diff --git a/CHANGELOG.md b/CHANGELOG.md
index ec554cea3507..bf3831e84a0a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,52 @@
+## Fleet 4.60.0 (Nov 27, 2024)
+
+### Endpoint operations
+- Added support for labels_include_any to gitops.
+- Added major improvements to keyboard accessibility throughout app (e.g. checkboxes, dropdowns, table navigation).
+- Added activity item for `fleetd` enrollment with host serial and display name.
+- Added capability for Fleet to serve YARA rules to agents over HTTPS authenticated via node key (requires osquery 5.14+).
+- Added a query to allow users to turn on/off automations while being transparent of the current log destination.
+- Updated UI to allow users to view scripts (from both the scripts page and host details page) without downloading them.
+- Updated activity feed to generate an activity when activity automations are enabled, edited, or disabled.
+- Cancelled pending script executions when a script is edited or deleted.
+
+### Device management (MDM)
+- Added better handling of timeout and insufficient permissions errors in NDES SCEP proxy.
+- Added info banner for cloud customers to help with their windows autoenrollment setup.
+- Added DB support for "include any" label profile deployment.
+- Added support for "include any" label/profile relationships to the profile reconciliation machinery.
+- Added `team_identifier` signature information to Apple macOS applications to the `/api/latest/fleet/hosts/:id/software` API endpoint.
+- Added indicator of how fresh a software title's host and version counts are on the title's details page.
+- Added UI for allowing users to install custom profiles on hosts that include any of the defined labels.
+- Added UI features supporting disk encryption for Ubuntu and Fedora Linux.
+- Added support for deb packages compressed with zstd.
+
+### Vulnerability management
+- Allowed skipping computationally heavy population of vulnerability details when populating host software on hosts list endpoint (`GET /api/latest/fleet/hosts`) when using Fleet Premium (`populate_software=without_vulnerability_descriptions`).
+
+### Bug fixes and improvements
+- Improved memory usage of the Fleet server when uploading a large software installer file. Note that the installer will now use (temporary) disk space and sufficient storage space is required.
+- Improved performance of adding and removing profiles to large teams by an order of magnitude.
+- Disabled accessibility via keyboard for forms that are disabled via a slider.
+- Updated software batch endpoint status code from 200 (OK) to 202 (Accepted).
+- Updated a package used for testing (msw) to improve security.
+- Updated to reboot linux machine on unlock to work around GDM bug on Ubuntu 24.04.
+- Updated GitOps to return an error if the deprecated `apple_bm_default_team` key is used and there are more than 1 ABM tokens in Fleet.
+- Dismissed error flash on the my device page when navigating to another URL.
+- Modified the Fleet setup experience feature to not run if there is no software or script configured for the setup experience.
+- Set a more accurate minimum height for the Add hosts > ChromeOS > Policy for extension field, avoiding a scrollbar.
+- Added UI prompt for user to reenter the password if SCEP/NDES url or username has changed.
+- Updated ABM public key to download as as PEM format instead of CRT.
+- Fixed issue with uploading macOS software packages that do not have a top level `Distribution.xml`, but do have a top level `PackageInfo.xml`. For example, Okta Verify.app.
+- Fixed some cases where Fleet Maintained Apps generated incorrect uninstall scripts.
+- Fixed a bug where a device that was removed from ABM and then added back wouldn't properly re-enroll in Fleet MDM.
+- Fixed name/version parsing issue with PE (EXE) installer self-extracting archives such as Opera.
+- Fixed a bug where the create and update label endpoints could return outdated information in a deployment using a mysql replica.
+- Fixed the MDM configuration profiles deployment when based on excluded labels.
+- Fixed gitops path resolution for installer queries and scripts to always be relative to where the query file or script is referenced. This change breaks existing YAML files that had to account for previous inconsistent behavior (e.g. installers in a subdirectory referencing scripts elsewhere).
+- Fixed issue where minimum OS version enforcement was not being applied during Apple ADE if MDM IdP integration was enabled.
+- Fixed a bug where users would be allowed to attempt an install of an App Store app on a host that was not MDM enrolled.
