diff --git a/.github/workflows/_test.yaml b/.github/workflows/_test.yaml
index c89705abdb04..645e6fb6753e 100644
--- a/.github/workflows/_test.yaml
+++ b/.github/workflows/_test.yaml
@@ -12,8 +12,8 @@ permissions:
 env:
   CI_TOOLS_DIR: "/home/runner/work/kuma/kuma/.ci_tools"
   # This is automatically managed by CI
-  K8S_MIN_VERSION: v1.23.17-k3s1
-  K8S_MAX_VERSION: v1.30.0-k3s1
+  K8S_MIN_VERSION: v1.25.16-k3s4
+  K8S_MAX_VERSION: v1.31.1-k3s1
 jobs:
   test_unit:
     timeout-minutes: 20
diff --git a/.github/workflows/merge-release-to-master.yaml b/.github/workflows/merge-release-to-master.yaml
index bded465c9d35..003d51fe777f 100644
--- a/.github/workflows/merge-release-to-master.yaml
+++ b/.github/workflows/merge-release-to-master.yaml
@@ -29,7 +29,9 @@ jobs:
         run: |
           echo "branch=$(make dev/print-latest-release-branch)" >> $GITHUB_OUTPUT
       - run: |
-          make dev/merge-release
+          if [[ "refs/heads/${{ steps.latest-branch.outputs.branch }}" == "${{ github.ref }}" ]]; then
+            make dev/merge-release
+          fi
       - id: commit-changes
         run: |
           git status
diff --git a/mk/dependencies/deps.lock b/mk/dependencies/deps.lock
index 41dec2053e30..d942da1f0550 100644
--- a/mk/dependencies/deps.lock
+++ b/mk/dependencies/deps.lock
@@ -1 +1 @@
-85edd35bf66665ac4e9f4fd54fdd06d202a510c3
+7ad8c624b09ea67fdb958f723c6dacf2be3d6bab
diff --git a/mk/dependencies/k3d.sh b/mk/dependencies/k3d.sh
index a214080da6e5..af5085ce62a2 100755
--- a/mk/dependencies/k3d.sh
+++ b/mk/dependencies/k3d.sh
@@ -3,7 +3,7 @@
 set -e
 
 OUTPUT_DIR=$1/bin
-VERSION="5.6.0"
+VERSION="5.7.4"
 # see https://raw.githubusercontent.com/rancher/k3d/main/install.sh
 curl --fail --location -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | \
           PATH=${OUTPUT_DIR}:${PATH} TAG=v${VERSION} USE_SUDO="false" K3D_INSTALL_DIR="${OUTPUT_DIR}" bash
diff --git a/mk/dev.mk b/mk/dev.mk
index 6c078b4427d5..c23aa0476ff2 100644
--- a/mk/dev.mk
+++ b/mk/dev.mk
@@ -21,8 +21,8 @@ CI_TOOLS_BIN_DIR=$(CI_TOOLS_DIR)/bin
 # Change here and `make check` ensures these are used for CI
 # Note: These are _docker image tags_
 # If changing min version, update mk/kind.mk as well
-K8S_MIN_VERSION = v1.23.17-k3s1
-K8S_MAX_VERSION = v1.30.0-k3s1
+K8S_MIN_VERSION = v1.25.16-k3s4
+K8S_MAX_VERSION = v1.31.1-k3s1
 export GO_VERSION=$(shell go mod edit -json | jq -r .Go)
 export GOLANGCI_LINT_VERSION=v1.60.3
 GOOS := $(shell go env GOOS)
diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_graph.go b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_graph.go
index 13505f1ccc2f..35d62dca87fe 100644
--- a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_graph.go
+++ b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_graph.go
@@ -38,7 +38,7 @@ func (r *Graph) CanReach(fromTags map[string]string, toTags map[string]string) b
 }
 
 func (r *Graph) CanReachBackend(fromTags map[string]string, backendIdentifier core_model.TypedResourceIdentifier) bool {
-	if backendIdentifier.ResourceType == core_model.ResourceType(common_api.MeshExternalService) {
+	if backendIdentifier.ResourceType == core_model.ResourceType(common_api.MeshExternalService) || backendIdentifier.ResourceType == core_model.ResourceType(common_api.MeshMultiZoneService) {
 		return true
 	}
 	noPort := core_model.TypedResourceIdentifier{