diff --git a/go.mod b/go.mod
index 8f08bc81f..349dac07f 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/openshift/api v0.0.0-20260213204242-d34f11c515b3
 	github.com/openshift/client-go v0.0.0-20260213141500-06efc6dce93b
 	github.com/operator-framework/api v0.42.0
-	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.90.1
+	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.91.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/regclient/regclient v0.11.3
 	github.com/sirupsen/logrus v1.9.4
diff --git a/go.sum b/go.sum
index 2340f57e9..e5d9da760 100644
--- a/go.sum
+++ b/go.sum
@@ -181,8 +181,8 @@ github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.90.1 h1:URbjn501/IBFTzPtGXrYDXHi+ZcbP2W60o6JeTrY3vQ=
-github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.90.1/go.mod h1:Gfzi4500QCMnptFIQc8YdDi8YZ4QA0vs22LROWZ3+YU=
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.91.0 h1:m2SZ2z5edgk0nXx7W6VHLfIsKZwgKbr+E5c2RNYyJB8=
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.91.0/go.mod h1:Gfzi4500QCMnptFIQc8YdDi8YZ4QA0vs22LROWZ3+YU=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/register.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/register.go
index 6f4298483..de160b72d 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/register.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/register.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/resource.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/resource.go
index e467c2bfa..e53da32ef 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/resource.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/resource.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/alertmanager_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/alertmanager_types.go
index d80946fd4..0240f072d 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/alertmanager_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/alertmanager_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -557,6 +557,10 @@ type AlertmanagerGlobalConfig struct {
 	// wechat defines the default WeChat Config
 	// +optional
 	WeChatConfig *GlobalWeChatConfig `json:"wechat,omitempty"`
+
+	// mattermost defines the default Mattermost Config
+	// +optional
+	MattermostConfig *GlobalMattermostConfig `json:"mattermost,omitempty"`
 }
 
 // AlertmanagerStatus is the most recent observed status of the Alertmanager cluster. Read-only.
@@ -772,6 +776,16 @@ type GlobalVictorOpsConfig struct {
 	APIKey *v1.SecretKeySelector `json:"apiKey,omitempty"`
 }
 
+// GlobalMattermostConfig configures global Mattermost parameters.
+type GlobalMattermostConfig struct {
+	// webhookURL defines the default Mattermost Webhook URL.
+	//
+	// It requires Alertmanager >= v0.32.0.
+	//
+	// +optional
+	WebhookURL *v1.SecretKeySelector `json:"webhookURL,omitempty"`
+}
+
 // HostPort represents a "host:port" network address.
 type HostPort struct {
 	// host defines the host's address, it can be a DNS name or a literal IP address.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/dns_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/dns_types.go
index d68b69831..1a9d27e82 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/dns_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/dns_types.go
@@ -1,4 +1,4 @@
-// Copyright 2024 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/doc.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/doc.go
index 64c472527..61ef677d2 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/doc.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2017 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/http_config.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/http_config.go
index 1590d23e0..64f07b213 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/http_config.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/http_config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/podmonitor_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/podmonitor_types.go
index d7da9bdca..0811492c1 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/podmonitor_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/podmonitor_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/probe_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/probe_types.go
index dc7ad44ee..0fd821ba8 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/probe_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/probe_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheus_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheus_types.go
index e0e62c2f3..b6ee7e7e4 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheus_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheus_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -118,6 +118,7 @@ type EnableFeature string
 
