkPpReA4=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -139,6 +139,7 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -651,8 +652,8 @@ sigs.k8s.io/controller-tools v0.13.0 h1:NfrvuZ4bxyolhDBt/rCZhDnx3M2hzlhgo5n3Iv2R
 sigs.k8s.io/controller-tools v0.13.0/go.mod h1:5vw3En2NazbejQGCeWKRrE7q4P+CW8/klfVqP8QZkgA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
+sigs.k8s.io/structured-merge-diff/v4 v4.3.0 h1:UZbZAZfX0wV2zr7YZorDz6GXROfDFj6LvqCRm4VUVKk=
+sigs.k8s.io/structured-merge-diff/v4 v4.3.0/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/vendor/github.com/gardener/gardener/hack/LICENSE_BOILERPLATE.txt b/vendor/github.com/gardener/gardener/hack/LICENSE_BOILERPLATE.txt
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/add-license-header.sh b/vendor/github.com/gardener/gardener/hack/add-license-header.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/check-apidiff.sh b/vendor/github.com/gardener/gardener/hack/check-apidiff.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/check-charts.sh b/vendor/github.com/gardener/gardener/hack/check-charts.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/check-generate.sh b/vendor/github.com/gardener/gardener/hack/check-generate.sh
old mode 100755
new mode 100644
index c966f785..6b2e1d0f
--- a/vendor/github.com/gardener/gardener/hack/check-generate.sh
+++ b/vendor/github.com/gardener/gardener/hack/check-generate.sh
@@ -106,17 +106,33 @@ if which git &>/dev/null; then
     exit 1
   fi
 
-  echo ">> make tidy"
-  if ! out=$(make -f "$makefile" tidy 2>&1); then
-    echo "Error during calling make tidy: $out"
-    exit 1
-  fi
-  new_status="$(git status -s)"
+  repo_root="$(git rev-parse --show-toplevel)"
+  if [[ -d "$repo_root/vendor" ]]; then
+    echo ">> make revendor"
+    if ! out=$(make -f "$makefile" revendor 2>&1); then
+      echo "Error during calling make revendor: $out"
+      exit 1
+    fi
+    new_status="$(git status -s)"
 
-  if [[ "$old_status" != "$new_status" ]]; then
-    echo "make tidy needs to be run:"
-    echo "$new_status"
-    exit 1
+    if [[ "$old_status" != "$new_status" ]]; then
+      echo "make revendor needs to be run:"
+      echo "$new_status"
+      exit 1
+    fi
+  else
+    echo ">> make tidy"
+    if ! out=$(make -f "$makefile" tidy 2>&1); then
+      echo "Error during calling make tidy: $out"
+      exit 1
+    fi
+    new_status="$(git status -s)"
+
+    if [[ "$old_status" != "$new_status" ]]; then
+      echo "make tidy needs to be run:"
+      echo "$new_status"
+      exit 1
+    fi
   fi
 else
   echo "No git detected, cannot run make check-generate"
diff --git a/vendor/github.com/gardener/gardener/hack/check-imports.sh b/vendor/github.com/gardener/gardener/hack/check-imports.sh
old mode 100755
new mode 100644
index 2ea80cd2..9da10643
--- a/vendor/github.com/gardener/gardener/hack/check-imports.sh
+++ b/vendor/github.com/gardener/gardener/hack/check-imports.sh
@@ -31,23 +31,8 @@ echo "> Check Imports"
 
 this_module=$(go list -m)
 
-SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-VGOPATH="$VGOPATH"
-
-# Ensure that if GOPATH is set, the GOPATH/{bin,pkg} directory exists. This seems to be not always
-# the case in certain environments like Prow. As we will create a symlink against the bin folder we
-# need to make sure that the bin directory is present in the GOPATH.
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/bin" ]; then mkdir -p "$GOPATH/bin"; fi
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/pkg" ]; then mkdir -p "$GOPATH/pkg"; fi
-
-VIRTUAL_GOPATH="$(mktemp -d)"
-trap 'rm -rf "$VIRTUAL_GOPATH"' EXIT
-
-# Setup virtual GOPATH so the codegen tools work as expected.
-(cd "$SCRIPT_DIR/.."; go mod download && "$VGOPATH" -o "$VIRTUAL_GOPATH")
-
-export GOROOT="${GOROOT:-"$(go env GOROOT)"}"
-export GOPATH="$VIRTUAL_GOPATH"
+# setup virtual GOPATH
+source $(dirname $0)/vgopath-setup.sh
 
