diff --git a/README.md b/README.md
index ca0ca508..b97989d4 100644
--- a/README.md
+++ b/README.md
@@ -130,8 +130,8 @@ The table below describes the available configuration options.
 The plugin pins a default `sysdig-cli-scanner` version and is tested end-to-end against both the
 default and the oldest still-maintained version:
 
-- Default pinned version: <!-- newest-version-marker -->1.28.0<!-- /newest-version-marker -->
-- Oldest maintained version tested: <!-- oldest-version-marker -->1.22.6<!-- /oldest-version-marker -->
+- Default pinned version: <!-- newest-version-marker -->1.29.0<!-- /newest-version-marker -->
+- Oldest maintained version tested: <!-- oldest-version-marker -->1.23.0<!-- /oldest-version-marker -->
 
 Both values are kept in sync by `just update-cli-scanner` and `just update-oldest-cli-scanner`.
 
diff --git a/flake.lock b/flake.lock
index 7fb9e96e..c900437a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785747939,
-        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
+        "lastModified": 1787814960,
+        "narHash": "sha256-PYZq1qzCJXC2zGI0mH07vrZBsw6DRBAOX0jN1pPtqOQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
+        "rev": "c27cdad491a991b11ed731760aa2ef8db0cb0410",
         "type": "github"
       },
       "original": {
diff --git a/pom.xml b/pom.xml
index 22930875..2e85132f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.plugins</groupId>
     <artifactId>plugin</artifactId>
-    <version>6.2211.v27f680c93c53</version>
+    <version>6.2221.va_045130417c9</version>
     <relativePath />
   </parent>
 
@@ -57,7 +57,7 @@
         <groupId>io.jenkins.tools.bom</groupId>
         <artifactId>bom-${jenkins.baseline}.x</artifactId>
         <!-- You can find your version for the selected baseline in: https://repo.jenkins-ci.org/public/io/jenkins/tools/bom/ -->
-        <version>6815.v1fb_2a_fee3765</version>
+        <version>6931.vea_a_b_c6fd017d</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/iac/entrypoint/IaCScanningBuilder.java b/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/iac/entrypoint/IaCScanningBuilder.java
index fe8bd0c8..f355f1db 100644
--- a/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/iac/entrypoint/IaCScanningBuilder.java
+++ b/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/iac/entrypoint/IaCScanningBuilder.java
@@ -54,7 +54,7 @@
 import org.kohsuke.stapler.QueryParameter;
 
 public class IaCScanningBuilder extends Builder implements SimpleBuildStep {
-    private static final String FIXED_SCANNED_VERSION = "1.28.0"; // newest-version-marker
+    private static final String FIXED_SCANNED_VERSION = "1.29.0"; // newest-version-marker
 
     private String engineCredentialsId;
     private boolean listUnsupported = false;
diff --git a/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerVersionResolver.java b/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerVersionResolver.java
index 75fd8c95..0c7922f7 100644
--- a/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerVersionResolver.java
+++ b/src/main/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerVersionResolver.java
@@ -24,7 +24,7 @@
  * custom version configured by the user and falling back to a pinned version.
  */
 public class ScannerVersionResolver {
-    private static final String FIXED_SCANNED_VERSION = "1.28.0"; // newest-version-marker
+    private static final String FIXED_SCANNED_VERSION = "1.29.0"; // newest-version-marker
 
     private final ImageScanningConfig config;
 
diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java
index 34bc7b7e..43a17d55 100644
--- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java
+++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java
@@ -26,9 +26,9 @@ public class TestMother {
      * (via {@code just update-cli-scanner} / {@code just update-oldest-cli-scanner}), regenerate the
      * matching fixtures with {@code just generate-scanner-fixtures}.
      */
-    public static final String NEWEST_FIXTURE_VERSION = "1.28.0"; // newest-version-marker
+    public static final String NEWEST_FIXTURE_VERSION = "1.29.0"; // newest-version-marker
 