+
 ## Fleet 4.59.1 (Nov 18, 2024)
 
 ### Bug fixes
diff --git a/changes/14899-yara-rules b/changes/14899-yara-rules
deleted file mode 100644
index 2c92188cfc02..000000000000
--- a/changes/14899-yara-rules
+++ /dev/null
@@ -1 +0,0 @@
-* Added capability for Fleet to serve yara rules to agents over HTTPS authenticated via node key (requires osquery 5.14+).
\ No newline at end of file
diff --git a/changes/20595-improve-memory-usage-software-installers b/changes/20595-improve-memory-usage-software-installers
deleted file mode 100644
index 7e15f3b935de..000000000000
--- a/changes/20595-improve-memory-usage-software-installers
+++ /dev/null
@@ -1 +0,0 @@
-* Improved memory usage of the Fleet server when uploading a large software installer file. Note that the installer will now use (temporary) disk space and sufficient storage space is required.
diff --git a/changes/21338-scope-profile-pending-rebuild b/changes/21338-scope-profile-pending-rebuild
deleted file mode 100644
index 59e48839557e..000000000000
--- a/changes/21338-scope-profile-pending-rebuild
+++ /dev/null
@@ -1 +0,0 @@
-- Speed up adding and removing profiles to large teams by an order of magnitude
diff --git a/changes/21633-windows-auto-enrollment-info-banner b/changes/21633-windows-auto-enrollment-info-banner
deleted file mode 100644
index 86cdfafdaf8f..000000000000
--- a/changes/21633-windows-auto-enrollment-info-banner
+++ /dev/null
@@ -1 +0,0 @@
-- add info banner for cloud customers to help with their windows autoenrollment setup
diff --git a/changes/21709-activities-automation-activity b/changes/21709-activities-automation-activity
deleted file mode 100644
index bc47a6e27330..000000000000
--- a/changes/21709-activities-automation-activity
+++ /dev/null
@@ -1 +0,0 @@
-* Generate an activity when activity automations are enabled, edited, or disabled.
diff --git a/changes/21888-dequeue-pending-scripts b/changes/21888-dequeue-pending-scripts
deleted file mode 100644
index 3852ee09c3e4..000000000000
--- a/changes/21888-dequeue-pending-scripts
+++ /dev/null
@@ -1 +0,0 @@
-* Cancelled pending script executions when a script is edited or deleted.
diff --git a/changes/22162-exclude-labels-fix-default-behavior b/changes/22162-exclude-labels-fix-default-behavior
deleted file mode 100644
index 41524c8c0399..000000000000
--- a/changes/22162-exclude-labels-fix-default-behavior
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed the MDM configuration profiles deployment when based on excluded labels - prior to this fix, hosts were considered "not a member" of the label by default, even if they had not yet returned results for the excluded labels. The fix checks the label's creation time vs the host's last reported label results timestamp to prevent deploying a configuration profile if it does not yet know if the host is a member or not of those labels.
diff --git a/changes/22187-gitops-software-relative-paths b/changes/22187-gitops-software-relative-paths
deleted file mode 100644
index 8f1ce8f480ca..000000000000
--- a/changes/22187-gitops-software-relative-paths
+++ /dev/null
@@ -1 +0,0 @@
-* GitOps: Fixed path resolution for installer queries and scripts to always be relative to where the query file or script is referenced. This change breaks existing YAML files that had to account for previous inconsistent behavior (e.g. installers in a subdirectory referencing scripts elsewhere).
\ No newline at end of file
diff --git a/changes/22224-query-log-destinations b/changes/22224-query-log-destinations
deleted file mode 100644
index b6172a331b0e..000000000000
--- a/changes/22224-query-log-destinations
+++ /dev/null
@@ -1 +0,0 @@
-- Creating a query allow users to turn on/off automations while being transparent of the current log destination
diff --git a/changes/22269-software-title-updated-at b/changes/22269-software-title-updated-at
deleted file mode 100644
index dfc3f127697d..000000000000
--- a/changes/22269-software-title-updated-at
+++ /dev/null
@@ -1 +0,0 @@
-* Added indicator of how fresh a software title's host and version counts are on the title's details page
diff --git a/changes/22359-gitops-mult-abm b/changes/22359-gitops-mult-abm
deleted file mode 100644
index b7a7801edbf2..000000000000
--- a/changes/22359-gitops-mult-abm
+++ /dev/null
@@ -1,2 +0,0 @@
-- Updates GitOps to return an error if the deprecated `apple_bm_default_team` key is used and there
-  are more than 1 ABM tokens in Fleet.
