diff --git a/go.mod b/go.mod
index 6b5a9f901..42d852c9f 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,7 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/vito/go-interact v1.0.1
 	github.com/vmware-labs/reconciler-runtime v0.11.1
-	github.com/vmware-tanzu/carvel-imgpkg v0.36.2
+	github.com/vmware-tanzu/carvel-imgpkg v0.38.0
 	github.com/vmware-tanzu/difflib v0.0.0-20201117154628-0c031775bf57
 	github.com/vmware-tanzu/tanzu-plugin-runtime v0.90.0
 	golang.org/x/crypto v0.14.0
@@ -140,10 +140,10 @@ require (
 	go.starlark.net v0.0.0-20230112144946-fae38c8a6d89 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	golang.org/x/mod v0.10.0 // indirect
+	golang.org/x/mod v0.12.0 // indirect
 	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/oauth2 v0.8.0 // indirect
-	golang.org/x/sync v0.2.0 // indirect
+	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/sys v0.13.0 // indirect
 	golang.org/x/term v0.13.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
diff --git a/go.sum b/go.sum
index 449b98250..cac172a10 100644
--- a/go.sum
+++ b/go.sum
@@ -668,8 +668,8 @@ github.com/vito/go-interact v1.0.1 h1:O8xi8c93bRUv2Tb/v6HdiuGc+WnWt+AQzF74MOOdlB
 github.com/vito/go-interact v1.0.1/go.mod h1:HrdHSJXD2yn1MhlTwSIMeFgQ5WftiIorszVGd3S/DAA=
 github.com/vmware-labs/reconciler-runtime v0.11.1 h1:eU2bDUq4XWFmjICaKgnNieT8NhCicMqc5ST53R2QYug=
 github.com/vmware-labs/reconciler-runtime v0.11.1/go.mod h1:IrjEBBrCnBhvvQA4RT9l1J4vYbH5+QKF3O93XU/lj3c=
-github.com/vmware-tanzu/carvel-imgpkg v0.36.2 h1:RxHd4A4o+Q2qn67ZhiQSMR42cslN/XnAaGXG+MeF+4M=
-github.com/vmware-tanzu/carvel-imgpkg v0.36.2/go.mod h1:eBOaUEF4tVajROCfcNFnB3zThG6xONhKuahbLFiqGU4=
+github.com/vmware-tanzu/carvel-imgpkg v0.38.0 h1:OEFibSOVs+8OJ65tB+N9hPTt4awPNpXVlpLFc7W/pf0=
+github.com/vmware-tanzu/carvel-imgpkg v0.38.0/go.mod h1:9ylhupBVCJ4JpYZtZKUzYfeot0EB9oWL90iKZ7eetYA=
 github.com/vmware-tanzu/difflib v0.0.0-20201117154628-0c031775bf57 h1:NmeWaPuGdwr2+NdXEFqDfcBYiA8Qi/z+twfED7mqCyY=
 github.com/vmware-tanzu/difflib v0.0.0-20201117154628-0c031775bf57/go.mod h1:q4R37lXdaJmkpws5TUoMwT2GXOMs8qJJ9P+zxrtHv28=
 github.com/vmware-tanzu/tanzu-plugin-runtime v0.90.0 h1:MbnTxvqCBOLR8gHpnzwxlcbP16vF71LyV8Tx2ANC57o=
@@ -780,8 +780,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -860,8 +860,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1019,7 +1019,7 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff/go.mod h1:YD9qOF0M9xpSpdWTBbzEl5e/RnCefISl8E5Noe10jFM=
-golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/dir_image.go b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/dir_image.go
index 955b94606..514350663 100644
--- a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/dir_image.go
+++ b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/dir_image.go
@@ -135,6 +135,14 @@ func (i *DirImage) extractTarEntry(header *tar.Header, input io.Reader) error {
 	userPermission := int64(mode & 0700)
 	permMode := os.FileMode(userPermission | userPermission>>3 | userPermission>>6)
 
