diff --git a/go.mod b/go.mod
index 8a345c7853..970c5a6760 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/tektoncd/hub v1.23.6
 	github.com/tektoncd/pipeline v1.9.8
 	github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1
-	github.com/tektoncd/triggers v0.35.0
+	github.com/tektoncd/triggers v0.35.3
 	github.com/theupdateframework/go-tuf v0.7.0
 	go.opencensus.io v0.24.0
 	go.uber.org/multierr v1.11.0
diff --git a/go.sum b/go.sum
index 6d306b202a..e2da40913e 100644
--- a/go.sum
+++ b/go.sum
@@ -1270,8 +1270,8 @@ github.com/tektoncd/pipeline v1.9.8 h1:WvMf57F+uIuaJN0n3x+Yc6qS42GmMtdfaoO+mFZDA
 github.com/tektoncd/pipeline v1.9.8/go.mod h1:MGy8jy7YAQpbrlzn38cweF4rfgPkM40PIv/aMKD+ql8=
 github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 h1:nv7BsOAZ1ifQX9Lw1hYFo1f7e62dTDyyVPJBuljgZKw=
 github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1/go.mod h1:eDs4O8vTNkyKZ/+AEuo4nYDfpyn1AzbgIcQ1QMQaKJk=
-github.com/tektoncd/triggers v0.35.0 h1:9Z5Cqn7RZTgyspWgWYFHz6AtWUUhd/awJeaisjZdF98=
-github.com/tektoncd/triggers v0.35.0/go.mod h1:te1wPij1VJ/59wqpVKfwxZHRS/FOZSCMSbBTpKtLfz4=
+github.com/tektoncd/triggers v0.35.3 h1:oAmW+IeB8a2R+pko9l5pTdA/eMghMEG9r34JLCxqHkU=
+github.com/tektoncd/triggers v0.35.3/go.mod h1:44cDhjaIEjTzEfzmnemQBTpDOSkkgjRvmvmkMX7gxiI=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
diff --git a/vendor/github.com/tektoncd/triggers/pkg/apis/config/core_interceptors.go b/vendor/github.com/tektoncd/triggers/pkg/apis/config/core_interceptors.go
new file mode 100644
index 0000000000..e512e3fd67
--- /dev/null
+++ b/vendor/github.com/tektoncd/triggers/pkg/apis/config/core_interceptors.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2026 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"os"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+const (
+	enterpriseHostAllowlistKey = "github.enterprise-host-allowlist"
+)
+
+// CoreInterceptorsConfig holds configuration for the core interceptors service.
+// +k8s:deepcopy-gen=true
+type CoreInterceptorsConfig struct {
+	EnterpriseHostAllowlist []string
+}
+
+// GetCoreInterceptorsConfigName returns the name of the configmap containing
+// core interceptor configuration.
+func GetCoreInterceptorsConfigName() string {
+	if e := os.Getenv("CONFIG_CORE_INTERCEPTORS_NAME"); e != "" {
+		return e
+	}
+	return "config-triggers-core-interceptors"
+}
+
+// NewCoreInterceptorsFromMap returns a CoreInterceptors given a map corresponding to a ConfigMap
+func NewCoreInterceptorsFromMap(cfgMap map[string]string) (*CoreInterceptorsConfig, error) {
+	ci := CoreInterceptorsConfig{}
+
+	if v, ok := cfgMap[enterpriseHostAllowlistKey]; ok && v != "" {
+		for p := range strings.SplitSeq(v, ",") {
+			if h := strings.TrimSpace(p); h != "" {
+				ci.EnterpriseHostAllowlist = append(ci.EnterpriseHostAllowlist, normalizeUrl(h))
+			}
+		}
+	}
+
+	return &ci, nil
+}
+
+// NewCoreInterceptorsFromConfigMap returns a CoreInterceptors for the given configmap
+func NewCoreInterceptorsFromConfigMap(config *corev1.ConfigMap) (*CoreInterceptorsConfig, error) {
+	return NewCoreInterceptorsFromMap(config.Data)
+}
+
+// DeepCopy returns a deep copy of CoreInterceptors.
+func (in *CoreInterceptorsConfig) DeepCopy() *CoreInterceptorsConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(CoreInterceptorsConfig)
+	if in.EnterpriseHostAllowlist != nil {
+		out.EnterpriseHostAllowlist = make([]string, len(in.EnterpriseHostAllowlist))
+		copy(out.EnterpriseHostAllowlist, in.EnterpriseHostAllowlist)
+	}
+	return out
+}
+
+func (in *CoreInterceptorsConfig) HostInEnterpriseHostAllowList(host string) bool {
+	host = normalizeUrl(host)
+	for _, h := range in.EnterpriseHostAllowlist {
+		if strings.EqualFold(host, h) {
+			return true
+		}
+	}
+	return false
+}
+
+func normalizeUrl(url string) string {
+	// Strip any scheme and path for normalization.
+	// Using instead of net/url.Parse which doesn't handle missing schemes well.
+	parts := strings.Split(url, "://")
+	if len(parts) > 1 {
+		url = parts[1]
+	}
+	parts = strings.Split(url, "/")
+	if len(parts) > 1 {
+		url = parts[0]
+	}
+	return url
+}
diff --git a/vendor/github.com/tektoncd/triggers/pkg/apis/config/feature_flags.go b/vendor/github.com/tektoncd/triggers/pkg/apis/config/feature_flags.go
index 76920d6469..bac1ad6c7c 100644
--- a/vendor/github.com/tektoncd/triggers/pkg/apis/config/feature_flags.go
+++ b/vendor/github.com/tektoncd/triggers/pkg/apis/config/feature_flags.go
@@ -32,6 +32,9 @@ const (
 	DefaultEnableAPIFields = StableAPIFieldValue
 
