diff --git a/go.mod b/go.mod
index 1b4c79aa5645..3336dce5b175 100644
--- a/go.mod
+++ b/go.mod
@@ -34,7 +34,7 @@ require (
 	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7
 	k8s.io/utils v0.0.0-20241210054802-24370beab758
 	knative.dev/caching v0.0.0-20250415164313-8f20a1163dbf
-	knative.dev/hack v0.0.0-20250331013814-c577ed9f7775
+	knative.dev/hack v0.0.0-20251022160648-4a7a07f9b7b4
 	knative.dev/networking v0.0.0-20250415164913-6268d931d247
 	knative.dev/pkg v0.0.0-20250415155312-ed3e2158b883
 	sigs.k8s.io/yaml v1.4.0
diff --git a/go.sum b/go.sum
index 6005f387b15a..ad154abe5f93 100644
--- a/go.sum
+++ b/go.sum
@@ -958,8 +958,8 @@ k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJ
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 knative.dev/caching v0.0.0-20250415164313-8f20a1163dbf h1:qQnKB6mx+beHzsoKU8aKrRU0oWAfgzKG2JgWMzr8CrM=
 knative.dev/caching v0.0.0-20250415164313-8f20a1163dbf/go.mod h1:q8ma7YxJ8Dofr+5kf3qR72A/7Zxl9uqQlOdMwNgCXY4=
-knative.dev/hack v0.0.0-20250331013814-c577ed9f7775 h1:UstB8/aowofYFHjLyZdPh1K7qB9BCx+lP1WuiCspYRE=
-knative.dev/hack v0.0.0-20250331013814-c577ed9f7775/go.mod h1:R0ritgYtjLDO9527h5vb5X6gfvt5LCrJ55BNbVDsWiY=
+knative.dev/hack v0.0.0-20251022160648-4a7a07f9b7b4 h1:CLFOOEXo5A278ScEdqOf4UnekCtYJ9l1PCsAi4eQp+E=
+knative.dev/hack v0.0.0-20251022160648-4a7a07f9b7b4/go.mod h1:R0ritgYtjLDO9527h5vb5X6gfvt5LCrJ55BNbVDsWiY=
 knative.dev/networking v0.0.0-20250415164913-6268d931d247 h1:BQcW8ur+WAmj6GCpYHyUyWoaJWVTs/75W1EObUV/bdA=
 knative.dev/networking v0.0.0-20250415164913-6268d931d247/go.mod h1:Y6OMRz/12RC8fzVa3gAB6K8BR415xbF4z35IAbdMHFc=
 knative.dev/pkg v0.0.0-20250415155312-ed3e2158b883 h1:UeOY7009M0EHwdyW3P35Fc1U6FJHzBrj6Gf370do8zY=
diff --git a/pkg/reconciler/revision/cruds.go b/pkg/reconciler/revision/cruds.go
index a8eb1852adc3..4e3c7855562e 100644
--- a/pkg/reconciler/revision/cruds.go
+++ b/pkg/reconciler/revision/cruds.go
@@ -30,6 +30,7 @@ import (
 	"knative.dev/pkg/logging"
 	autoscalingv1alpha1 "knative.dev/serving/pkg/apis/autoscaling/v1alpha1"
 	v1 "knative.dev/serving/pkg/apis/serving/v1"
+	"knative.dev/serving/pkg/client/injection/reconciler/autoscaling/v1alpha1/podautoscaler"
 	"knative.dev/serving/pkg/reconciler/revision/config"
 	"knative.dev/serving/pkg/reconciler/revision/resources"
 )
@@ -104,5 +105,17 @@ func (c *Reconciler) createPA(
 	deployment *appsv1.Deployment,
 ) (*autoscalingv1alpha1.PodAutoscaler, error) {
 	pa := resources.MakePA(rev, deployment)
+
+	// Ensure autoscaling annotations are set before creating PA.
+	// This avoids a race condition where the informer cache sees the PA
+	// before the webhook defaulting completes.