\ No newline at end of file
diff --git a/changes/22361-os-update-ade-sso b/changes/22361-os-update-ade-sso
deleted file mode 100644
index 40221866fb93..000000000000
--- a/changes/22361-os-update-ade-sso
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fixed issue where minimum OS version enforcement was not being applied during Apple ADE if MDM
-  IdP integration was enabled.
diff --git a/changes/22437-linux-lock-black-screen b/changes/22437-linux-lock-black-screen
deleted file mode 100644
index edfd4dc8d477..000000000000
--- a/changes/22437-linux-lock-black-screen
+++ /dev/null
@@ -1 +0,0 @@
-- Reboot linux machine on unlock to work around GDM bug on Ubuntu 24.04
diff --git a/changes/22446-scripts-modal b/changes/22446-scripts-modal
deleted file mode 100644
index 1e06aea93108..000000000000
--- a/changes/22446-scripts-modal
+++ /dev/null
@@ -1 +0,0 @@
-- Users can view scripts in the UI (from both the scripts page and host details page) without downloading them
diff --git a/changes/22575-ui-for-include-any-labels b/changes/22575-ui-for-include-any-labels
deleted file mode 100644
index 5f66f8396b79..000000000000
--- a/changes/22575-ui-for-include-any-labels
+++ /dev/null
@@ -1,2 +0,0 @@
-- add UI for allowing users to install custom profiles on hosts that include any of the defined
-labels
diff --git a/changes/22576-labels-include-any-gitops b/changes/22576-labels-include-any-gitops
deleted file mode 100644
index 228171c7d161..000000000000
--- a/changes/22576-labels-include-any-gitops
+++ /dev/null
@@ -1 +0,0 @@
-- Add support for labels_include_any to gitops
diff --git a/changes/22578-db-schema b/changes/22578-db-schema
deleted file mode 100644
index 281c14a6b909..000000000000
--- a/changes/22578-db-schema
+++ /dev/null
@@ -1 +0,0 @@
-- Adds DB support for "include any" label profile deployment
\ No newline at end of file
diff --git a/changes/22581-cron-updates b/changes/22581-cron-updates
deleted file mode 100644
index f228460a0406..000000000000
--- a/changes/22581-cron-updates
+++ /dev/null
@@ -1 +0,0 @@
-- Adds support for "include any" label/profile relationships to the profile reconciliation machinery.
\ No newline at end of file
diff --git a/changes/22606-keyboard-accessiblity b/changes/22606-keyboard-accessiblity
deleted file mode 100644
index 6f863e248a7a..000000000000
--- a/changes/22606-keyboard-accessiblity
+++ /dev/null
@@ -1 +0,0 @@
-- Fleet UI: Major improvements to keyboard accessibility throughout app (e.g. checkboxes, dropdowns, table navigation)
\ No newline at end of file
diff --git a/changes/22702-linux-encryption-frontend b/changes/22702-linux-encryption-frontend
deleted file mode 100644
index a35d2423751b..000000000000
--- a/changes/22702-linux-encryption-frontend
+++ /dev/null
@@ -1 +0,0 @@
-- Added UI features supporting disk encryption for Ubuntu and Fedora Linux.
diff --git a/changes/22773-fma-uninstall-fix b/changes/22773-fma-uninstall-fix
deleted file mode 100644
index 74c4390533b5..000000000000
--- a/changes/22773-fma-uninstall-fix
+++ /dev/null
@@ -1 +0,0 @@
-- Fix some cases where Fleet Maintained Apps generated incorrect uninstall scripts
diff --git a/changes/22810-fleetd-enroll-activity b/changes/22810-fleetd-enroll-activity
deleted file mode 100644
index b9b9380a05df..000000000000
--- a/changes/22810-fleetd-enroll-activity
+++ /dev/null
@@ -1 +0,0 @@
-Added activity item for fleetd enrollment with host serial and display name.