 	labelsExclusionPattern = "labels-exclusion-pattern"
+
+	interceptorsGitHubUseEnterpriseHostAllowlistKey     = "interceptors.github.use-enterprise-host-allowlist"
+	defaultInterceptorsGitHubUseEnterpriseHostAllowlist = false
 )
 
 // FeatureFlags holds the features configurations
@@ -43,6 +46,12 @@ type FeatureFlags struct {
 	// LabelsExclusionPattern determines the regex pattern to use to exclude
 	// labels being propagated to resources created by the EventListener
 	LabelsExclusionPattern string
+	// UseEnterpriseHostAllowlist determines if the GitHub core interceptor
+	// validates the X-Github-Enterprise-Host header against the
+	// setting `github.enterprise-host-allowlist`.
+	// It is strongly encouraged to be enabled for security, and will be removed
+	// and always enforced in a later version
+	InterceptorsGitHubUseEnterpriseHostAllowlist bool
 }
 
 // GetFeatureFlagsConfigName returns the name of the configmap containing all
@@ -56,17 +65,23 @@ func GetFeatureFlagsConfigName() string {
 
 // NewFeatureFlagsFromMap returns a Config given a map corresponding to a ConfigMap
 func NewFeatureFlagsFromMap(cfgMap map[string]string) (*FeatureFlags, error) {
-	tc := FeatureFlags{}
+	ff := FeatureFlags{}
 	var err error
-	if tc.EnableAPIFields, err = getEnabledAPI(cfgMap); err != nil {
+	if ff.EnableAPIFields, err = getEnabledAPI(cfgMap); err != nil {
 		return nil, err
 	}
 
-	if tc.LabelsExclusionPattern, err = getLabelsExclusionPattern(cfgMap); err != nil {
+	if ff.LabelsExclusionPattern, err = getLabelsExclusionPattern(cfgMap); err != nil {
 		return nil, err
 	}
 
-	return &tc, nil
+	if v, ok := cfgMap[interceptorsGitHubUseEnterpriseHostAllowlistKey]; ok {
+		ff.InterceptorsGitHubUseEnterpriseHostAllowlist = strings.EqualFold(v, "true")
+	} else {
+		ff.InterceptorsGitHubUseEnterpriseHostAllowlist = defaultInterceptorsGitHubUseEnterpriseHostAllowlist
+	}
+
+	return &ff, nil
 }
 
 // getLabelsExclusionPattern gets the "labels-exclusion-pattern" flag based on the content of a given map.
diff --git a/vendor/github.com/tektoncd/triggers/pkg/apis/config/store.go b/vendor/github.com/tektoncd/triggers/pkg/apis/config/store.go
index 84c836ef6c..98b6703449 100644
--- a/vendor/github.com/tektoncd/triggers/pkg/apis/config/store.go
+++ b/vendor/github.com/tektoncd/triggers/pkg/apis/config/store.go
@@ -27,8 +27,9 @@ type cfgKey struct{}
 // Config holds the collection of configurations that we attach to contexts.
 // +k8s:deepcopy-gen=false
 type Config struct {
-	Defaults     *Defaults
-	FeatureFlags *FeatureFlags
+	Defaults         *Defaults
+	FeatureFlags     *FeatureFlags
+	CoreInterceptors *CoreInterceptorsConfig
 }
 
