diff --git a/jsonnet/kube-prometheus/versions.json b/jsonnet/kube-prometheus/versions.json
index 8c71e72c7285c3222aec0e26339693e95756470b..b732590940b795b0b9946e6c4daa4e485115ec5e 100644
--- a/jsonnet/kube-prometheus/versions.json
+++ b/jsonnet/kube-prometheus/versions.json
@@ -3,7 +3,7 @@
   "blackboxExporter": "0.22.0",
   "grafana": "9.1.6",
   "kubeStateMetrics": "2.6.0",
-  "nodeExporter": "1.3.1",
+  "nodeExporter": "1.4.0",
   "prometheus": "2.38.0",
   "prometheusAdapter": "0.10.0",
   "prometheusOperator": "0.59.2",
diff --git a/jsonnetfile.lock.json b/jsonnetfile.lock.json
index f9f44d40010892e1fa7dcda6254fa59a306d0326..f18552631d6f2b1ed0e0db89cf7a18fc278a2eae 100644
--- a/jsonnetfile.lock.json
+++ b/jsonnetfile.lock.json
@@ -18,7 +18,7 @@
           "subdir": "contrib/mixin"
         }
       },
-      "version": "434c7c43097bfca31532fcc9b8966dd30a8fe103",
+      "version": "a932fb58f26ec862be858c884380c53a4975fb3b",
       "sum": "IkDHlaE0gvvcPjSNurFT+jQ2aCOAbqHF1WVmXbAgkds="
     },
     {
@@ -58,7 +58,7 @@
           "subdir": "grafana-builder"
         }
       },
-      "version": "351bfae3eee23db305597f272ef29ec16f99ee49",
+      "version": "2c06399b18ea6d31e61cab450c1a6ef9879a08b8",
       "sum": "tDR6yT2GVfw0wTU12iZH+m01HrbIr6g/xN+/8nzNkU0="
     },
     {
@@ -98,7 +98,7 @@
           "subdir": "jsonnet/mixin"
         }
       },
-      "version": "9f6bbb5913304f7eb951e4eb37fccd8a184c3b4a",
+      "version": "0e18c5c1c32663f1e20adfb6b13cdbda8f94538a",
       "sum": "GQmaVFJwKMiD/P4n3N2LrAZVcwutriWrP8joclDtBYQ=",
       "name": "prometheus-operator-mixin"
     },
@@ -109,8 +109,8 @@
           "subdir": "jsonnet/prometheus-operator"
         }
       },
-      "version": "9f6bbb5913304f7eb951e4eb37fccd8a184c3b4a",
-      "sum": "P56LHovRSvKxdKJuhR+qYhotTtORA5x1RtV59cChHdM="
+      "version": "0e18c5c1c32663f1e20adfb6b13cdbda8f94538a",
+      "sum": "Xyd3/8Q+vhz7/zqTp/OGd/8nqDef4WqzT69HI3xP2bM="
     },
     {
       "source": {
@@ -119,7 +119,7 @@
           "subdir": "doc/alertmanager-mixin"
         }
       },
-      "version": "33a0e77a7143fd0795ee20f2e45bbdfffb2dbbbb",
+      "version": "545529639209d9838aef521a56afeda55e59d982",
       "sum": "PsK+V7oETCPKu2gLoPfqY0wwPKH9TzhNj6o2xezjjXc=",
       "name": "alertmanager"
     },
@@ -130,7 +130,7 @@
           "subdir": "docs/node-mixin"
         }
       },
-      "version": "e0845a81fd99c32aa227f78bfddf6a74f3fec98d",
+      "version": "d9b2634324aa93a4b680f732359185eb02528ab7",
       "sum": "tappaHscNBSJCA6ypSWt7DDhohIOkxNjcLFRb3WKpu4="
     },
     {
@@ -140,7 +140,7 @@
           "subdir": "documentation/prometheus-mixin"
         }
       },
-      "version": "734772f82824db11344ea3c39a166449d0e7e468",
+      "version": "8120af22e2bc4f09e052cdb07e73def9e5b3b26e",
       "sum": "Dq+wurABxuqRAHj4DGp2sCmjJWzNjrhP2XEScsS0kmY=",
       "name": "prometheus"
     },
@@ -151,7 +151,7 @@
           "subdir": "config/crd/bases"
         }
       },
-      "version": "f5174c76aa20a4b673e9e919cd4bd88dfb9809fd",
+      "version": "592e4ddd83cb4426bc254d78028de53108a3d83b",
       "sum": "d1550yhsX4VxdVN7b0gWT0cido/W90P6OGLzLqPwZcs="
     },
     {
@@ -161,7 +161,7 @@
           "subdir": "mixin"
         }
       },
-      "version": "f4ffce659d2f1b47f45662c57b6e2b9ca60f61d6",
+      "version": "d533abf8354ca26a6fddfbf6722ab57df0ebff3b",
       "sum": "095uB0qB1Ek+aNYf+CgydVZk5aFETsfD8GYf6gDwSJs=",
       "name": "thanos-mixin"
     },
diff --git a/manifests/nodeExporter-clusterRole.yaml b/manifests/nodeExporter-clusterRole.yaml
index 9227c8fac19d5d77a7b2d1713557fdb7eb4b2cb2..abe7a82c976c4531ce412936b7785f2359f0ec72 100644
--- a/manifests/nodeExporter-clusterRole.yaml
+++ b/manifests/nodeExporter-clusterRole.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 rules:
diff --git a/manifests/nodeExporter-clusterRoleBinding.yaml b/manifests/nodeExporter-clusterRoleBinding.yaml
index 469eb712bdc9a41e5be4fa10e4c1121f602b51bc..c21d667a7bb3406c7c6ef6f7aae991d3c981a33d 100644
--- a/manifests/nodeExporter-clusterRoleBinding.yaml
