diff --git a/contrib/tetragon-rthooks/go.mod b/contrib/tetragon-rthooks/go.mod
index e513c87dcbc..48237167226 100644
--- a/contrib/tetragon-rthooks/go.mod
+++ b/contrib/tetragon-rthooks/go.mod
@@ -27,8 +27,8 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/ttrpc v1.2.6 // indirect
-	github.com/containerd/typeurl/v2 v2.2.2 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/containers/storage v1.56.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.1-0.20231103132048-7d375ecc2b09 // indirect
 	github.com/cyphar/filepath-securejoin v0.3.5 // indirect
diff --git a/contrib/tetragon-rthooks/go.sum b/contrib/tetragon-rthooks/go.sum
index 2e79c59dd8d..15cbce0ae5b 100644
--- a/contrib/tetragon-rthooks/go.sum
+++ b/contrib/tetragon-rthooks/go.sum
@@ -25,10 +25,10 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/nri v0.9.0 h1:jribDJs/oQ95vLO4Yn19HKFYriZGWKiG6nKWjl9Y/x4=
 github.com/containerd/nri v0.9.0/go.mod h1:sDRoMy5U4YolsWthg7TjTffAwPb6LEr//83O+D3xVU4=
-github.com/containerd/ttrpc v1.2.6 h1:zG+Kn5EZ6MUYCS1t2Hmt2J4tMVaLSFEJVOraDQwNPC4=
-github.com/containerd/ttrpc v1.2.6/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl/v2 v2.2.2 h1:3jN/k2ysKuPCsln5Qv8bzR9cxal8XjkxPogJfSNO31k=
-github.com/containerd/typeurl/v2 v2.2.2/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
+github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/containers/common v0.61.0 h1:j/84PTqZIKKYy42OEJsZmjZ4g4Kq2ERuC3tqp2yWdh4=
 github.com/containers/common v0.61.0/go.mod h1:NGRISq2vTFPSbhNqj6MLwyes4tWSlCnqbJg7R77B8xc=
 github.com/containers/storage v1.56.0 h1:DZ9KSkj6M2tvj/4bBoaJu3QDHRl35BwsZ4kmLJS97ZI=
diff --git a/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/metadata.go b/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/metadata.go
index ce8c0d13c41..6e004248742 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/metadata.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/metadata.go
@@ -62,6 +62,34 @@ func (m MD) Append(key string, values ...string) {
 	}
 }
 
+// Clone returns a copy of MD or nil if it's nil.
+// It's copied from golang's `http.Header.Clone` implementation:
+// https://cs.opensource.google/go/go/+/refs/tags/go1.23.4:src/net/http/header.go;l=94
+func (m MD) Clone() MD {
+	if m == nil {
+		return nil
+	}
+
+	// Find total number of values.
+	nv := 0
+	for _, vv := range m {
+		nv += len(vv)
+	}
+	sv := make([]string, nv) // shared backing array for headers' values
+	m2 := make(MD, len(m))
+	for k, vv := range m {
+		if vv == nil {
+			// Preserve nil values.
+			m2[k] = nil
+			continue
+		}
+		n := copy(sv, vv)
+		m2[k] = sv[:n:n]
+		sv = sv[n:]
+	}
+	return m2
+}
+
 func (m MD) setRequest(r *Request) {
 	for k, values := range m {
 		for _, v := range values {
diff --git a/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/server.go b/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/server.go
index 26419831dac..bb71de677b0 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/server.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/containerd/ttrpc/server.go
@@ -74,9 +74,18 @@ func (s *Server) RegisterService(name string, desc *ServiceDesc) {
 }
 
 func (s *Server) Serve(ctx context.Context, l net.Listener) error {
-	s.addListener(l)
+	s.mu.Lock()
+	s.addListenerLocked(l)
 	defer s.closeListener(l)
 
+	select {
+	case <-s.done:
+		s.mu.Unlock()
+		return ErrServerClosed
+	default:
+	}
+	s.mu.Unlock()
+
 	var (
 		backoff    time.Duration
 		handshaker = s.config.handshaker
@@ -188,9 +197,7 @@ func (s *Server) Close() error {
 	return err
 }
 
-func (s *Server) addListener(l net.Listener) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+func (s *Server) addListenerLocked(l net.Listener) {
 	s.listeners[l] = struct{}{}
 }
 
diff --git a/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types.go b/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types.go
index efc405ddd48..9bf78104165 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types.go
@@ -39,7 +39,7 @@ type handler interface {
 	Marshaller(interface{}) func() ([]byte, error)
 	Unmarshaller(interface{}) func([]byte) error
 	TypeURL(interface{}) string
-	GetType(url string) reflect.Type
+	GetType(url string) (reflect.Type, bool)
 }
 