+	// By default, imgpkg will remove the permissions for group/all on all files.
+	// Here we are checking if these permissions are still present. If this is the case it means that the creator
+	// of the OCI image intended to keep the original permissions of the file. In this case we will honor the
+	// request by keeping the original permissions on the files
+	if mode&0077 > 0 {
+		permMode = mode
+	}
+
 	err := os.MkdirAll(filepath.Dir(path), 0777)
 	if err != nil {
 		return err
diff --git a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/tar_image.go b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/tar_image.go
index 8e1857cf8..400fa3098 100644
--- a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/tar_image.go
+++ b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image/tar_image.go
@@ -7,7 +7,6 @@ import (
 	"archive/tar"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -16,19 +15,20 @@ import (
 )
 
 type TarImage struct {
-	files        []string
-	excludePaths []string
-	logger       Logger
+	files           []string
+	excludePaths    []string
+	logger          Logger
+	keepPermissions bool
 }
 
 // NewTarImage creates a struct that will allow users to create a representation of a set of paths as an OCI Image
-func NewTarImage(files []string, excludePaths []string, logger Logger) *TarImage {
-	return &TarImage{files, excludePaths, logger}
+func NewTarImage(files []string, excludePaths []string, logger Logger, keepPermissions bool) *TarImage {
+	return &TarImage{files, excludePaths, logger, keepPermissions}
 }
 
 // AsFileImage Creates an OCI Image representation of the provided folders
 func (i *TarImage) AsFileImage(labels map[string]string) (*FileImage, error) {
-	tmpFile, err := ioutil.TempFile("", "imgpkg-tar-image")
+	tmpFile, err := os.CreateTemp("", "imgpkg-tar-image")
 	if err != nil {
 		return nil, err
 	}
@@ -80,7 +80,7 @@ func (i *TarImage) createTarball(file *os.File, filePaths []string) error {
 					if i.isExcluded(relPath) {
 						return filepath.SkipDir
 					}
-					return i.addDirToTar(relPath, tarWriter)
+					return i.addDirToTar(path, relPath, tarWriter)
 				}
 				if (info.Mode() & os.ModeType) != 0 {
 					return fmt.Errorf("Expected file '%s' to be a regular file", walkedPath)
@@ -101,7 +101,7 @@ func (i *TarImage) createTarball(file *os.File, filePaths []string) error {
 	return nil
 }
 
-func (i *TarImage) addDirToTar(relPath string, tarWriter *tar.Writer) error {
+func (i *TarImage) addDirToTar(fullPath string, relPath string, tarWriter *tar.Writer) error {
 	if i.isExcluded(relPath) {
 		panic("Unreachable") // directories excluded above
 	}
@@ -113,10 +113,19 @@ func (i *TarImage) addDirToTar(relPath string, tarWriter *tar.Writer) error {
 		relPath = strings.ReplaceAll(relPath, "\\", "/")
 	}
 
+	folderPermission := int64(0700)
+	if i.keepPermissions {
+		fInfo, err := os.Stat(fullPath)
+		if err != nil {
+			return fmt.Errorf("Unable to stat the folder '%s': %s", fullPath, err)
+		}
+		folderPermission = int64(fInfo.Mode())
+	}
+
 	header := &tar.Header{
 		Name:     relPath,
-		Mode:     0700,        // static
-		ModTime:  time.Time{}, // static
+		Mode:     folderPermission, // static
+		ModTime:  time.Time{},      // static
 		Typeflag: tar.TypeDir,
 	}
 
@@ -141,12 +150,16 @@ func (i *TarImage) addFileToTar(fullPath, relPath string, info os.FileInfo, tarW
 	if runtime.GOOS == "windows" {
 		relPath = strings.ReplaceAll(relPath, "\\", "/")
 	}
+	filePermission := int64(info.Mode() & 0700)
+	if i.keepPermissions {
+		filePermission = int64(info.Mode())
+	}
 
 	header := &tar.Header{
 		Name:     relPath,
 		Size:     info.Size(),
-		Mode:     int64(info.Mode() & 0700), // static
-		ModTime:  time.Time{},               // static
+		Mode:     filePermission, // static
+		ModTime:  time.Time{},    // static
 		Typeflag: tar.TypeReg,
 	}
 
diff --git a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/plainimage/contents.go b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/plainimage/contents.go
index 78b9236fb..fa767f22c 100644
--- a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/plainimage/contents.go
+++ b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/plainimage/contents.go
@@ -18,8 +18,9 @@ import (
 