 # We need to explicitly pass GO111MODULE=off to import-boss as it is significantly slower otherwise,
 # see https://github.com/kubernetes/code-generator/issues/100.
diff --git a/vendor/github.com/gardener/gardener/hack/check-license-header.sh b/vendor/github.com/gardener/gardener/hack/check-license-header.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/check-plutono-dashboards.sh b/vendor/github.com/gardener/gardener/hack/check-plutono-dashboards.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/check-skaffold-deps-for-binary.sh b/vendor/github.com/gardener/gardener/hack/check-skaffold-deps-for-binary.sh
old mode 100755
new mode 100644
index eb8b7536..b728edf2
--- a/vendor/github.com/gardener/gardener/hack/check-skaffold-deps-for-binary.sh
+++ b/vendor/github.com/gardener/gardener/hack/check-skaffold-deps-for-binary.sh
@@ -73,6 +73,10 @@ go list -f '{{ join .Deps "\n" }}' "./cmd/$binary_name" |\
 
 # always add VERSION file
 echo "VERSION" >> "$path_actual_dependencies"
+# add vendor if the vendor/ dir exists
+if [[ -d "$repo_root/vendor" ]]; then
+  echo "vendor" >> "$path_actual_dependencies"
+fi
 
 # sort dependencies
 sort -fo "$path_current_skaffold_dependencies"{,}
diff --git a/vendor/github.com/gardener/gardener/hack/check-skaffold-deps.sh b/vendor/github.com/gardener/gardener/hack/check-skaffold-deps.sh
old mode 100755
new mode 100644
index 48cf864e..bb89cb7c
--- a/vendor/github.com/gardener/gardener/hack/check-skaffold-deps.sh
+++ b/vendor/github.com/gardener/gardener/hack/check-skaffold-deps.sh
@@ -35,6 +35,7 @@ run "skaffold.yaml" "gardener-apiserver"                 "controlplane"
 run "skaffold.yaml" "gardener-controller-manager"        "controlplane"
 run "skaffold.yaml" "gardener-extension-provider-local"  "provider-local"
 run "skaffold.yaml" "gardener-resource-manager"          "gardenlet"
+run "skaffold.yaml" "gardener-node-agent"                "gardenlet"
 run "skaffold.yaml" "gardener-scheduler"                 "controlplane"
 run "skaffold.yaml" "gardenlet"                          "gardenlet"
 
diff --git a/vendor/github.com/gardener/gardener/hack/check.sh b/vendor/github.com/gardener/gardener/hack/check.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/cherry-pick-pull.sh b/vendor/github.com/gardener/gardener/hack/cherry-pick-pull.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-common.sh b/vendor/github.com/gardener/gardener/hack/ci-common.sh
old mode 100755
new mode 100644
index 779b5396..9540a8cc
--- a/vendor/github.com/gardener/gardener/hack/ci-common.sh
+++ b/vendor/github.com/gardener/gardener/hack/ci-common.sh
@@ -38,8 +38,8 @@ export_artifacts() {
       kubectl -n "$namespace" exec "$node" -- crictl images >"$node_dir/images.log" || true
       kubectl -n "$namespace" get pod "$node" --show-managed-fields -oyaml >"$node_dir/pod.yaml" || true
 