+	cfg := config.FromContext(ctx)
+	if pa.Annotations == nil {
+		pa.Annotations = make(map[string]string)
+	}
+	if _, ok := pa.Annotations[podautoscaler.ClassAnnotationKey]; !ok && cfg.Autoscaler.PodAutoscalerClass != "" {
+		pa.Annotations[podautoscaler.ClassAnnotationKey] = cfg.Autoscaler.PodAutoscalerClass
+	}
+
 	return c.client.AutoscalingV1alpha1().PodAutoscalers(pa.Namespace).Create(ctx, pa, metav1.CreateOptions{})
 }
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 31ce189ffab3..fd621d181d4e 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -130,7 +130,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:dd8ca727b4aaf354ab17273617abcefc7b6e56ea5f5d5ff1f7840b6168b41d20
+          image: gcr.io/knative-releases/knative.dev/net-contour/cmd/controller@sha256:dd8ca727b4aaf354ab17273617abcefc7b6e56ea5f5d5ff1f7840b6168b41d20
           resources:
             requests:
               cpu: 40m
diff --git a/third_party/gateway-api-latest/net-gateway-api.yaml b/third_party/gateway-api-latest/net-gateway-api.yaml
index 19425576defe..38301c61eb01 100644
--- a/third_party/gateway-api-latest/net-gateway-api.yaml
+++ b/third_party/gateway-api-latest/net-gateway-api.yaml
@@ -95,7 +95,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller@sha256:e8aede7a9af7bd31a2c6d11216e3a81d09d83b7a5bccc6939a6ab29f80139ac1
+          image: gcr.io/knative-releases/knative.dev/net-gateway-api/cmd/controller@sha256:cf6eb5b8d4364976c449d489363e69453d003508bd27cf1548bf1fec78c876c7
           resources:
             requests:
               cpu: 100m
@@ -173,7 +173,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/webhook@sha256:5685197c06ce287e4fdb331733aa3fe686dd27b5e784677234b56c13ef6e0021
+          image: gcr.io/knative-releases/knative.dev/net-gateway-api/cmd/webhook@sha256:fa238aa79849f272a763a0871472236fb3246bcc5ec6c91692074967e36c50ec
           resources:
             requests:
               cpu: 20m
diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 88a8004b9b97..c3de18121122 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -336,7 +336,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:18376be76f77cd195e2bb4993eebf86c6b8c34222247f2f8e4a265c5c4e9b9a8
+          image: gcr.io/knative-releases/knative.dev/net-istio/cmd/controller@sha256:0d5f740b4224ceae5a2e96325868d492ebf9433c3efc4b834e74e6408a76f9c5
           resources:
             requests:
               cpu: 30m
@@ -436,7 +436,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:dcc32d23e1565c26620c3735c28ea294215e8b01dd9a30b58e19152879b89422
+          image: gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook@sha256:697668be78934fa964730c745acb7bd951ed1160cd449f56ffc351d025e5261a
           resources:
             requests:
               cpu: 20m
diff --git a/third_party/kourier-latest/kourier.yaml b/third_party/kourier-latest/kourier.yaml
index bd87221f1e7a..0d8cf99c7f62 100644
--- a/third_party/kourier-latest/kourier.yaml
+++ b/third_party/kourier-latest/kourier.yaml
@@ -356,7 +356,7 @@ spec:
         app: net-kourier-controller
     spec:
       containers:
-        - image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier@sha256:6b86707a3042217d18a57911748e99033850af2703645747feb58bb6dd0ff400
+        - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:15a601147ef4574386e296c4b2456bb1e230d2dc110254295dddb56e5118b5a8
           name: controller
           env:
             - name: CERTS_SECRET_NAMESPACE
diff --git a/vendor/knative.dev/hack/library.sh b/vendor/knative.dev/hack/library.sh
index d487a14957e6..447484b6de37 100644
--- a/vendor/knative.dev/hack/library.sh
+++ b/vendor/knative.dev/hack/library.sh
@@ -588,7 +588,7 @@ function report_go_test() {
   logfile="${logfile/.xml/.jsonl}"
   echo "Running go test with args: ${go_test_args[*]}"
   local gotest_retcode=0
-  go_run gotest.tools/gotestsum@v1.11.0 \
+  go_run gotest.tools/gotestsum@v1.13.0 \
     --format "${GO_TEST_VERBOSITY:-testname}" \
     --junitfile "${xml}" \
     --junitfile-testsuite-name relative \
@@ -681,7 +681,7 @@ function start_knative_eventing_extension() {
 # Parameters: $1 - tool package for go run.
 #             $2..$n - parameters passed to the tool.
 function go_run() {
-  local package
+  local package gotoolchain
   package="$1"
   if [[ "$package" != *@* ]]; then
     abort 'Package for "go_run" needs to have @version'
@@ -696,6 +696,11 @@ function go_run() {
     GORUN_PATH="$(mktemp -t -d -u gopath.XXXXXXXX)"
   fi
   export GORUN_PATH
+  gotoolchain="$(go env GOTOOLCHAIN)"
+  if [[ "$package" == knative.dev/toolbox/* ]]; then
+    gotoolchain=auto
+  fi
+  GOTOOLCHAIN="${gotoolchain}" \
   GOPATH="${GORUN_PATH}" \
   GOFLAGS='' \
     go run "$package" "$@"
diff --git a/vendor/knative.dev/hack/presubmit-tests.sh b/vendor/knative.dev/hack/presubmit-tests.sh
index b96ffadf43ea..f11585d49fad 100644
--- a/vendor/knative.dev/hack/presubmit-tests.sh
+++ b/vendor/knative.dev/hack/presubmit-tests.sh
@@ -141,7 +141,7 @@ function __build_test_runner_for_module() {
   # Don't merge these two lines, or return code will always be 0.
   # Get all build tags in go code (ignore /vendor, /hack and /third_party)
   local tags
-  tags="$(go run knative.dev/toolbox/go-ls-tags@latest --joiner=,)"
+  tags="$(go_run knative.dev/toolbox/go-ls-tags@latest --joiner=,)"
   local go_pkg_dirs
   go_pkg_dirs="$(go list -tags "${tags}" ./...)" || return $?
   if [[ -z "${go_pkg_dirs}" ]]; then
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 9beee3a87669..38b701be81e0 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1420,7 +1420,7 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake
 knative.dev/caching/pkg/client/injection/informers/factory
 knative.dev/caching/pkg/client/injection/informers/factory/fake
 knative.dev/caching/pkg/client/listers/caching/v1alpha1
-# knative.dev/hack v0.0.0-20250331013814-c577ed9f7775
+# knative.dev/hack v0.0.0-20251022160648-4a7a07f9b7b4
 ## explicit; go 1.21
 knative.dev/hack
 # knative.dev/networking v0.0.0-20250415164913-6268d931d247