 // CommonPrometheusFields are the options available to both the Prometheus server and agent.
 // +k8s:deepcopy-gen=true
+// +kubebuilder:validation:XValidation:rule="!has(self.shardingStrategy) || !has(self.shardingStrategy.mode) || self.shardingStrategy.mode != 'Topology' || !has(self.shardingStrategy.topology) || !has(self.shardingStrategy.topology.values) || self.shardingStrategy.topology.values.size() == 0 || (has(self.shards) ? self.shards : 1) >= self.shardingStrategy.topology.values.size()",message="shards must be greater than or equal to the number of topology values when sharding strategy mode is Topology"
 type CommonPrometheusFields struct {
 	// podMetadata defines labels and annotations which are propagated to the Prometheus pods.
 	//
@@ -202,7 +203,8 @@ type CommonPrometheusFields struct {
 	// of the custom resource definition. It is recommended to use
 	// `spec.additionalScrapeConfigs` instead.
 	//
-	// Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+	// Note that the ScrapeConfig custom resource definition is currently at Alpha level
+	// and will be graduated to Beta in a future release.
 	//
 	// +optional
 	ScrapeConfigSelector *metav1.LabelSelector `json:"scrapeConfigSelector,omitempty"`
@@ -210,7 +212,8 @@ type CommonPrometheusFields struct {
 	// matches all namespaces. A null label selector matches the current
 	// namespace only.
 	//
-	// Note that the ScrapeConfig custom resource definition is currently at Alpha level.
+	// Note that the ScrapeConfig custom resource definition is currently at Alpha level
+	// and will be graduated to Beta in a future release.
 	//
 	// +optional
 	ScrapeConfigNamespaceSelector *metav1.LabelSelector `json:"scrapeConfigNamespaceSelector,omitempty"`
@@ -289,6 +292,14 @@ type CommonPrometheusFields struct {
 	// +optional
 	Shards *int32 `json:"shards,omitempty"`
 
+	// shardingStrategy defines the sharding strategy for distributing scraped targets across Prometheus shards.
+	//
+	// When not defined, the operator defaults to the 'Address' mode which distributes
+	// targets based on a hash of the target address.
+	//
+	// +optional
+	ShardingStrategy *ShardingStrategy `json:"shardingStrategy,omitempty"`
+
 	// replicaExternalLabelName defines the name of Prometheus external label used to denote the replica name.
 	// The external label will _not_ be added when the field is set to the
 	// empty string (`""`).
@@ -1345,7 +1356,9 @@ var (
 )
 
 type RetainConfig struct {
-	// retentionPeriod defines the retentionPeriod for shard retention policy.
+	// retentionPeriod defines how long the scaled-down shard(s) need to be
+	// kept before being deleted.
+	//
 	// +required
 	RetentionPeriod Duration `json:"retentionPeriod"`
 }
@@ -1356,15 +1369,77 @@ type ShardRetentionPolicy struct {
 	// * `Retain`, the operator will keep the pods from the scaled-down shard(s), so the data can still be queried.
 	//
 	// If not defined, the operator assumes the `Delete` value.
+	//
 	// +kubebuilder:validation:Enum=Retain;Delete
 	// +optional
 	WhenScaled *WhenScaledRetentionType `json:"whenScaled,omitempty"`
-	// retain defines the config for retention when the retention policy is set to `Retain`.
-	// This field is ineffective as of now.
+	// retain defines the config for retention when the retention policy is set
+	// to `Retain`.
+	//
+	// If not defined, the operator will use the retention duration configured
+	// for the Prometheus data. If the resource uses size-based retention, the
+	// shard(s) are kept forever (unless manually deleted).
+	//
 	// +optional
 	Retain *RetainConfig `json:"retain,omitempty"`
 }
 