-      # systemd units
-      for unit in cloud-config-downloader kubelet containerd containerd-configuration-local-setup; do
+      # relevant systemd units
+      for unit in cloud-config-downloader gardener-node-agent kubelet containerd containerd-configuration-local-setup; do
         kubectl -n "$namespace" exec "$node" -- journalctl --no-pager -u $unit.service >"$node_dir/$unit.log" || true
       done
       kubectl -n "$namespace" exec "$node" -- journalctl --no-pager >"$node_dir/journal.log" || true
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-ha-multi-zone.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-ha-multi-zone.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-ha-single-zone.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-ha-single-zone.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-migration-ha-single-zone.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-migration-ha-single-zone.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-migration.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-migration.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-operator.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-operator.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-upgrade.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind-upgrade.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/ci-e2e-kind.sh b/vendor/github.com/gardener/gardener/hack/ci-e2e-kind.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/clean.sh b/vendor/github.com/gardener/gardener/hack/clean.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/compare-k8s-admission-plugins.sh b/vendor/github.com/gardener/gardener/hack/compare-k8s-admission-plugins.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/compare-k8s-api-groups.sh b/vendor/github.com/gardener/gardener/hack/compare-k8s-api-groups.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/compare-k8s-controllers.sh b/vendor/github.com/gardener/gardener/hack/compare-k8s-controllers.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/compare-k8s-feature-gates.sh b/vendor/github.com/gardener/gardener/hack/compare-k8s-feature-gates.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/compute-k8s-controllers.sh b/vendor/github.com/gardener/gardener/hack/compute-k8s-controllers.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/download_gardener_source_code.sh b/vendor/github.com/gardener/gardener/hack/download_gardener_source_code.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/format.sh b/vendor/github.com/gardener/gardener/hack/format.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/gardener-down.sh b/vendor/github.com/gardener/gardener/hack/gardener-down.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/gardener-extensions-down.sh b/vendor/github.com/gardener/gardener/hack/gardener-extensions-down.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/gardener-extensions-up.sh b/vendor/github.com/gardener/gardener/hack/gardener-extensions-up.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-controller-registration.sh b/vendor/github.com/gardener/gardener/hack/generate-controller-registration.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-crds.sh b/vendor/github.com/gardener/gardener/hack/generate-crds.sh
old mode 100755
new mode 100644
index 1655ef6e..89e8372e
--- a/vendor/github.com/gardener/gardener/hack/generate-crds.sh
+++ b/vendor/github.com/gardener/gardener/hack/generate-crds.sh
@@ -42,23 +42,9 @@ add_keep_object_annotation=false
 k8s_io_api_approval_reason="unapproved, temporarily squatting"
 crd_options=""
 
-SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-VGOPATH="$VGOPATH"
+# setup virtual GOPATH
+source $(dirname $0)/vgopath-setup.sh
 
-# Ensure that if GOPATH is set, the GOPATH/{bin,pkg} directory exists. This seems to be not always
-# the case in certain environments like Prow. As we will create a symlink against the bin folder we
-# need to make sure that the bin directory is present in the GOPATH.
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/bin" ]; then mkdir -p "$GOPATH/bin"; fi
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/pkg" ]; then mkdir -p "$GOPATH/pkg"; fi
-
-VIRTUAL_GOPATH="$(mktemp -d)"
-trap 'rm -rf "$VIRTUAL_GOPATH"' EXIT
-
-# Setup virtual GOPATH so the codegen tools work as expected.
-(cd "$SCRIPT_DIR/.."; go mod download && "$VGOPATH" -o "$VIRTUAL_GOPATH")
-
-export GOROOT="${GOROOT:-"$(go env GOROOT)"}"
-export GOPATH="$VIRTUAL_GOPATH"
 export GO111MODULE=off
 