-    public static final String OLDEST_FIXTURE_VERSION = "1.22.6"; // oldest-version-marker
+    public static final String OLDEST_FIXTURE_VERSION = "1.23.0"; // oldest-version-marker
 
     private static final String NEWEST_FIXTURE = FIXTURE_DIR + "scanner_newest_scan_result.json.gz";
     private static final String OLDEST_FIXTURE = FIXTURE_DIR + "scanner_oldest_scan_result.json.gz";
diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EFreestyleTests.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EFreestyleTests.java
index 2839f52c..5dcfb3b9 100644
--- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EFreestyleTests.java
+++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EFreestyleTests.java
@@ -62,7 +62,7 @@ void testFreestyleWithCredentialsAndAssertLogOutput() throws Exception {
 
         jenkins.assertLogContains("Attempting to download CLI", build);
         jenkins.assertLogContains(
-                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.28.0", // newest-version-marker
+                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0", // newest-version-marker
                 build);
         jenkins.assertLogContains("Starting scan", build);
         jenkins.assertLogContains("--iac --apiurl=https://secure.sysdig.com --loglevel=info", build);
@@ -144,7 +144,7 @@ void testFreestyleWithAllConfigs() throws Exception {
                     b.setIsRecursive(false);
                     b.setSeverityThreshold("m");
                     b.setSysdigEnv("https://us2.app.sysdig.com");
-                    b.setVersion("1.22.6"); // oldest-version-marker
+                    b.setVersion("1.23.0"); // oldest-version-marker
                 })
                 .build();
 
@@ -152,7 +152,7 @@ void testFreestyleWithAllConfigs() throws Exception {
 
         jenkins.assertLogContains("Attempting to download CLI", build);
         jenkins.assertLogContains(
-                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6", // oldest-version-marker
+                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.23.0", // oldest-version-marker
                 build);
         jenkins.assertLogContains("Starting scan", build);
         jenkins.assertLogContains("--iac --apiurl=https://us2.app.sysdig.com --loglevel=info", build);
diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EPipelineTests.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EPipelineTests.java
index 02a3e0eb..767f097f 100644
--- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EPipelineTests.java
+++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/e2e/IaCScanE2EPipelineTests.java
@@ -53,7 +53,7 @@ void testPipelineWithCredentialsAndAssertLogOutput() throws Exception {
 
         jenkins.assertLogContains("Attempting to download CLI", build);
         jenkins.assertLogContains(
-                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.28.0", // newest-version-marker
+                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.29.0", // newest-version-marker
                 build);
         jenkins.assertLogContains("Starting scan", build);
         jenkins.assertLogContains("--iac --apiurl=https://secure.sysdig.com --loglevel=info", build);
@@ -72,14 +72,14 @@ void testPipelineWithAllConfigs() throws Exception {
                                       isRecursive: false,
                                       severityThreshold: 'm',
                                       sysdigEnv: 'https://us2.app.sysdig.com',
-                                      version: '1.22.6'""") // oldest-version-marker
+                                      version: '1.23.0'""") // oldest-version-marker
                 .buildWithRemoteExecution();
 
         var build = jenkins.buildAndAssertStatus(Result.FAILURE, job);
 
         jenkins.assertLogContains("Attempting to download CLI", build);
         jenkins.assertLogContains(
-                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6", // oldest-version-marker
+                "Downloading https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.23.0", // oldest-version-marker
                 build);
         jenkins.assertLogContains("Starting scan", build);
         jenkins.assertLogContains("--iac --apiurl=https://us2.app.sysdig.com --loglevel=info", build);
diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerBinaryProviderTest.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerBinaryProviderTest.java
index b8e85c94..f88dfca1 100644
--- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerBinaryProviderTest.java
+++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/ScannerBinaryProviderTest.java
@@ -20,7 +20,7 @@
 
 class ScannerBinaryProviderTest {
     /** Pinned default version. Kept in sync by {@code just update-cli-scanner}; do not drop the marker. */
-    private static final String PINNED_VERSION = "1.28.0"; // newest-version-marker
+    private static final String PINNED_VERSION = "1.29.0"; // newest-version-marker
 
     /** Arbitrary version for the URL-shape tests below: they assert os/arch mapping, not the pin. */
     private static final String ANY_VERSION = "1.27.2";
diff --git a/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_newest_scan_result.json.gz b/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_newest_scan_result.json.gz
index 54cb4c68..c0789901 100644
Binary files a/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_newest_scan_result.json.gz and b/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_newest_scan_result.json.gz differ
diff --git a/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_oldest_scan_result.json.gz b/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_oldest_scan_result.json.gz
index 8c287376..fd100292 100644
Binary files a/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_oldest_scan_result.json.gz and b/src/test/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/scanner_oldest_scan_result.json.gz differ