 // FromContext extracts a Config from the provided context.
@@ -48,9 +49,11 @@ func FromContextOrDefaults(ctx context.Context) *Config {
 	}
 	defaults, _ := NewDefaultsFromMap(map[string]string{})
 	featureFlags, _ := NewFeatureFlagsFromMap(map[string]string{})
+	coreInterceptors, _ := NewCoreInterceptorsFromMap(map[string]string{})
 	return &Config{
-		Defaults:     defaults,
-		FeatureFlags: featureFlags,
+		Defaults:         defaults,
+		FeatureFlags:     featureFlags,
+		CoreInterceptors: coreInterceptors,
 	}
 }
 
@@ -73,8 +76,9 @@ func NewStore(logger configmap.Logger, onAfterStore ...func(name string, value i
 			"defaults/features/artifacts",
 			logger,
 			configmap.Constructors{
-				GetFeatureFlagsConfigName(): NewFeatureFlagsFromConfigMap,
-				GetDefaultsConfigName():     NewDefaultsFromConfigMap,
+				GetFeatureFlagsConfigName():     NewFeatureFlagsFromConfigMap,
+				GetDefaultsConfigName():         NewDefaultsFromConfigMap,
+				GetCoreInterceptorsConfigName(): NewCoreInterceptorsFromConfigMap,
 			},
 			onAfterStore...,
 		),
@@ -98,9 +102,14 @@ func (s *Store) Load() *Config {
 	if featureFlags == nil {
 		featureFlags, _ = NewFeatureFlagsFromMap(map[string]string{})
 	}
+	coreInterceptors := s.UntypedLoad(GetCoreInterceptorsConfigName())
+	if coreInterceptors == nil {
+		coreInterceptors, _ = NewCoreInterceptorsFromMap(map[string]string{})
+	}
 
 	return &Config{
-		Defaults:     defaults.(*Defaults).DeepCopy(),
-		FeatureFlags: featureFlags.(*FeatureFlags).DeepCopy(),
+		Defaults:         defaults.(*Defaults).DeepCopy(),
+		FeatureFlags:     featureFlags.(*FeatureFlags).DeepCopy(),
+		CoreInterceptors: coreInterceptors.(*CoreInterceptorsConfig).DeepCopy(),
 	}
 }
diff --git a/vendor/github.com/tektoncd/triggers/pkg/apis/config/zz_generated.deepcopy.go b/vendor/github.com/tektoncd/triggers/pkg/apis/config/zz_generated.deepcopy.go
index fd5084233e..892c5cde26 100644
--- a/vendor/github.com/tektoncd/triggers/pkg/apis/config/zz_generated.deepcopy.go
+++ b/vendor/github.com/tektoncd/triggers/pkg/apis/config/zz_generated.deepcopy.go
@@ -21,6 +21,13 @@ limitations under the License.
 
 package config
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CoreInterceptorsConfig) DeepCopyInto(out *CoreInterceptorsConfig) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Defaults) DeepCopyInto(out *Defaults) {
 	*out = *in
diff --git a/vendor/github.com/tektoncd/triggers/test/e2e-common.sh b/vendor/github.com/tektoncd/triggers/test/e2e-common.sh
index 8187fd4382..1f88824729 100644
--- a/vendor/github.com/tektoncd/triggers/test/e2e-common.sh
+++ b/vendor/github.com/tektoncd/triggers/test/e2e-common.sh
@@ -54,7 +54,7 @@ function install_triggers_crd() {
   echo ">> Deploying Tekton Triggers"
   rel=$(mktemp)
   release=$(mktemp)
-  ko resolve -f config/ > "${rel}" || fail_test "Tekton Triggers build failed"
+  ko resolve ${KO_FLAGS:-} -f config/ > "${rel}" || fail_test "Tekton Triggers build failed"
 
   if [ "${SKIP_SECURITY_CTX}" == "true" ]; then
       yq 'del(.spec.template.spec.containers[]?.securityContext.runAsUser, .spec.template.spec.containers[]?.securityContext.runAsGroup)' "${rel}" > "${release}"
@@ -66,7 +66,7 @@ function install_triggers_crd() {
 