 get_group_package () {
diff --git a/vendor/github.com/gardener/gardener/hack/generate-groups.sh b/vendor/github.com/gardener/gardener/hack/generate-groups.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-imagename-constants.sh b/vendor/github.com/gardener/gardener/hack/generate-imagename-constants.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-internal-groups.sh b/vendor/github.com/gardener/gardener/hack/generate-internal-groups.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-logcheck-symlinks.sh b/vendor/github.com/gardener/gardener/hack/generate-logcheck-symlinks.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-monitoring-docs.sh b/vendor/github.com/gardener/gardener/hack/generate-monitoring-docs.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-parallel.sh b/vendor/github.com/gardener/gardener/hack/generate-parallel.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate-sequential.sh b/vendor/github.com/gardener/gardener/hack/generate-sequential.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/generate.sh b/vendor/github.com/gardener/gardener/hack/generate.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/get-build-ld-flags.sh b/vendor/github.com/gardener/gardener/hack/get-build-ld-flags.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/hook-me.sh b/vendor/github.com/gardener/gardener/hack/hook-me.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/install.sh b/vendor/github.com/gardener/gardener/hack/install.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/kind-down.sh b/vendor/github.com/gardener/gardener/hack/kind-down.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/kind-extensions-up.sh b/vendor/github.com/gardener/gardener/hack/kind-extensions-up.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/kind-up.sh b/vendor/github.com/gardener/gardener/hack/kind-up.sh
old mode 100755
new mode 100644
index 23397b05..f39f9b8c
--- a/vendor/github.com/gardener/gardener/hack/kind-up.sh
+++ b/vendor/github.com/gardener/gardener/hack/kind-up.sh
@@ -18,6 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+REGISTRY_CACHE=${CI:-false}
 CLUSTER_NAME=""
 PATH_CLUSTER_VALUES=""
 PATH_KUBECONFIG=""
@@ -128,6 +129,7 @@ setup_containerd_registry_mirrors() {
     setup_containerd_registry_mirror $NODE "ghcr.io" "https://ghcr.io" "http://${REGISTRY_HOSTNAME}:5005"
     setup_containerd_registry_mirror $NODE "registry.k8s.io" "https://registry.k8s.io" "http://${REGISTRY_HOSTNAME}:5006"
     setup_containerd_registry_mirror $NODE "quay.io" "https://quay.io" "http://${REGISTRY_HOSTNAME}:5007"
+    setup_containerd_registry_mirror $NODE "europe-docker.pkg.dev" "https://europe-docker.pkg.dev" "http://${REGISTRY_HOSTNAME}:5008"
   done
 }
 
@@ -149,6 +151,22 @@ server = "${UPSTREAM_SERVER}"
 EOF
 }
 
+check_registry_cache_availability() {
+  local registry_cache_ip
+  local registry_cache_dns
+  if [[ "$REGISTRY_CACHE" != "true" ]]; then
+    return
+  fi
+  echo "Registry-cache enabled. Checking if registry-cache instances are deployed in prow cluster."
+  for registry_cache_dns in $(kubectl create -k "$(dirname "$0")/../example/gardener-local/registry-prow" --dry-run=client -o yaml | grep kube-system.svc.cluster.local | awk '{ print $2 }' | sed -e "s/^http:\/\///" -e "s/:5000$//"); do
+    registry_cache_ip=$(getent hosts "$registry_cache_dns" | awk '{ print $1 }')
+    if [[ "$registry_cache_ip" == "" ]]; then
+      echo "Unable to resolve IP of $registry_cache_dns in prow cluster. Disabling registry-cache."
+      REGISTRY_CACHE=false
+    fi
+  done
+}
+
 parse_flags "$@"
 
 mkdir -m 0755 -p \
@@ -262,7 +280,14 @@ kubectl -n kube-system get configmap coredns -ojson | \
 kubectl -n kube-system rollout restart deployment coredns
 