diff --git a/changes/22891-zstd-deb-packages b/changes/22891-zstd-deb-packages
deleted file mode 100644
index f523dd62720d..000000000000
--- a/changes/22891-zstd-deb-packages
+++ /dev/null
@@ -1 +0,0 @@
-- Add support for deb packages compressed with zstd
diff --git a/changes/22985-disable-forms-keyboard-access b/changes/22985-disable-forms-keyboard-access
deleted file mode 100644
index 2e90b69dc543..000000000000
--- a/changes/22985-disable-forms-keyboard-access
+++ /dev/null
@@ -1 +0,0 @@
-- Fleet UI: Disable accessibility via keyboard for forms that are disabled via a slider
diff --git a/changes/23016-add-chrome-host-text-area-height b/changes/23016-add-chrome-host-text-area-height
deleted file mode 100644
index 7616f4bfa0a2..000000000000
--- a/changes/23016-add-chrome-host-text-area-height
+++ /dev/null
@@ -1,2 +0,0 @@
-* Set a more elegant minimum height for the Add hosts > ChromeOS > Policy for extension field,
-avoiding a scrollbar.
diff --git a/changes/23021-abm-cert-pem b/changes/23021-abm-cert-pem
deleted file mode 100644
index c1890e07bb29..000000000000
--- a/changes/23021-abm-cert-pem
+++ /dev/null
@@ -1 +0,0 @@
-- Download ABM public key as PEM format instead of CRT
diff --git a/changes/23078-allow-skipping-vuln-details b/changes/23078-allow-skipping-vuln-details
deleted file mode 100644
index 7a299339769b..000000000000
--- a/changes/23078-allow-skipping-vuln-details
+++ /dev/null
@@ -1 +0,0 @@
-* Allowed skipping computationally heavy population of vulnerability details when populating host software on hosts list endpoint (`GET /api/latest/fleet/hosts`) when using Fleet Premium (`populate_software=without_vulnerability_descriptions`)
\ No newline at end of file
diff --git a/changes/23128-update-mock-service-worker-package-for-secutiy b/changes/23128-update-mock-service-worker-package-for-secutiy
deleted file mode 100644
index aa9a3e47af24..000000000000
--- a/changes/23128-update-mock-service-worker-package-for-secutiy
+++ /dev/null
@@ -1 +0,0 @@
-- update a package used for testing (msw) to improve security
diff --git a/changes/23200-ade-enroll b/changes/23200-ade-enroll
deleted file mode 100644
index 6a6c597bf480..000000000000
--- a/changes/23200-ade-enroll
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fixes a bug where a device that was removed from ABM and then added back wouldn't properly
-  re-enroll in Fleet MDM
\ No newline at end of file
diff --git a/changes/23213-okta-verify b/changes/23213-okta-verify
deleted file mode 100644
index 6fd38a9e476b..000000000000
--- a/changes/23213-okta-verify
+++ /dev/null
@@ -1 +0,0 @@
-Fixed issue with uploading macOS software packages that do not have a top level Distribution.xml, but do have a top level PackageInfo.xml. For example, Okta Verify.app
diff --git a/changes/23247-vpp-app-install b/changes/23247-vpp-app-install
deleted file mode 100644
index 97a62eb9df09..000000000000
--- a/changes/23247-vpp-app-install
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fixes a bug where users would be allowed to attempt an install of an App Store app on a host that
-  was not MDM enrolled.
\ No newline at end of file
diff --git a/changes/23492-software-batch-status-code b/changes/23492-software-batch-status-code
deleted file mode 100644
index 9ab51770d9a4..000000000000
--- a/changes/23492-software-batch-status-code
+++ /dev/null
@@ -1 +0,0 @@
-* Updated software batch endpoint status code from 200 (OK) to 202 (Accepted)
\ No newline at end of file
diff --git a/changes/23525-ndes-errors b/changes/23525-ndes-errors
deleted file mode 100644
index 409723e8095c..000000000000
--- a/changes/23525-ndes-errors
+++ /dev/null
@@ -1 +0,0 @@
-Added better handling of timeout and insufficient permissions errors in NDES SCEP proxy.
diff --git a/changes/23540-pe-sfx b/changes/23540-pe-sfx
deleted file mode 100644
index 63c241a8be83..000000000000
--- a/changes/23540-pe-sfx
+++ /dev/null
@@ -1 +0,0 @@
-Fixed name/version parsing issue with PE (EXE) installer self-extracting archives such as Opera.
