diff --git a/go.mod b/go.mod
index 0d157aa03..63c0b6bc6 100644
--- a/go.mod
+++ b/go.mod
@@ -12,8 +12,8 @@ require (
 	k8s.io/api v0.35.3
 	k8s.io/apimachinery v0.35.3
 	k8s.io/client-go v0.35.3
-	knative.dev/eventing v0.48.1-0.20260415165636-0a7b2da46145
-	knative.dev/hack v0.0.0-20260415233235-54d1312ccc91
+	knative.dev/eventing v0.48.1-0.20260416124637-ae92548e56ea
+	knative.dev/hack v0.0.0-20260416140237-504af4d2178f
 	knative.dev/pkg v0.0.0-20260416015135-a395c1078b3d
 )
 
diff --git a/go.sum b/go.sum
index bcd1ac27c..d97c91e78 100644
--- a/go.sum
+++ b/go.sum
@@ -348,10 +348,10 @@ k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZ
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/eventing v0.48.1-0.20260415165636-0a7b2da46145 h1:p6CRV2KuYXk1dW2AWSJ11N4gYJy82Trtpciwj7BZTNg=
-knative.dev/eventing v0.48.1-0.20260415165636-0a7b2da46145/go.mod h1:ykUKyweljeKMmkxcrkMEgl3S6tubLzeF/bPAqeddvl0=
-knative.dev/hack v0.0.0-20260415233235-54d1312ccc91 h1:YkboMEJ48h7DxRQSPe2SePm1yKK0YYgrsQW5Mmc0SEk=
-knative.dev/hack v0.0.0-20260415233235-54d1312ccc91/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0=
+knative.dev/eventing v0.48.1-0.20260416124637-ae92548e56ea h1:57Dlmv3YBGC4hl7cRuHyMpeQvmNVDWXdA5NESQjEtLg=
+knative.dev/eventing v0.48.1-0.20260416124637-ae92548e56ea/go.mod h1:KIndP2eQs3iT6L57oQZFWuWXa+oOGIQFRBIDluLQRLE=
+knative.dev/hack v0.0.0-20260416140237-504af4d2178f h1:YTht2cGdhd++kSrhwcDutWpk1V1bi0vKpAs0h4xIjpw=
+knative.dev/hack v0.0.0-20260416140237-504af4d2178f/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0=
 knative.dev/pkg v0.0.0-20260416015135-a395c1078b3d h1:u9tHGBMUh1CYgZOdIBxeXpjvEPNIXT/rCjWVFUtzzs8=
 knative.dev/pkg v0.0.0-20260416015135-a395c1078b3d/go.mod h1:SvS4U6mNzjdSvasGVgnuox9eKsG9INWroDcpBo0wFnE=
 sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM=
diff --git a/vendor/knative.dev/hack/library.sh b/vendor/knative.dev/hack/library.sh
index 6eb566795..d5bcacab0 100644
--- a/vendor/knative.dev/hack/library.sh
+++ b/vendor/knative.dev/hack/library.sh
@@ -35,6 +35,13 @@ if [[ ! -v GOPATH ]]; then
   fi
 fi
 
+# Pinned tool versions
+readonly GUM_VERSION="v0.14.1"
+readonly GOTESTSUM_VERSION="v1.13.0"
+readonly GOTESTFMT_VERSION="v2.5.0"
+readonly TERMINAL_TO_HTML_VERSION="v3.10.0"
+readonly GO_LICENSES_VERSION="v2.0.1"
+
 # Useful environment variables
 [[ -v PROW_JOB_ID ]] && IS_PROW=1 || IS_PROW=0
 readonly IS_PROW
@@ -265,7 +272,7 @@ function gum_banner() {
 
 # Simple info banner for logging purposes.
 function gum_style() {
-  go_run github.com/charmbracelet/gum@v0.14.1 style "$@"
+  go_run "github.com/charmbracelet/gum@${GUM_VERSION}" style "$@"
 }
 
 # Checks whether the given function exists.
@@ -588,7 +595,7 @@ function report_go_test() {
   logfile="${logfile/.xml/.jsonl}"
   echo "Running go test with args: ${go_test_args[*]}"
   local gotest_retcode=0
-  go_run gotest.tools/gotestsum@v1.13.0 \
+  go_run "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" \
     --format "${GO_TEST_VERBOSITY:-testname}" \
     --junitfile "${xml}" \
     --junitfile-testsuite-name relative \
@@ -601,14 +608,14 @@ function report_go_test() {
   echo "Test log (JSONL) written to ${logfile}"
 
   ansilog="${logfile/.jsonl/-ansi.log}"
-  go_run github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.5.0 \
+  go_run "github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@${GOTESTFMT_VERSION}" \
     -input "${logfile}" \
     -showteststatus \
     -nofail > "$ansilog"
   echo "Test log (ANSI) written to ${ansilog}"
 
   htmllog="${logfile/.jsonl/.html}"
-  go_run github.com/buildkite/terminal-to-html/v3/cmd/terminal-to-html@v3.10.0 \
+  go_run "github.com/buildkite/terminal-to-html/v3/cmd/terminal-to-html@${TERMINAL_TO_HTML_VERSION}" \
     --preview < "$ansilog" > "$htmllog"
   echo "Test log (HTML) written to ${htmllog}"
 
@@ -921,13 +928,14 @@ function run_kntest() {
 }
 
 # Run go-licenses to check for forbidden licenses.
+# Extra flags can be passed via the GO_LICENSES_FLAGS environment variable.
 function check_licenses() {
   # Pin GOTOOLCHAIN to the project's Go version so that go-licenses is
   # compiled with the same toolchain.  GOTOOLCHAIN=auto (the go_run default)
   # may select a different Go, causing isStdLib() path mismatches.
   GOTOOLCHAIN="$(go env GOVERSION)" \
-  go_run github.com/google/go-licenses/v2@v2.0.1 \
-    check "${REPO_ROOT_DIR}/..." || \
+  go_run "github.com/google/go-licenses/v2@${GO_LICENSES_VERSION}" \
+    check ${GO_LICENSES_FLAGS:-} "${REPO_ROOT_DIR}/..." || \
     { echo "--- FAIL: go-licenses failed the license check"; return 1; }
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 7aaf92df2..406e6869b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1095,7 +1095,7 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/ptr
 k8s.io/utils/trace
-# knative.dev/eventing v0.48.1-0.20260415165636-0a7b2da46145
+# knative.dev/eventing v0.48.1-0.20260416124637-ae92548e56ea
 ## explicit; go 1.25.0
 knative.dev/eventing/pkg/adapter/v2
 knative.dev/eventing/pkg/adapter/v2/util/crstatusevent
@@ -1126,7 +1126,7 @@ knative.dev/eventing/pkg/observability/configmap
 knative.dev/eventing/pkg/observability/otel
 knative.dev/eventing/pkg/reconciler/source
 knative.dev/eventing/pkg/utils
-# knative.dev/hack v0.0.0-20260415233235-54d1312ccc91
+# knative.dev/hack v0.0.0-20260416140237-504af4d2178f
 ## explicit; go 1.24
 knative.dev/hack
 # knative.dev/pkg v0.0.0-20260416015135-a395c1078b3d