 if [[ "$DEPLOY_REGISTRY" == "true" ]]; then
-  kubectl apply -k "$(dirname "$0")/../example/gardener-local/registry" --server-side
+  check_registry_cache_availability
+  if [[ "$REGISTRY_CACHE" == "true" ]]; then
+    echo "Deploying local container registries in registry-cache configuration"
+    kubectl apply -k "$(dirname "$0")/../example/gardener-local/registry-prow" --server-side
+  else
+    echo "Deploying local container registries in default configuration"
+    kubectl apply -k "$(dirname "$0")/../example/gardener-local/registry" --server-side
+  fi
   kubectl wait --for=condition=available deployment -l app=registry -n registry --timeout 5m
 fi
 kubectl apply -k "$(dirname "$0")/../example/gardener-local/calico/$IPFAMILY" --server-side
diff --git a/vendor/github.com/gardener/gardener/hack/prepare-envtest.sh b/vendor/github.com/gardener/gardener/hack/prepare-envtest.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/start-envtest.sh b/vendor/github.com/gardener/gardener/hack/start-envtest.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-cover-clean.sh b/vendor/github.com/gardener/gardener/hack/test-cover-clean.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-cover.sh b/vendor/github.com/gardener/gardener/hack/test-cover.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-e2e-local.env b/vendor/github.com/gardener/gardener/hack/test-e2e-local.env
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-e2e-local.sh b/vendor/github.com/gardener/gardener/hack/test-e2e-local.sh
old mode 100755
new mode 100644
index 2d7f6d68..c4e8e2fe
--- a/vendor/github.com/gardener/gardener/hack/test-e2e-local.sh
+++ b/vendor/github.com/gardener/gardener/hack/test-e2e-local.sh
@@ -52,6 +52,7 @@ if [[ "$1" != "operator" ]]; then
     e2e-wake-up-wl.local
     e2e-migrate.local
     e2e-migrate-wl.local
+    e2e-mgr-hib.local
     e2e-rotate.local
     e2e-rotate-wl.local
     e2e-default.local
diff --git a/vendor/github.com/gardener/gardener/hack/test-integration.env b/vendor/github.com/gardener/gardener/hack/test-integration.env
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-integration.sh b/vendor/github.com/gardener/gardener/hack/test-integration.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test-prometheus.sh b/vendor/github.com/gardener/gardener/hack/test-prometheus.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/test.sh b/vendor/github.com/gardener/gardener/hack/test.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/tools.go b/vendor/github.com/gardener/gardener/hack/tools.go
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/tools.mk b/vendor/github.com/gardener/gardener/hack/tools.mk
old mode 100755
new mode 100644
index b699684a..b59196f3
--- a/vendor/github.com/gardener/gardener/hack/tools.mk
+++ b/vendor/github.com/gardener/gardener/hack/tools.mk
@@ -57,18 +57,18 @@ YQ                         := $(TOOLS_BIN_DIR)/yq
 VGOPATH                    := $(TOOLS_BIN_DIR)/vgopath
 
 # default tool versions
-GOLANGCI_LINT_VERSION ?= v1.55.1
-GO_APIDIFF_VERSION ?= v0.6.1
+GOLANGCI_LINT_VERSION ?= v1.55.2
+GO_APIDIFF_VERSION ?= v0.7.0
 GO_ADD_LICENSE_VERSION ?= v1.1.1
-GOIMPORTSREVISER_VERSION ?= v3.5.6
+GOIMPORTSREVISER_VERSION ?= v3.6.0
 GO_VULN_CHECK_VERSION ?= latest
-HELM_VERSION ?= v3.13.1
+HELM_VERSION ?= v3.13.2
 KIND_VERSION ?= v0.20.0
-KUBECTL_VERSION ?= v1.28.3
-PROMTOOL_VERSION ?= 2.47.2
-PROTOC_VERSION ?= 24.4
-SKAFFOLD_VERSION ?= v2.8.0
-YQ_VERSION ?= v4.35.2
+KUBECTL_VERSION ?= v1.28.4
+PROMTOOL_VERSION ?= 2.48.0
+PROTOC_VERSION ?= 25.1
+SKAFFOLD_VERSION ?= v2.9.0
+YQ_VERSION ?= v4.40.4
 VGOPATH_VERSION ?= v0.1.3
 
 # tool versions from go.mod
diff --git a/vendor/github.com/gardener/gardener/hack/update-codegen.sh b/vendor/github.com/gardener/gardener/hack/update-codegen.sh
old mode 100755
new mode 100644
index 4d404a19..d5aca059
--- a/vendor/github.com/gardener/gardener/hack/update-codegen.sh
+++ b/vendor/github.com/gardener/gardener/hack/update-codegen.sh
@@ -42,23 +42,8 @@ AVAILABLE_CODEGEN_OPTIONS=(
   "nodeagent_groups"
 )
 
-SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-VGOPATH="$VGOPATH"
-
-# Ensure that if GOPATH is set, the GOPATH/{bin,pkg} directory exists. This seems to be not always
-# the case in certain environments like Prow. As we will create a symlink against the bin folder we
-# need to make sure that the bin directory is present in the GOPATH.
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/bin" ]; then mkdir -p "$GOPATH/bin"; fi
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/pkg" ]; then mkdir -p "$GOPATH/pkg"; fi
-
-VIRTUAL_GOPATH="$(mktemp -d)"
-trap 'rm -rf "$VIRTUAL_GOPATH"' EXIT
-
-# Setup virtual GOPATH so the codegen tools work as expected.
-(cd "$SCRIPT_DIR/.."; go mod download && "$VGOPATH" -o "$VIRTUAL_GOPATH")
-
-export GOROOT="${GOROOT:-"$(go env GOROOT)"}"
-export GOPATH="$VIRTUAL_GOPATH"
+# setup virtual GOPATH
+source $(dirname $0)/vgopath-setup.sh
 