diff --git a/changes/23597-fix-create-update-label-returns-outdated-info b/changes/23597-fix-create-update-label-returns-outdated-info
deleted file mode 100644
index 3a5e26e5aa8c..000000000000
--- a/changes/23597-fix-create-update-label-returns-outdated-info
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed a bug where the create and update label endpoints could return outdated information in a deployment using a mysql replica.
diff --git a/changes/23651-reenter-password b/changes/23651-reenter-password
deleted file mode 100644
index b3fc7df44d87..000000000000
--- a/changes/23651-reenter-password
+++ /dev/null
@@ -1 +0,0 @@
-- Fleet UI: Prompt user to reenter the password if SCEP/NDES url or username has changed
diff --git a/changes/23669-dismiss-error-flash-on-url-change-dup b/changes/23669-dismiss-error-flash-on-url-change-dup
deleted file mode 100644
index 125774f81fe3..000000000000
--- a/changes/23669-dismiss-error-flash-on-url-change-dup
+++ /dev/null
@@ -1 +0,0 @@
-* Dismiss error flash on the my device page when navigating to another URL.
\ No newline at end of file
diff --git a/changes/24024-no-setup-exp b/changes/24024-no-setup-exp
deleted file mode 100644
index 44ab42bcf059..000000000000
--- a/changes/24024-no-setup-exp
+++ /dev/null
@@ -1,2 +0,0 @@
-- Modifies the Fleet setup experience feature to not run if there is no software or script
-  configured for the setup experience.
\ No newline at end of file
diff --git a/changes/8750-add-team_identifier-to-software b/changes/8750-add-team_identifier-to-software
deleted file mode 100644
index 0d05d81b0944..000000000000
--- a/changes/8750-add-team_identifier-to-software
+++ /dev/null
@@ -1 +0,0 @@
-* Added `team_identifier` signature information to Apple macOS applications to the `/api/latest/fleet/hosts/:id/software` API endpoint.
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index f9b80ed1e343..aeb5a838e0c5 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -4,11 +4,11 @@ name: fleet
 keywords:
   - fleet
   - osquery
-version: v6.2.2
+version: v6.2.3
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.59.1
+appVersion: v4.60.0
 dependencies:
   - name: mysql
     condition: mysql.enabled
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index 7e1c7f7916b2..231c8bb22b79 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -3,7 +3,7 @@
 hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 imageRepository: fleetdm/fleet
-imageTag: v4.59.1 # Version of Fleet to deploy
+imageTag: v4.60.0 # Version of Fleet to deploy
 podAnnotations: {} # Additional annotations to add to the Fleet pod
 serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
 resources:
diff --git a/infrastructure/dogfood/terraform/aws/variables.tf b/infrastructure/dogfood/terraform/aws/variables.tf
index cd04b77c5028..097ee9befe58 100644
--- a/infrastructure/dogfood/terraform/aws/variables.tf
+++ b/infrastructure/dogfood/terraform/aws/variables.tf
@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.59.1"
+  default     = "fleetdm/fleet:v4.60.0"
 }
 
 variable "software_inventory" {
diff --git a/infrastructure/dogfood/terraform/gcp/variables.tf b/infrastructure/dogfood/terraform/gcp/variables.tf
index deb96bc38ec1..4cc4956f107e 100644
--- a/infrastructure/dogfood/terraform/gcp/variables.tf
+++ b/infrastructure/dogfood/terraform/gcp/variables.tf
@@ -68,7 +68,7 @@ variable "redis_mem" {
 }
 
 variable "image" {
-  default = "fleetdm/fleet:v4.59.1"
+  default = "fleetdm/fleet:v4.60.0"
 }
 
 variable "software_installers_bucket_name" {
diff --git a/infrastructure/guardduty/.terraform.lock.hcl b/infrastructure/guardduty/.terraform.lock.hcl
index 5b743eb544e9..f8978d7aa6d4 100644
--- a/infrastructure/guardduty/.terraform.lock.hcl
+++ b/infrastructure/guardduty/.terraform.lock.hcl
@@ -2,8 +2,8 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version     = "4.59.1"
-  constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.59.1"
+  version     = "4.60.0"
+  constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.60.0"
   hashes = [
     "h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
     "zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
diff --git a/infrastructure/guardduty/main.tf b/infrastructure/guardduty/main.tf
index fdeb7607e00e..f1ce03a2748d 100644
--- a/infrastructure/guardduty/main.tf