+// ShardingStrategyMode defines the sharding mode for Prometheus.
+// +kubebuilder:validation:Enum=Address;Topology
+type ShardingStrategyMode string
+
+const (
+	// AddressShardingStrategyMode is the default sharding mode.
+	// Targets are distributed across shards based on a hash of the target address.
+	AddressShardingStrategyMode ShardingStrategyMode = "Address"
+
+	// TopologyShardingStrategyMode enables zone-aware sharding.
+	// Each shard is assigned to a specific topology zone and only scrapes targets in that zone.
+	// (Alpha) Using this mode requires the `PrometheusTopologySharding` feature gate to be enabled.
+	TopologyShardingStrategyMode ShardingStrategyMode = "Topology"
+)
+
+// TopologyShardingStrategy defines the configuration for topology-aware sharding.
+type TopologyShardingStrategy struct {
+	// externalLabelName defines the name of the Prometheus external label used
+	// to communicate the topology zone assigned to the Prometheus instance.
+	// If not defined, it defaults to "zone".
+	// If set to the empty string, no external label is added to the Prometheus configuration.
+	//
+	// +optional
+	ExternalLabelName *string `json:"externalLabelName,omitempty"`
+
+	// values defines the list of topology values (e.g. zone names) to be used
+	// for sharding. The configured number of shards must be greater than or
+	// equal to the number of values.
+	//
+	// +listType=atomic
+	// +optional
+	Values []string `json:"values,omitempty"`
+}
+
+// ShardingStrategy defines the sharding strategy for Prometheus.
+// +kubebuilder:validation:XValidation:rule="!has(self.topology) || (has(self.mode) && self.mode == 'Topology')",message="topology can only be defined when mode is set to 'Topology'"
+type ShardingStrategy struct {
+	// mode defines the sharding mode. Can be 'Address' or 'Topology'.
+	//
+	// 'Address' is the default mode and distributes targets across shards
+	// based on a hash of the target address.
+	//
+	// 'Topology' enables zone-aware sharding where each shard is assigned to a
+	// specific topology zone and only scrapes targets in that zone.
+	// (Alpha) Using the 'Topology' mode requires the `PrometheusTopologySharding`
+	// feature gate to be enabled.
+	//
+	// +optional
+	Mode *ShardingStrategyMode `json:"mode,omitempty"`
+
+	// topology defines the configuration for topology-aware sharding.
+	// This field is only valid when mode is set to 'Topology'.
+	// +optional
+	Topology *TopologyShardingStrategy `json:"topology,omitempty"`
+}
+
 // PrometheusStatus is the most recent observed status of the Prometheus cluster.
 // More info:
 // https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -1579,10 +1654,10 @@ type ThanosSpec struct {
 
 	// grpcServerTlsConfig defines the TLS parameters for the gRPC server providing the StoreAPI.
 	//
-	// Note: Currently only the `minVersion`, `caFile`, `certFile`, and `keyFile` fields are supported.
+	// Note: Currently only the `minVersion`, `caFile`, `certFile`, `keyFile`, `cipherSuites` and `curves` fields are supported.
 	//
 	// +optional
-	GRPCServerTLSConfig *TLSConfig `json:"grpcServerTlsConfig,omitempty"`
+	GRPCServerTLSConfig *GRPCServerTLSConfig `json:"grpcServerTlsConfig,omitempty"`
 
 	// logLevel for the Thanos sidecar.
 	// +kubebuilder:validation:Enum="";debug;info;warn;error
@@ -1867,6 +1942,7 @@ type QueueConfig struct {
 
 // Sigv4 defines AWS's Signature Verification 4 signing process to
 // sign requests.
+// +kubebuilder:validation:XValidation:rule="!has(self.externalId) || has(self.roleArn)",message="externalId can only be used when roleArn is specified"
 // +k8s:openapi-gen=true
 type Sigv4 struct {
 	// region defines the AWS region. If blank, the region from the default credentials chain used.
@@ -1886,6 +1962,12 @@ type Sigv4 struct {
 	// roleArn defines the named AWS profile used to authenticate.
 	// +optional
 	RoleArn string `json:"roleArn,omitempty"`
+	// externalId defines the external ID used when assuming an AWS role. Can only be used with roleArn.
+	// It requires Prometheus >= v3.11.0 or Alertmanager >= v0.33.0. Currently not supported by Thanos.
+	//
+	// +kubebuilder:validation:MinLength=1
+	// +optional
+	ExternalID string `json:"externalId,omitempty"`
 	// useFIPSSTSEndpoint defines the FIPS mode for the AWS STS endpoint.
 	// It requires Prometheus >= v2.54.0.
 	//
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheusrule_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheusrule_types.go
index 439b57c53..e7f80b52c 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheusrule_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/prometheusrule_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/register.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/register.go
index 37786147a..1e8ec0c70 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/register.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/register.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/servicemonitor_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/servicemonitor_types.go
index 90bcd7997..d7a9be6ac 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/servicemonitor_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/servicemonitor_types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/thanos_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/thanos_types.go
index a78f5a3d1..b31e02d62 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/thanos_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/thanos_types.go
@@ -1,4 +1,4 @@
-// Copyright 2020 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -453,10 +453,10 @@ type ThanosRulerSpec struct {
 	// grpcServerTlsConfig defines the gRPC server from which Thanos Querier reads
 	// recorded rule data.
 	//
-	// Note: Currently only the `minVersion`, `caFile`, `certFile`, and `keyFile` fields are supported.
+	// Note: Currently only the `minVersion`, `caFile`, `certFile`, `keyFile`, `cipherSuites` and `curves` fields are supported.
 	//
 	// +optional
-	GRPCServerTLSConfig *TLSConfig `json:"grpcServerTlsConfig,omitempty"`
+	GRPCServerTLSConfig *GRPCServerTLSConfig `json:"grpcServerTlsConfig,omitempty"`
 