 // Contents of the OCI Image
 type Contents struct {
-	paths         []string
-	excludedPaths []string
+	paths               []string
+	excludedPaths       []string
+	preservePermissions bool
 }
 
 // ImagesWriter defines the needed functions to write to the registry
@@ -29,8 +30,8 @@ type ImagesWriter interface {
 }
 
 // NewContents creates the struct that represent an OCI Image based on the provided paths
-func NewContents(paths []string, excludedPaths []string) Contents {
-	return Contents{paths: paths, excludedPaths: excludedPaths}
+func NewContents(paths []string, excludedPaths []string, preservePermissions bool) Contents {
+	return Contents{paths: paths, excludedPaths: excludedPaths, preservePermissions: preservePermissions}
 }
 
 // Push the OCI Image to the registry
@@ -40,7 +41,7 @@ func (i Contents) Push(uploadRef regname.Tag, labels map[string]string, writer I
 		return "", err
 	}
 
-	tarImg := ctlimg.NewTarImage(i.paths, i.excludedPaths, logger)
+	tarImg := ctlimg.NewTarImage(i.paths, i.excludedPaths, logger, i.preservePermissions)
 
 	img, err := tarImg.AsFileImage(labels)
 	if err != nil {
diff --git a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/registry/registry.go b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/registry/registry.go
index ee7360448..f7536b6b3 100644
--- a/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/registry/registry.go
+++ b/vendor/github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/registry/registry.go
@@ -7,8 +7,8 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
 	"net/http"
+	"os"
 	"regexp"
 	"sync"
 	"time"
@@ -536,7 +536,7 @@ func newHTTPTransport(opts Opts) (*http.Transport, error) {
 
 	if len(opts.CACertPaths) > 0 {
 		for _, path := range opts.CACertPaths {
-			if certs, err := ioutil.ReadFile(path); err != nil {
+			if certs, err := os.ReadFile(path); err != nil {
 				return nil, fmt.Errorf("Reading CA certificates from '%s': %s", path, err)
 			} else if ok := pool.AppendCertsFromPEM(certs); !ok {
 				return nil, fmt.Errorf("Adding CA certificates from '%s': failed", path)
diff --git a/vendor/golang.org/x/mod/semver/semver.go b/vendor/golang.org/x/mod/semver/semver.go
index a30a22bf2..9a2dfd33a 100644
--- a/vendor/golang.org/x/mod/semver/semver.go
+++ b/vendor/golang.org/x/mod/semver/semver.go
@@ -140,7 +140,7 @@ func Compare(v, w string) int {
 // Max canonicalizes its arguments and then returns the version string
 // that compares greater.
 //
-// Deprecated: use Compare instead. In most cases, returning a canonicalized
+// Deprecated: use [Compare] instead. In most cases, returning a canonicalized
 // version is not expected or desired.
 func Max(v, w string) string {
 	v = Canonical(v)
@@ -151,7 +151,7 @@ func Max(v, w string) string {
 	return w
 }
 
-// ByVersion implements sort.Interface for sorting semantic version strings.
+// ByVersion implements [sort.Interface] for sorting semantic version strings.
 type ByVersion []string
 
 func (vs ByVersion) Len() int      { return len(vs) }
@@ -164,7 +164,7 @@ func (vs ByVersion) Less(i, j int) bool {
 	return vs[i] < vs[j]
 }
 