+++ b/infrastructure/guardduty/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.59.1"
+      version = "~> 4.60.0"
     }
   }
   backend "s3" {
diff --git a/infrastructure/infrastructure/cloudtrail/main.tf b/infrastructure/infrastructure/cloudtrail/main.tf
index 0eaff5aff2ea..a000f06d08ad 100644
--- a/infrastructure/infrastructure/cloudtrail/main.tf
+++ b/infrastructure/infrastructure/cloudtrail/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.59.1"
+      version = "~> 4.60.0"
     }
   }
   backend "s3" {
diff --git a/infrastructure/infrastructure/elastic-agent/.terraform.lock.hcl b/infrastructure/infrastructure/elastic-agent/.terraform.lock.hcl
index c327efe67542..4ed29230cf87 100644
--- a/infrastructure/infrastructure/elastic-agent/.terraform.lock.hcl
+++ b/infrastructure/infrastructure/elastic-agent/.terraform.lock.hcl
@@ -2,8 +2,8 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version     = "4.59.1"
-  constraints = ">= 3.63.0, ~> 4.59.1"
+  version     = "4.60.0"
+  constraints = ">= 3.63.0, ~> 4.60.0"
   hashes = [
     "h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
     "zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
diff --git a/infrastructure/infrastructure/elastic-agent/main.tf b/infrastructure/infrastructure/elastic-agent/main.tf
index 78f310682be3..41f8b21f8e92 100644
--- a/infrastructure/infrastructure/elastic-agent/main.tf
+++ b/infrastructure/infrastructure/elastic-agent/main.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.59.1"
+      version = "~> 4.60.0"
     }
   }
   backend "s3" {
diff --git a/infrastructure/infrastructure/guardduty-alerts/.terraform.lock.hcl b/infrastructure/infrastructure/guardduty-alerts/.terraform.lock.hcl
index 5b743eb544e9..f8978d7aa6d4 100644
--- a/infrastructure/infrastructure/guardduty-alerts/.terraform.lock.hcl
+++ b/infrastructure/infrastructure/guardduty-alerts/.terraform.lock.hcl
@@ -2,8 +2,8 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version     = "4.59.1"
-  constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.59.1"
+  version     = "4.60.0"
+  constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.60.0"
   hashes = [
     "h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
     "zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
diff --git a/infrastructure/infrastructure/guardduty-alerts/main.tf b/infrastructure/infrastructure/guardduty-alerts/main.tf
index 4d0e0f4a6805..698cfd3e2250 100644
--- a/infrastructure/infrastructure/guardduty-alerts/main.tf
+++ b/infrastructure/infrastructure/guardduty-alerts/main.tf
@@ -15,7 +15,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.59.1"
+      version = "~> 4.60.0"
     }
   }
   backend "s3" {
diff --git a/infrastructure/infrastructure/spend_alerts/main.tf b/infrastructure/infrastructure/spend_alerts/main.tf
index 837d69399e1a..7af7ceac5463 100644
--- a/infrastructure/infrastructure/spend_alerts/main.tf
+++ b/infrastructure/infrastructure/spend_alerts/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.59.1"
+      version = "~> 4.60.0"
     }
   }
   backend "s3" {
diff --git a/terraform/addons/vuln-processing/variables.tf b/terraform/addons/vuln-processing/variables.tf
index b372a36ff8d4..bdf2ae161c88 100644
--- a/terraform/addons/vuln-processing/variables.tf
+++ b/terraform/addons/vuln-processing/variables.tf
@@ -24,7 +24,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = optional(number, 2048)
     vuln_data_stream_mem                 = optional(number, 1024)
     vuln_data_stream_cpu                 = optional(number, 512)
-    image                                = optional(string, "fleetdm/fleet:v4.59.1")
+    image                                = optional(string, "fleetdm/fleet:v4.60.0")
     family                               = optional(string, "fleet-vuln-processing")
     sidecars                             = optional(list(any), [])
     extra_environment_variables          = optional(map(string), {})
@@ -82,7 +82,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = 2048
     vuln_data_stream_mem                 = 1024
     vuln_data_stream_cpu                 = 512
-    image                                = "fleetdm/fleet:v4.59.1"
+    image                                = "fleetdm/fleet:v4.60.0"
     family                               = "fleet-vuln-processing"
     sidecars                             = []
