diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c19caf..e6822aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,6 @@ jobs:
       registry-server: ghcr.io
       registry-username: ${{ github.actor }}
       image: ${{ github.repository }}
-      version: 0.15.1
+      version: 0.16.0
     secrets:
       pull-request-token: ${{ secrets.GH_ORG_PAT }}
diff --git a/package/config/upstream/release.yml b/package/config/upstream/release.yml
index c932496..3be55a5 100644
--- a/package/config/upstream/release.yml
+++ b/package/config/upstream/release.yml
@@ -801,11 +801,11 @@ metadata:
         - git:
             dirty: true
             remoteURL: https://github.com/carvel-dev/secretgen-controller
-            sha: a0e1378edd0327e34baedb4c269086718b83faba
+            sha: d806899d96fcb5a07ff2e38f93e37884a3db2b1d
             tags:
-            - v0.15.1
-        url: ghcr.io/carvel-dev/secretgen-controller@sha256:c3f1ff0895b5b6b32be578081df6474b775cbaecb8b060e9144ab4829d796973
-    secretgen-controller.carvel.dev/version: v0.15.1
+            - v0.16.0
+        url: ghcr.io/carvel-dev/secretgen-controller@sha256:59ec05ce5847bfd70c8e04f08b5195e918c8f6fbb947ffc91b456494a2958fd5
+    secretgen-controller.carvel.dev/version: v0.16.0
   name: secretgen-controller
   namespace: secretgen-controller
 spec:
@@ -820,7 +820,7 @@ spec:
         app: secretgen-controller
     spec:
       containers:
-      - image: ghcr.io/carvel-dev/secretgen-controller@sha256:c3f1ff0895b5b6b32be578081df6474b775cbaecb8b060e9144ab4829d796973
+      - image: ghcr.io/carvel-dev/secretgen-controller@sha256:59ec05ce5847bfd70c8e04f08b5195e918c8f6fbb947ffc91b456494a2958fd5
         name: secretgen-controller
         resources:
           requests:
diff --git a/package/vendir.lock.yml b/package/vendir.lock.yml
index 262a670..f02f857 100644
--- a/package/vendir.lock.yml
+++ b/package/vendir.lock.yml
@@ -2,8 +2,8 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - githubRelease:
-      tag: v0.15.1
-      url: https://api.github.com/repos/carvel-dev/secretgen-controller/releases/127311034
+      tag: v0.16.0
+      url: https://api.github.com/repos/carvel-dev/secretgen-controller/releases/133131122
     path: .
   path: config/upstream
 kind: LockConfig
diff --git a/package/vendir.yml b/package/vendir.yml
index 31357ab..72aa745 100755
--- a/package/vendir.yml
+++ b/package/vendir.yml
@@ -4,7 +4,7 @@ directories:
   - githubRelease:
       disableAutoChecksumValidation: true
       slug: carvel-dev/secretgen-controller
-      tag: v0.15.1
+      tag: v0.16.0
     includePaths:
     - release.yml
     path: .