 // Definitions of common error types used throughout typeurl.
@@ -240,7 +240,7 @@ func MarshalAnyToProto(from interface{}) (*anypb.Any, error) {
 }
 
 func unmarshal(typeURL string, value []byte, v interface{}) (interface{}, error) {
-	t, err := getTypeByUrl(typeURL)
+	t, isProto, err := getTypeByUrl(typeURL)
 	if err != nil {
 		return nil, err
 	}
@@ -258,14 +258,16 @@ func unmarshal(typeURL string, value []byte, v interface{}) (interface{}, error)
 		}
 	}
 
-	pm, ok := v.(proto.Message)
-	if ok {
-		return v, proto.Unmarshal(value, pm)
-	}
+	if isProto {
+		pm, ok := v.(proto.Message)
+		if ok {
+			return v, proto.Unmarshal(value, pm)
+		}
 
-	for _, h := range handlers {
-		if unmarshal := h.Unmarshaller(v); unmarshal != nil {
-			return v, unmarshal(value)
+		for _, h := range handlers {
+			if unmarshal := h.Unmarshaller(v); unmarshal != nil {
+				return v, unmarshal(value)
+			}
 		}
 	}
 
@@ -273,12 +275,12 @@ func unmarshal(typeURL string, value []byte, v interface{}) (interface{}, error)
 	return v, json.Unmarshal(value, v)
 }
 
-func getTypeByUrl(url string) (reflect.Type, error) {
+func getTypeByUrl(url string) (_ reflect.Type, isProto bool, _ error) {
 	mu.RLock()
 	for t, u := range registry {
 		if u == url {
 			mu.RUnlock()
-			return t, nil
+			return t, false, nil
 		}
 	}
 	mu.RUnlock()
@@ -286,15 +288,15 @@ func getTypeByUrl(url string) (reflect.Type, error) {
 	if err != nil {
 		if errors.Is(err, protoregistry.NotFound) {
 			for _, h := range handlers {
-				if t := h.GetType(url); t != nil {
-					return t, nil
+				if t, isProto := h.GetType(url); t != nil {
+					return t, isProto, nil
 				}
 			}
 		}
-		return nil, fmt.Errorf("type with url %s: %w", url, ErrNotFound)
+		return nil, false, fmt.Errorf("type with url %s: %w", url, ErrNotFound)
 	}
 	empty := mt.New().Interface()
-	return reflect.TypeOf(empty).Elem(), nil
+	return reflect.TypeOf(empty).Elem(), true, nil
 }
 
 func tryDereference(v interface{}) reflect.Type {
diff --git a/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types_gogo.go b/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types_gogo.go
index fa293323bef..adb892ec60c 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types_gogo.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/containerd/typeurl/v2/types_gogo.go
@@ -59,10 +59,10 @@ func (gogoHandler) TypeURL(v interface{}) string {
 	return gogoproto.MessageName(pm)
 }
 
-func (gogoHandler) GetType(url string) reflect.Type {
+func (gogoHandler) GetType(url string) (reflect.Type, bool) {
 	t := gogoproto.MessageType(url)
 	if t == nil {
-		return nil
+		return nil, false
 	}
-	return t.Elem()
+	return t.Elem(), true
 }
diff --git a/contrib/tetragon-rthooks/vendor/modules.txt b/contrib/tetragon-rthooks/vendor/modules.txt
index 0dafa523b7a..f6718928bc9 100644
--- a/contrib/tetragon-rthooks/vendor/modules.txt
+++ b/contrib/tetragon-rthooks/vendor/modules.txt
@@ -39,10 +39,10 @@ github.com/containerd/nri/pkg/log
 github.com/containerd/nri/pkg/net
 github.com/containerd/nri/pkg/net/multiplex
 github.com/containerd/nri/pkg/stub
-# github.com/containerd/ttrpc v1.2.6
+# github.com/containerd/ttrpc v1.2.7
 ## explicit; go 1.19
 github.com/containerd/ttrpc
-# github.com/containerd/typeurl/v2 v2.2.2
+# github.com/containerd/typeurl/v2 v2.2.3
 ## explicit; go 1.21
 github.com/containerd/typeurl/v2
 # github.com/containers/common v0.61.0