 # We need to explicitly pass GO111MODULE=off to k8s.io/code-generator as it is significantly slower otherwise,
 # see https://github.com/kubernetes/code-generator/issues/100.
diff --git a/vendor/github.com/gardener/gardener/hack/update-protobuf.sh b/vendor/github.com/gardener/gardener/hack/update-protobuf.sh
old mode 100755
new mode 100644
index e0583c30..65684710
--- a/vendor/github.com/gardener/gardener/hack/update-protobuf.sh
+++ b/vendor/github.com/gardener/gardener/hack/update-protobuf.sh
@@ -18,23 +18,8 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-VGOPATH="$VGOPATH"
-
-# Ensure that if GOPATH is set, the GOPATH/{bin,pkg} directory exists. This seems to be not always
-# the case in certain environments like Prow. As we will create a symlink against the bin folder we
-# need to make sure that the bin directory is present in the GOPATH.
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/bin" ]; then mkdir -p "$GOPATH/bin"; fi
-if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/pkg" ]; then mkdir -p "$GOPATH/pkg"; fi
-
-VIRTUAL_GOPATH="$(mktemp -d)"
-trap 'rm -rf "$VIRTUAL_GOPATH"' EXIT
-
-# Setup virtual GOPATH so the codegen tools work as expected.
-(cd "$SCRIPT_DIR/.."; go mod download && "$VGOPATH" -o "$VIRTUAL_GOPATH")
-
-export GOROOT="${GOROOT:-"$(go env GOROOT)"}"
-export GOPATH="$VIRTUAL_GOPATH"
+# setup virtual GOPATH
+source $(dirname $0)/vgopath-setup.sh
 
 # We need to explicitly pass GO111MODULE=off to k8s.io/code-generator as it is significantly slower otherwise,
 # see https://github.com/kubernetes/code-generator/issues/100.
diff --git a/vendor/github.com/gardener/gardener/hack/update-skaffold-deps.sh b/vendor/github.com/gardener/gardener/hack/update-skaffold-deps.sh
old mode 100755
new mode 100644
diff --git a/vendor/github.com/gardener/gardener/hack/vgopath-setup.sh b/vendor/github.com/gardener/gardener/hack/vgopath-setup.sh
new file mode 100644
index 00000000..ee841f38
--- /dev/null
+++ b/vendor/github.com/gardener/gardener/hack/vgopath-setup.sh
@@ -0,0 +1,33 @@
+# Copyright 2023 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+
+# Ensure that if GOPATH is set, the GOPATH/{bin,pkg} directory exists. This seems to be not always
+# the case in certain environments like Prow. As we will create a symlink against the bin folder we
+# need to make sure that the bin directory is present in the GOPATH.
+if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/bin" ]; then mkdir -p "$GOPATH/bin"; fi
+if [ -n "$GOPATH" ] && [ ! -d "$GOPATH/pkg" ]; then mkdir -p "$GOPATH/pkg"; fi
+
+VIRTUAL_GOPATH="$(mktemp -d)"
+trap 'rm -rf "$VIRTUAL_GOPATH"' EXIT
+
+# Use REPO_ROOT if set, otherwise default to $SCRIPT_DIR/..
+TARGET_DIR="${REPO_ROOT:-$SCRIPT_DIR/..}"
+
+# Setup virtual GOPATH
+(cd "$TARGET_DIR"; go mod download && "$VGOPATH" -o "$VIRTUAL_GOPATH")
+
+export GOROOT="${GOROOT:-"$(go env GOROOT)"}"
+export GOPATH="$VIRTUAL_GOPATH"
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ebc2e9ac..13d01723 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -15,7 +15,7 @@ github.com/fatih/color
 # github.com/fsnotify/fsnotify v1.6.0
 ## explicit; go 1.16
 github.com/fsnotify/fsnotify
-# github.com/gardener/gardener v1.84.0
+# github.com/gardener/gardener v1.86.0
 ## explicit; go 1.21
 github.com/gardener/gardener/hack
 # github.com/go-logr/logr v1.2.4
@@ -499,7 +499,7 @@ sigs.k8s.io/controller-tools/pkg/webhook
 ## explicit; go 1.18
 sigs.k8s.io/json
 sigs.k8s.io/json/internal/golang/encoding/json
-# sigs.k8s.io/structured-merge-diff/v4 v4.2.3
+# sigs.k8s.io/structured-merge-diff/v4 v4.3.0
 ## explicit; go 1.13
 sigs.k8s.io/structured-merge-diff/v4/schema
 sigs.k8s.io/structured-merge-diff/v4/value
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/elements.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/elements.go
index 7e5dc758..5d3707a5 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/elements.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/elements.go
@@ -73,7 +73,7 @@ type Atom struct {
 }
 