 	// alertQueryUrl defines how Thanos Ruler will set in the 'Source' field
 	// of all alerts.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/tls_types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/tls_types.go
index 51e683527..8a977fc59 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/tls_types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/tls_types.go
@@ -1,4 +1,4 @@
-// Copyright 2025 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -38,6 +38,43 @@ type TLSConfig struct {
 	TLSFilesConfig `json:",inline"`
 }
 
+// GRPCServerTLSConfig defines TLS configuration for a gRPC server.
+// +k8s:openapi-gen=true
+type GRPCServerTLSConfig struct {
+	TLSConfig `json:",inline"`
+
+	// cipherSuites defines the list of supported cipher suites for TLS
+	// versions up to TLS 1.2.
+	//
+	// If not defined, the Go default cipher suites are used.
+	// Available cipher suites are documented in the Go documentation:
+	// https://golang.org/pkg/crypto/tls/#pkg-constants
+	//
+	//
+	// It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+	// the Thanos version supports the provided values.
+	//
+	// +optional
+	// +listType=set
+	// +kubebuilder:validation:MinItems=1
+	CipherSuites []string `json:"cipherSuites,omitempty"`
+
+	// curves defines the list of preferred elliptic curves for
+	// TLS handshakes.
+	//
+	// If not defined, the Go default curves are used.
+	// Available curves are documented in the Go documentation:
+	// https://golang.org/pkg/crypto/tls/#CurveID
+	//
+	// It requires Thanos >= v0.42.0. Note that the operator doesn't verify if
+	// the Thanos version supports the provided values.
+	//
+	// +optional
+	// +listType=set
+	// +kubebuilder:validation:MinItems=1
+	Curves []string `json:"curves,omitempty"`
+}
+
 // Validate semantically validates the given TLSConfig.
 func (c *TLSConfig) Validate() error {
 	if c == nil {
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/types.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/types.go
index 36db7f95d..520efc21f 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/types.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/types.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The prometheus-operator Authors
+// Copyright The prometheus-operator Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/zz_generated.deepcopy.go b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/zz_generated.deepcopy.go
index fec9816d4..83a1648ce 100644
--- a/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/zz_generated.deepcopy.go
+++ b/vendor/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1/zz_generated.deepcopy.go
@@ -283,6 +283,11 @@ func (in *AlertmanagerGlobalConfig) DeepCopyInto(out *AlertmanagerGlobalConfig)
 		*out = new(GlobalWeChatConfig)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.MattermostConfig != nil {
+		in, out := &in.MattermostConfig, &out.MattermostConfig
+		*out = new(GlobalMattermostConfig)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AlertmanagerGlobalConfig.
@@ -879,6 +884,11 @@ func (in *CommonPrometheusFields) DeepCopyInto(out *CommonPrometheusFields) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.ShardingStrategy != nil {
+		in, out := &in.ShardingStrategy, &out.ShardingStrategy
+		*out = new(ShardingStrategy)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ReplicaExternalLabelName != nil {
 		in, out := &in.ReplicaExternalLabelName, &out.ReplicaExternalLabelName
 		*out = new(string)
@@ -1478,6 +1488,32 @@ func (in *Exemplars) DeepCopy() *Exemplars {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCServerTLSConfig) DeepCopyInto(out *GRPCServerTLSConfig) {
+	*out = *in
+	in.TLSConfig.DeepCopyInto(&out.TLSConfig)
