diff --git a/verticadb-operator.yaml b/verticadb-operator.yaml
index 88a80d9498a..86af60bd59c 100644
--- a/verticadb-operator.yaml
+++ b/verticadb-operator.yaml
@@ -1,7 +1,7 @@
 package:
   name: verticadb-operator
   version: "25.4.0.0"
-  epoch: 1
+  epoch: 2 # GHSA-cfpf-hrx2-8rv6
   description: Simple, fast container image builder for Go applications.
   copyright:
     - license: Apache-2.0
@@ -25,6 +25,12 @@ pipeline:
       repository: https://github.com/vertica/vertica-kubernetes
       tag: v${{vars.mangled-package-version}}
 
+  - uses: go/bump
+    with:
+      deps: |-
+        github.com/expr-lang/expr@v1.17.7
+      go-version: 1.24
+
   - name: Setup go modroot
     runs: |
       make manifests generate fmt vet
@@ -36,13 +42,6 @@ pipeline:
       cp -r pkg workspace-verticadb-operator/
       cp -r local-libs workspace-verticadb-operator/
 
-  - uses: go/bump
-    with:
-      deps: |-
-        github.com/expr-lang/expr@v1.17.0
-      modroot: workspace-verticadb-operator
-      go-version: 1.24
-
   - uses: go/build
     with:
       modroot: workspace-verticadb-operator/