   # Wait for the Interceptors CRD to be available before adding the core-interceptors
   kubectl wait --for=condition=Established --timeout=30s crds/clusterinterceptors.triggers.tekton.dev
-  ko resolve -f config/interceptors > "${rel}" || fail_test "Core interceptors build failed"
+  ko resolve ${KO_FLAGS:-} -f config/interceptors > "${rel}" || fail_test "Core interceptors build failed"
 
   if [ "${SKIP_SECURITY_CTX}" == "true" ]; then
       kubectl patch configmap config-defaults-triggers -n tekton-pipelines --type='merge' -p='{"data":{"default-run-as-user":"","default-fs-group":"", "default-run-as-group":""}}'
diff --git a/vendor/github.com/tektoncd/triggers/test/e2e-tests-examples.sh b/vendor/github.com/tektoncd/triggers/test/e2e-tests-examples.sh
index 6f8c43c194..d69e2a6817 100644
--- a/vendor/github.com/tektoncd/triggers/test/e2e-tests-examples.sh
+++ b/vendor/github.com/tektoncd/triggers/test/e2e-tests-examples.sh
@@ -49,6 +49,10 @@ install_knative_serving() {
 
   kubectl apply -f https://github.com/knative/net-kourier/releases/download/knative-v1.10.0/kourier.yaml
 
+  # Wait for webhook to be ready before patching configmap
+  kubectl wait --for=condition=Ready --timeout=60s pod -l app=webhook -n knative-serving || echo "Webhook pod not ready yet, waiting..."
+  sleep 5
+
   kubectl patch configmap/config-network \
     --namespace knative-serving \
     --type merge \
@@ -69,11 +73,25 @@ apply_files() {
     err "failed to find files"
     exit 1
   }
+
+  # Apply rbac.yaml first if it exists to ensure service accounts are created before they're referenced
   for y in ${yaml_files}; do
-    kubectl apply  -f ${y} || {
-      err "failed to apply ${y}"
-      exit 1
-    }
+    if [[ $(basename ${y}) == "rbac.yaml" ]]; then
+      kubectl apply -f ${y} || {
+        err "failed to apply ${y}"
+        exit 1
+      }
+    fi
+  done
+
+  # Apply remaining files
+  for y in ${yaml_files}; do
+    if [[ $(basename ${y}) != "rbac.yaml" ]]; then
+      kubectl apply -f ${y} || {
+        err "failed to apply ${y}"
+        exit 1
+      }
+    fi
   done
 }
 
@@ -159,10 +177,13 @@ curl_knative_service() {
   hostURL=$(kubectl get el ${elName} -o=jsonpath='{.status.address.url}')
   host=$(echo $(echo $hostURL | tr "://" "\n") | cut -d' ' -f 2)
 
+  # Wait a bit for Knative routing to be ready
+  sleep 5
+
   bash ${REPO_ROOT_DIR}/examples/${current_example_version}/${current_example}/curl.sh $forwardingPort $host
 
-  # kill the process which ran eith port-forwarding
-  ps -ef | grep $forwardingPort | grep -v grep | awk '{print $2}' | xargs kill
+  # kill the process which ran with port-forwarding
+  ps -ef | grep $forwardingPort | grep -v grep | awk '{print $2}' | xargs kill || true
 }
 
 kill_process() {
@@ -186,7 +207,8 @@ main() {
   versions="v1alpha1 v1beta1"
   # List of examples test will run on
   examples_v1alpha1="bitbucket-server cron embedded-trigger github gitlab label-selector namespace-selector trigger-ref"
-  examples_v1beta1="${examples_v1alpha1} slack bitbucket-cloud triggergroups github-add-changed-files-pr github-add-changed-files-push-cel github-owners create-configmap"
+  # Note: github-add-changed-files-* and github-owners require GitHub API access and are skipped in CI
+  examples_v1beta1="${examples_v1alpha1} slack bitbucket-cloud triggergroups create-configmap"
 
 
   create_example_pipeline
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 1dbf8f8cb0..2de6da20c2 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1649,8 +1649,8 @@ github.com/tektoncd/pipeline/test/parse
 # github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1
 ## explicit; go 1.23
 github.com/tektoncd/plumbing/scripts
-# github.com/tektoncd/triggers v0.35.0
-## explicit; go 1.24.0
+# github.com/tektoncd/triggers v0.35.3
+## explicit; go 1.25.11
 github.com/tektoncd/triggers/pkg/apis/config
 github.com/tektoncd/triggers/pkg/apis/triggers
 github.com/tektoncd/triggers/pkg/apis/triggers/contexts