diff --git a/contrib/tetragon-rthooks/go.mod b/contrib/tetragon-rthooks/go.mod
index 994359899fa..b99828b4a68 100644
--- a/contrib/tetragon-rthooks/go.mod
+++ b/contrib/tetragon-rthooks/go.mod
@@ -6,7 +6,7 @@ go 1.23.0
 toolchain go1.23.1
 
 require (
-	github.com/alecthomas/kong v1.7.0
+	github.com/alecthomas/kong v1.8.0
 	github.com/cilium/lumberjack/v2 v2.4.1
 	github.com/cilium/tetragon/api v0.0.0-00010101000000-000000000000
 	github.com/containerd/containerd v1.7.25
diff --git a/contrib/tetragon-rthooks/go.sum b/contrib/tetragon-rthooks/go.sum
index c94b9c32fb9..050b4d48d73 100644
--- a/contrib/tetragon-rthooks/go.sum
+++ b/contrib/tetragon-rthooks/go.sum
@@ -7,8 +7,8 @@ github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0
 github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/kong v1.7.0 h1:MnT8+5JxFDCvISeI6vgd/mFbAJwueJ/pqQNzZMsiqZE=
-github.com/alecthomas/kong v1.7.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/kong v1.8.0 h1:LEDIdSYrHU+4oTF2BL0NAfw++wH6lg/LzAJodTkLikM=
+github.com/alecthomas/kong v1.8.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/.golangci.yml b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/.golangci.yml
index 844092f993b..3a05633a471 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/.golangci.yml
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/.golangci.yml
@@ -42,6 +42,7 @@ linters:
     - copyloopvar
     - intrange
     - execinquery
+    - nakedret
 
 linters-settings:
   govet:
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/callbacks.go b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/callbacks.go
index 4644c5487c7..2a296d09fef 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/callbacks.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/callbacks.go
@@ -81,57 +81,44 @@ func getMethod(value reflect.Value, name string) reflect.Value {
 // and any embedded fields.
 //
 // Returns a slice of bound methods that can be called directly.
-func getMethods(value reflect.Value, name string) []reflect.Value {
-	// Traverses embedded fields of the struct
-	// starting from the given value to collect all possible receivers
-	// for the given method name.
-	var traverse func(value reflect.Value, receivers []reflect.Value) []reflect.Value
-	traverse = func(value reflect.Value, receivers []reflect.Value) []reflect.Value {
-		// Always consider the current value for hooks.
-		receivers = append(receivers, value)
-
-		if value.Kind() == reflect.Ptr {
-			value = value.Elem()
-		}
+func getMethods(value reflect.Value, name string) (methods []reflect.Value) {
+	if value.Kind() == reflect.Ptr {
+		value = value.Elem()
+	}
+	if !value.IsValid() {
+		return
+	}
 
-		// If the current value is a struct, also consider embedded fields.
-		// Two kinds of embedded fields are considered if they're exported:
-		//
-		//   - standard Go embedded fields
-		//   - fields tagged with `embed:""`
-		if value.Kind() == reflect.Struct {
-			t := value.Type()
-			for i := 0; i < value.NumField(); i++ {
-				fieldValue := value.Field(i)
-				field := t.Field(i)
-
-				if !field.IsExported() {
-					continue
-				}
-
-				// Consider a field embedded if it's actually embedded
-				// or if it's tagged with `embed:""`.
-				_, isEmbedded := field.Tag.Lookup("embed")
-				isEmbedded = isEmbedded || field.Anonymous
-				if isEmbedded {
-					receivers = traverse(fieldValue, receivers)
-				}
-			}
-		}
+	if method := getMethod(value, name); method.IsValid() {
+		methods = append(methods, method)
+	}
 
-		return receivers
+	if value.Kind() != reflect.Struct {
+		return
 	}
+	// If the current value is a struct, also consider embedded fields.
+	// Two kinds of embedded fields are considered if they're exported:
+	//
+	//   - standard Go embedded fields
+	//   - fields tagged with `embed:""`
+	t := value.Type()
+	for i := 0; i < value.NumField(); i++ {
+		fieldValue := value.Field(i)
+		field := t.Field(i)
 
-	receivers := traverse(value, nil /* receivers */)
+		if !field.IsExported() {
+			continue
+		}
 
-	// Search all receivers for methods
-	var methods []reflect.Value
-	for _, receiver := range receivers {
-		if method := getMethod(receiver, name); method.IsValid() {
-			methods = append(methods, method)
+		// Consider a field embedded if it's actually embedded
+		// or if it's tagged with `embed:""`.
+		_, isEmbedded := field.Tag.Lookup("embed")
+		isEmbedded = isEmbedded || field.Anonymous
+		if isEmbedded {
+			methods = append(methods, getMethods(fieldValue, name)...)
 		}
 	}
-	return methods
+	return
 }
 
 func callFunction(f reflect.Value, bindings bindings) error {
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/kong.go b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/kong.go
index b85e145296c..3cb2e40c333 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/kong.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/kong.go
@@ -91,7 +91,7 @@ func New(grammar any, options ...Option) (*Kong, error) {
 		},
 	}
 