+++ b/manifests/nodeExporter-clusterRoleBinding.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 roleRef:
diff --git a/manifests/nodeExporter-daemonset.yaml b/manifests/nodeExporter-daemonset.yaml
index 1720502f7afb269ba645e385a348ad308dcf34d5..085227f20fe5b70367f866cccad09d482763339d 100644
--- a/manifests/nodeExporter-daemonset.yaml
+++ b/manifests/nodeExporter-daemonset.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 spec:
@@ -22,7 +22,7 @@ spec:
         app.kubernetes.io/component: exporter
         app.kubernetes.io/name: node-exporter
         app.kubernetes.io/part-of: kube-prometheus
-        app.kubernetes.io/version: 1.3.1
+        app.kubernetes.io/version: 1.4.0
     spec:
       automountServiceAccountToken: true
       containers:
@@ -35,7 +35,7 @@ spec:
         - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/k3s/containerd/.+|var/lib/docker/.+|var/lib/kubelet/pods/.+)($|/)
         - --collector.netclass.ignored-devices=^(veth.*|[a-f0-9]{15})$
         - --collector.netdev.device-exclude=^(veth.*|[a-f0-9]{15})$
-        image: quay.io/prometheus/node-exporter:v1.3.1
+        image: quay.io/prometheus/node-exporter:v1.4.0
         name: node-exporter
         resources:
           limits:
diff --git a/manifests/nodeExporter-networkPolicy.yaml b/manifests/nodeExporter-networkPolicy.yaml
index 1d2291581793df78fbeb173930a83859434e80b4..9280a7799c264a75eac841ebf694ca1230613b19 100644
--- a/manifests/nodeExporter-networkPolicy.yaml
+++ b/manifests/nodeExporter-networkPolicy.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 spec:
diff --git a/manifests/nodeExporter-prometheusRule.yaml b/manifests/nodeExporter-prometheusRule.yaml
index 3747c9f7eb6c384970d2037247cb22d44c4f8827..56a5180783f41bef15b8474d74963d4d5135dff9 100644
--- a/manifests/nodeExporter-prometheusRule.yaml
+++ b/manifests/nodeExporter-prometheusRule.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
     prometheus: k8s
     role: alert-rules
   name: node-exporter-rules
diff --git a/manifests/nodeExporter-service.yaml b/manifests/nodeExporter-service.yaml
index 59bee6888da077c1779c9064b3c4ee1a65da3e19..b0a641138730da4c37048c63c91c0ac0cbdefd2d 100644
--- a/manifests/nodeExporter-service.yaml
+++ b/manifests/nodeExporter-service.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 spec:
diff --git a/manifests/nodeExporter-serviceAccount.yaml b/manifests/nodeExporter-serviceAccount.yaml
index c04d5daf9a95c95d9fb24e8fbf8c77c1bda14f6e..0038ba3ee98a71e6e39ad232c256ea4d61f80817 100644
--- a/manifests/nodeExporter-serviceAccount.yaml
+++ b/manifests/nodeExporter-serviceAccount.yaml
@@ -6,6 +6,6 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
diff --git a/manifests/nodeExporter-serviceMonitor.yaml b/manifests/nodeExporter-serviceMonitor.yaml
index 7814fc7d6c26ff74278cdb1f30a49203c9551636..7fa957833ad319c713db6f50e4f19a0fa5066388 100644
--- a/manifests/nodeExporter-serviceMonitor.yaml
+++ b/manifests/nodeExporter-serviceMonitor.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: node-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 1.3.1
+    app.kubernetes.io/version: 1.4.0
   name: node-exporter
   namespace: monitoring
 spec:
diff --git a/manifests/setup/0alertmanagerCustomResourceDefinition.yaml b/manifests/setup/0alertmanagerCustomResourceDefinition.yaml
index 2145f17f32f45f6e54eefd125c27ba3ad3d5bc81..6ec04ee5e3e9878a42da3e6d9f46a74e654f3523 100644
--- a/manifests/setup/0alertmanagerCustomResourceDefinition.yaml
+++ b/manifests/setup/0alertmanagerCustomResourceDefinition.yaml
@@ -1412,7 +1412,7 @@ spec:
                   as the Alertmanager object, which shall be mounted into the Alertmanager
                   Pods. Each ConfigMap is added to the StatefulSet definition as a
                   volume named `configmap-<configmap-name>`. The ConfigMaps are mounted
-                  into /etc/alertmanager/configmaps/<configmap-name> in the 'alertmanager'
+                  into `/etc/alertmanager/configmaps/<configmap-name>` in the 'alertmanager'
                   container.