     extra_environment_variables          = {}
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
index 580e94cbf51d..2ffd63d25a69 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
+++ b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
@@ -16,7 +16,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.59.1")
+    image                        = optional(string, "fleetdm/fleet:v4.60.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -119,7 +119,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.59.1"
+    image                        = "fleetdm/fleet:v4.60.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/byo-vpc/byo-db/variables.tf b/terraform/byo-vpc/byo-db/variables.tf
index ddd474e14ba7..94316f6d7a18 100644
--- a/terraform/byo-vpc/byo-db/variables.tf
+++ b/terraform/byo-vpc/byo-db/variables.tf
@@ -77,7 +77,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.59.1")
+    image                        = optional(string, "fleetdm/fleet:v4.60.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -205,7 +205,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.59.1"
+    image                        = "fleetdm/fleet:v4.60.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/byo-vpc/example/main.tf b/terraform/byo-vpc/example/main.tf
index 855ab59f9fc0..bca3bd652c85 100644
--- a/terraform/byo-vpc/example/main.tf
+++ b/terraform/byo-vpc/example/main.tf
@@ -17,7 +17,7 @@ provider "aws" {
 }
 
 locals {
-  fleet_image = "fleetdm/fleet:v4.59.1"
+  fleet_image = "fleetdm/fleet:v4.60.0"
   domain_name = "example.com"
 }
 
diff --git a/terraform/byo-vpc/variables.tf b/terraform/byo-vpc/variables.tf
index f85ddb408381..a8ca6742baa7 100644
--- a/terraform/byo-vpc/variables.tf
+++ b/terraform/byo-vpc/variables.tf
@@ -170,7 +170,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.59.1")
+    image                        = optional(string, "fleetdm/fleet:v4.60.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -298,7 +298,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.59.1"
+    image                        = "fleetdm/fleet:v4.60.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/example/main.tf b/terraform/example/main.tf
index 7f169df3e89b..4f8b3e035de9 100644
--- a/terraform/example/main.tf
+++ b/terraform/example/main.tf
@@ -63,8 +63,8 @@ module "fleet" {
 
   fleet_config = {
     # To avoid pull-rate limiting from dockerhub, consider using our quay.io mirror
-    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.59.1"
-    image = "fleetdm/fleet:v4.59.1" # override default to deploy the image you desire
+    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.60.0"
+    image = "fleetdm/fleet:v4.60.0" # override default to deploy the image you desire
     # See https://fleetdm.com/docs/deploy/reference-architectures#aws for appropriate scaling
     # memory and cpu.
     autoscaling = {
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 9f08b701df38..8f77be61526c 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -218,7 +218,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.59.1")
+    image                        = optional(string, "fleetdm/fleet:v4.60.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -346,7 +346,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.59.1"
+    image                        = "fleetdm/fleet:v4.60.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/tools/fleetctl-docker/Dockerfile b/tools/fleetctl-docker/Dockerfile
index 6b82ed628541..ca678cedf7fa 100644
--- a/tools/fleetctl-docker/Dockerfile
+++ b/tools/fleetctl-docker/Dockerfile
@@ -2,7 +2,7 @@ FROM rust:latest@sha256:56418f03475cf7b107f87d7fabe99ce9a4a9f9904daafa99be7c50d9
 
 ARG transporter_url=https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/ra/resources/download/public/Transporter__Linux/bin
 
-RUN cargo install --version 0.16.0 apple-codesign \
+RUN cargo install --locked --version 0.16.0 apple-codesign \
   && curl -sSf $transporter_url -o transporter_install.sh \
   && sh transporter_install.sh --target transporter --accept --noexec
 
diff --git a/tools/fleetctl-npm/package.json b/tools/fleetctl-npm/package.json
index d9d07156ca18..5dd2236b30d2 100644
--- a/tools/fleetctl-npm/package.json
+++ b/tools/fleetctl-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.59.1",
+  "version": "v4.60.0",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"