+	if in.CipherSuites != nil {
+		in, out := &in.CipherSuites, &out.CipherSuites
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Curves != nil {
+		in, out := &in.Curves, &out.Curves
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCServerTLSConfig.
+func (in *GRPCServerTLSConfig) DeepCopy() *GRPCServerTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCServerTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GlobalJiraConfig) DeepCopyInto(out *GlobalJiraConfig) {
 	*out = *in
@@ -1498,6 +1534,26 @@ func (in *GlobalJiraConfig) DeepCopy() *GlobalJiraConfig {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalMattermostConfig) DeepCopyInto(out *GlobalMattermostConfig) {
+	*out = *in
+	if in.WebhookURL != nil {
+		in, out := &in.WebhookURL, &out.WebhookURL
+		*out = new(corev1.SecretKeySelector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalMattermostConfig.
+func (in *GlobalMattermostConfig) DeepCopy() *GlobalMattermostConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalMattermostConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GlobalRocketChatConfig) DeepCopyInto(out *GlobalRocketChatConfig) {
 	*out = *in
@@ -3632,6 +3688,31 @@ func (in *ShardStatus) DeepCopy() *ShardStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShardingStrategy) DeepCopyInto(out *ShardingStrategy) {
+	*out = *in
+	if in.Mode != nil {
+		in, out := &in.Mode, &out.Mode
+		*out = new(ShardingStrategyMode)
+		**out = **in
+	}
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = new(TopologyShardingStrategy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardingStrategy.
+func (in *ShardingStrategy) DeepCopy() *ShardingStrategy {
+	if in == nil {
+		return nil
+	}
+	out := new(ShardingStrategy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Sigv4) DeepCopyInto(out *Sigv4) {
 	*out = *in
@@ -4015,7 +4096,7 @@ func (in *ThanosRulerSpec) DeepCopyInto(out *ThanosRulerSpec) {
 	}
 	if in.GRPCServerTLSConfig != nil {
 		in, out := &in.GRPCServerTLSConfig, &out.GRPCServerTLSConfig
-		*out = new(TLSConfig)
+		*out = new(GRPCServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.MinReadySeconds != nil {
@@ -4168,7 +4249,7 @@ func (in *ThanosSpec) DeepCopyInto(out *ThanosSpec) {
 	}
 	if in.GRPCServerTLSConfig != nil {
 		in, out := &in.GRPCServerTLSConfig, &out.GRPCServerTLSConfig
-		*out = new(TLSConfig)
+		*out = new(GRPCServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.VolumeMounts != nil {
@@ -4195,6 +4276,31 @@ func (in *ThanosSpec) DeepCopy() *ThanosSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TopologyShardingStrategy) DeepCopyInto(out *TopologyShardingStrategy) {
+	*out = *in
+	if in.ExternalLabelName != nil {
+		in, out := &in.ExternalLabelName, &out.ExternalLabelName
+		*out = new(string)
+		**out = **in
+	}
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyShardingStrategy.
+func (in *TopologyShardingStrategy) DeepCopy() *TopologyShardingStrategy {
+	if in == nil {
+		return nil
+	}
+	out := new(TopologyShardingStrategy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TopologySpreadConstraint) DeepCopyInto(out *TopologySpreadConstraint) {
 	*out = *in
diff --git a/vendor/modules.txt b/vendor/modules.txt
index f28efb2f9..ee6f37acc 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -300,7 +300,7 @@ github.com/peterbourgon/diskv
 # github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 ## explicit
 github.com/pmezard/go-difflib/difflib
-# github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.90.1
+# github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.91.0
 ## explicit; go 1.25.0
 github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
 github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1