-	options = append(options, Bind(k))
+	options = append(options, Bind(k), Resolvers(EnvResolver()))
 
 	for _, option := range options {
 		if err := option.Apply(k); err != nil {
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/lefthook.yml b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/lefthook.yml
new file mode 100644
index 00000000000..28ba9ad9b3a
--- /dev/null
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/lefthook.yml
@@ -0,0 +1,11 @@
+output:
+  - success
+  - failure
+pre-push:
+  parallel: true
+  jobs:
+    - name: test
+      run: go test -v ./...
+
+    - name: lint
+      run: golangci-lint run
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/model.go b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/model.go
index 065fcdd0848..391323912fe 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/model.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/model.go
@@ -3,7 +3,6 @@ package kong
 import (
 	"fmt"
 	"math"
-	"os"
 	"reflect"
 	"strconv"
 	"strings"
@@ -377,19 +376,6 @@ func (v *Value) ApplyDefault() error {
 // Does not include resolvers.
 func (v *Value) Reset() error {
 	v.Target.Set(reflect.Zero(v.Target.Type()))
-	if len(v.Tag.Envs) != 0 {
-		for _, env := range v.Tag.Envs {
-			envar, ok := os.LookupEnv(env)
-			// Parse the first non-empty ENV in the list
-			if ok {
-				err := v.Parse(ScanFromTokens(Token{Type: FlagValueToken, Value: envar}), v.Target)
-				if err != nil {
-					return fmt.Errorf("%s (from envar %s=%q)", err, env, envar)
-				}
-				return nil
-			}
-		}
-	}
 	if v.HasDefault {
 		return v.Parse(ScanFromTokens(Token{Type: FlagValueToken, Value: v.Default}), v.Target)
 	}
diff --git a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/resolver.go b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/resolver.go
index 29be1b9189f..d28158ff62d 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/resolver.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/alecthomas/kong/resolver.go
@@ -2,7 +2,9 @@ package kong
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
+	"os"
 	"strings"
 )
 
@@ -66,3 +68,69 @@ func snakeCase(name string) string {
 	name = strings.Join(strings.Split(strings.Title(name), "-"), "")
 	return strings.ToLower(name[:1]) + name[1:]
 }
+
+// EnvResolver provides a resolver for environment variables tags
+func EnvResolver() Resolver {
+	// Resolvers are typically only invoked for flags, as shown here:
+	// https://github.com/alecthomas/kong/blob/v1.6.0/context.go#L567
+	// However, environment variable annotations can also apply to arguments,
+	// as demonstrated in this test:
+	// https://github.com/alecthomas/kong/blob/v1.6.0/kong_test.go#L1226-L1244
+	// To handle this, we ensure that arguments are resolved as well.
+	// Since the resolution only needs to happen once, we use this boolean
+	// to track whether the resolution process has already been performed.
+	argsResolved := false
+	return ResolverFunc(func(context *Context, parent *Path, flag *Flag) (interface{}, error) {
+		if !argsResolved {
+			if err := resolveArgs(context.Path); err != nil {
+				return nil, err
+			}
+			// once resolved we do not want to run this anymore
+			argsResolved = true
+		}
+		for _, env := range flag.Tag.Envs {
+			envar, ok := os.LookupEnv(env)
+			// Parse the first non-empty ENV in the list
+			if ok {
+				return envar, nil
+			}
+		}
+		return nil, nil
+	})
+}
+
+func resolveArgs(paths []*Path) error {
+	for _, path := range paths {
+		if path.Command == nil {
+			continue
+		}
+		for _, positional := range path.Command.Positional {
+			if positional.Tag == nil {
+				continue
+			}
+			if err := visitValue(positional); err != nil {
+				return err
+			}
+		}
+		if path.Command.Argument != nil {
+			if err := visitValue(path.Command.Argument); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func visitValue(value *Value) error {
+	for _, env := range value.Tag.Envs {
+		envar, ok := os.LookupEnv(env)
+		if !ok {
+			continue
+		}
+		token := Token{Type: FlagValueToken, Value: envar}
+		if err := value.Parse(ScanFromTokens(token), value.Target); err != nil {
+			return fmt.Errorf("%s (from envar %s=%q)", err, env, envar)
+		}
+	}
+	return nil
+}
diff --git a/contrib/tetragon-rthooks/vendor/modules.txt b/contrib/tetragon-rthooks/vendor/modules.txt
index 88016c92ff2..7a3c442d1b1 100644
--- a/contrib/tetragon-rthooks/vendor/modules.txt
+++ b/contrib/tetragon-rthooks/vendor/modules.txt
@@ -4,7 +4,7 @@ cel.dev/expr
 # dario.cat/mergo v1.0.1
 ## explicit; go 1.13
 dario.cat/mergo
-# github.com/alecthomas/kong v1.7.0
+# github.com/alecthomas/kong v1.8.0
 ## explicit; go 1.20
 github.com/alecthomas/kong
 # github.com/antlr4-go/antlr/v4 v4.13.0