 // Scalar (AKA "primitive") represents a type which has a single value which is
-// either numeric, string, or boolean.
+// either numeric, string, or boolean, or untyped for any of them.
 //
 // TODO: split numeric into float/int? Something even more fine-grained?
 type Scalar string
@@ -82,6 +82,7 @@ const (
 	Numeric = Scalar("numeric")
 	String  = Scalar("string")
 	Boolean = Scalar("boolean")
+	Untyped = Scalar("untyped")
 )
 
 // ElementRelationship is an enum of the different possible relationships
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/schemaschema.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/schemaschema.go
index 7d64d130..e4c5caa2 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/schemaschema.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/schema/schemaschema.go
@@ -110,7 +110,7 @@ var SchemaSchemaYAML = `types:
         scalar: string
     - name: deduceInvalidDiscriminator
       type:
-        scalar: bool
+        scalar: boolean
     - name: fields
       type:
         list:
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapreflect.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapreflect.go
index dc8b8c72..c38402b9 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapreflect.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapreflect.go
@@ -136,7 +136,7 @@ func (r mapReflect) EqualsUsing(a Allocator, m Map) bool {
 		if !ok {
 			return false
 		}
-		return Equals(vr.mustReuse(lhsVal, entry, nil, nil), value)
+		return EqualsUsing(a, vr.mustReuse(lhsVal, entry, nil, nil), value)
 	})
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapunstructured.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapunstructured.go
index d8e20862..c3ae00b1 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapunstructured.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/mapunstructured.go
@@ -88,12 +88,12 @@ func (m mapUnstructuredInterface) EqualsUsing(a Allocator, other Map) bool {
 	}
 	vv := a.allocValueUnstructured()
 	defer a.Free(vv)
-	return other.Iterate(func(key string, value Value) bool {
+	return other.IterateUsing(a, func(key string, value Value) bool {
 		lhsVal, ok := m[key]
 		if !ok {
 			return false
 		}
-		return Equals(vv.reuse(lhsVal), value)
+		return EqualsUsing(a, vv.reuse(lhsVal), value)
 	})
 }
 
@@ -168,12 +168,12 @@ func (m mapUnstructuredString) EqualsUsing(a Allocator, other Map) bool {
 	}
 	vv := a.allocValueUnstructured()
 	defer a.Free(vv)
-	return other.Iterate(func(key string, value Value) bool {
+	return other.IterateUsing(a, func(key string, value Value) bool {
 		lhsVal, ok := m[key]
 		if !ok {
 			return false
 		}
-		return Equals(vv.reuse(lhsVal), value)
+		return EqualsUsing(a, vv.reuse(lhsVal), value)
 	})
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/reflectcache.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/reflectcache.go
index a5a467c0..f0d58d42 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/value/reflectcache.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/value/reflectcache.go
@@ -154,7 +154,9 @@ func buildStructCacheEntry(t reflect.Type, infos map[string]*FieldCacheEntry, fi
 			if field.Type.Kind() == reflect.Ptr {
 				e = field.Type.Elem()
 			}
-			buildStructCacheEntry(e, infos, append(fieldPath, field.Index))
+			if e.Kind() == reflect.Struct {
+				buildStructCacheEntry(e, infos, append(fieldPath, field.Index))
+			}
 			continue
 		}
 		info := &FieldCacheEntry{JsonName: jsonName, isOmitEmpty: isOmitempty, fieldPath: append(fieldPath, field.Index), fieldType: field.Type}