                 items:
                   type: string
@@ -1420,7 +1420,7 @@ spec:
               configSecret:
                 description: "ConfigSecret is the name of a Kubernetes Secret in the
                   same namespace as the Alertmanager object, which contains the configuration
-                  for this Alertmanager instance. If empty, it defaults to 'alertmanager-<alertmanager-name>'.
+                  for this Alertmanager instance. If empty, it defaults to `alertmanager-<alertmanager-name>`.
                   \n The Alertmanager configuration should be available under the
                   `alertmanager.yaml` key. Additional keys from the original secret
                   are copied to the generated secret. \n If either the secret or the
@@ -4066,7 +4066,7 @@ spec:
                 description: Secrets is a list of Secrets in the same namespace as
                   the Alertmanager object, which shall be mounted into the Alertmanager
                   Pods. Each Secret is added to the StatefulSet definition as a volume
-                  named `secret-<secret-name>`. The Secrets are mounted into /etc/alertmanager/secrets/<secret-name>
+                  named `secret-<secret-name>`. The Secrets are mounted into `/etc/alertmanager/secrets/<secret-name>`
                   in the 'alertmanager' container.
                 items:
                   type: string
diff --git a/manifests/setup/0podmonitorCustomResourceDefinition.yaml b/manifests/setup/0podmonitorCustomResourceDefinition.yaml
index daca49a2e64ce3f3f048cffc381ec1ec7a917778..5fa52499dd479afd415eccb8e1abf4cecf514ab0 100644
--- a/manifests/setup/0podmonitorCustomResourceDefinition.yaml
+++ b/manifests/setup/0podmonitorCustomResourceDefinition.yaml
@@ -185,6 +185,10 @@ spec:
                     enableHttp2:
                       description: Whether to enable HTTP2.
                       type: boolean
+                    filterRunning:
+                      description: 'Drop pods that are not running. (Failed, Succeeded).
+                        Enabled by default. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase'
+                      type: boolean
                     followRedirects:
                       description: FollowRedirects configures whether scrape requests
                         follow HTTP 3xx redirects.
diff --git a/manifests/setup/0prometheusCustomResourceDefinition.yaml b/manifests/setup/0prometheusCustomResourceDefinition.yaml
index cf7cf1a0ac01e995d642f87945a73143ab0da815..6d2f3505629cc09a39f797b0d23bbdb32826f0d1 100644
--- a/manifests/setup/0prometheusCustomResourceDefinition.yaml
+++ b/manifests/setup/0prometheusCustomResourceDefinition.yaml
@@ -6401,9 +6401,14 @@ spec:
                     description: 'Thanos base image if other than default. Deprecated:
                       use ''image'' instead'
                     type: string
+                  grpcListenLocal:
+                    description: If true, the Thanos sidecar listens on the loopback
+                      interface for the gRPC endpoints. It has no effect if `listenLocal`
+                      is true.
+                    type: boolean
                   grpcServerTlsConfig:
-                    description: 'GRPCServerTLSConfig configures the gRPC server from
-                      which Thanos Querier reads recorded rule data. Note: Currently
+                    description: 'GRPCServerTLSConfig configures the TLS parameters
+                      for the gRPC server providing the StoreAPI. Note: Currently
                       only the CAFile, CertFile, and KeyFile fields are supported.
                       Maps to the ''--grpc-server-tls-*'' CLI args.'
                     properties:
@@ -6536,6 +6541,11 @@ spec:
                         description: Used to verify the hostname for the targets.
                         type: string
                     type: object
+                  httpListenLocal:
+                    description: If true, the Thanos sidecar listens on the loopback
+                      interface for the HTTP endpoints. It has no effect if `listenLocal`
+                      is true.
+                    type: boolean
                   image:
                     description: Image if specified has precedence over baseImage,
                       tag and sha combinations. Specifying the version is still necessary
@@ -6543,8 +6553,10 @@ spec:
                       is being configured.
                     type: string
                   listenLocal:
-                    description: ListenLocal makes the Thanos sidecar listen on loopback,
-                      so that it does not bind against the Pod IP.
+                    description: 'If true, the Thanos sidecar listens on the loopback
+                      interface for the HTTP and gRPC endpoints. It takes precedence
+                      over `grpcListenLocal` and `httpListenLocal`. Deprecated: use
+                      `grpcListenLocal` and `httpListenLocal` instead.'
                     type: boolean
                   logFormat:
                     description: LogFormat for Thanos sidecar to be configured with.