-// Sort sorts a list of semantic version strings using ByVersion.
+// Sort sorts a list of semantic version strings using [ByVersion].
 func Sort(list []string) {
 	sort.Sort(ByVersion(list))
 }
diff --git a/vendor/golang.org/x/sync/errgroup/errgroup.go b/vendor/golang.org/x/sync/errgroup/errgroup.go
index cbee7a4e2..b18efb743 100644
--- a/vendor/golang.org/x/sync/errgroup/errgroup.go
+++ b/vendor/golang.org/x/sync/errgroup/errgroup.go
@@ -20,7 +20,7 @@ type token struct{}
 // A zero Group is valid, has no limit on the number of active goroutines,
 // and does not cancel on error.
 type Group struct {
-	cancel func()
+	cancel func(error)
 
 	wg sync.WaitGroup
 
@@ -43,7 +43,7 @@ func (g *Group) done() {
 // returns a non-nil error or the first time Wait returns, whichever occurs
 // first.
 func WithContext(ctx context.Context) (*Group, context.Context) {
-	ctx, cancel := context.WithCancel(ctx)
+	ctx, cancel := withCancelCause(ctx)
 	return &Group{cancel: cancel}, ctx
 }
 
@@ -52,7 +52,7 @@ func WithContext(ctx context.Context) (*Group, context.Context) {
 func (g *Group) Wait() error {
 	g.wg.Wait()
 	if g.cancel != nil {
-		g.cancel()
+		g.cancel(g.err)
 	}
 	return g.err
 }
@@ -76,7 +76,7 @@ func (g *Group) Go(f func() error) {
 			g.errOnce.Do(func() {
 				g.err = err
 				if g.cancel != nil {
-					g.cancel()
+					g.cancel(g.err)
 				}
 			})
 		}
@@ -105,7 +105,7 @@ func (g *Group) TryGo(f func() error) bool {
 			g.errOnce.Do(func() {
 				g.err = err
 				if g.cancel != nil {
-					g.cancel()
+					g.cancel(g.err)
 				}
 			})
 		}
diff --git a/vendor/golang.org/x/sync/errgroup/go120.go b/vendor/golang.org/x/sync/errgroup/go120.go
new file mode 100644
index 000000000..7d419d376
--- /dev/null
+++ b/vendor/golang.org/x/sync/errgroup/go120.go
@@ -0,0 +1,14 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.20
+// +build go1.20
+
+package errgroup
+
+import "context"
+
+func withCancelCause(parent context.Context) (context.Context, func(error)) {
+	return context.WithCancelCause(parent)
+}
diff --git a/vendor/golang.org/x/sync/errgroup/pre_go120.go b/vendor/golang.org/x/sync/errgroup/pre_go120.go
new file mode 100644
index 000000000..1795c18ac
--- /dev/null
+++ b/vendor/golang.org/x/sync/errgroup/pre_go120.go
@@ -0,0 +1,15 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.20
+// +build !go1.20
+
+package errgroup
+
+import "context"
+
+func withCancelCause(parent context.Context) (context.Context, func(error)) {
+	ctx, cancel := context.WithCancel(parent)
+	return ctx, func(error) { cancel() }
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 3d6feeb66..1870978ec 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -500,8 +500,8 @@ github.com/vmware-labs/reconciler-runtime/reconcilers
 github.com/vmware-labs/reconciler-runtime/testing
 github.com/vmware-labs/reconciler-runtime/tracker
 github.com/vmware-labs/reconciler-runtime/validation
-# github.com/vmware-tanzu/carvel-imgpkg v0.36.2
-## explicit; go 1.20
+# github.com/vmware-tanzu/carvel-imgpkg v0.38.0
+## explicit; go 1.21
 github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/image
 github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/imagedigest
 github.com/vmware-tanzu/carvel-imgpkg/pkg/imgpkg/internal/util
@@ -542,7 +542,7 @@ go.uber.org/multierr
 golang.org/x/crypto/pkcs12
 golang.org/x/crypto/pkcs12/internal/rc2
 golang.org/x/crypto/ssh/terminal
-# golang.org/x/mod v0.10.0
+# golang.org/x/mod v0.12.0
 ## explicit; go 1.17
 golang.org/x/mod/semver
 # golang.org/x/net v0.17.0
@@ -561,8 +561,8 @@ golang.org/x/oauth2/google/internal/externalaccount
 golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
-# golang.org/x/sync v0.2.0
-## explicit
+# golang.org/x/sync v0.3.0
+## explicit; go 1.17
 golang.org/x/sync/errgroup
 # golang.org/x/sys v0.13.0
 ## explicit; go 1.17