diff --git a/go.mod b/go.mod
index c2064c19..5a727348 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.21
 
 require (
 	carvel.dev/imgpkg v0.41.1
-	carvel.dev/vendir v0.39.0
+	carvel.dev/vendir v0.40.0
 	github.com/cppforlife/cobrautil v0.0.0-20221021151949-d60711905d65
 	github.com/cppforlife/go-cli-ui v0.0.0-20220428182907-73db60c7611a
 	github.com/google/go-containerregistry v0.19.0
diff --git a/go.sum b/go.sum
index 6d381455..80ac9f9a 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
 carvel.dev/imgpkg v0.41.1 h1:Zdyy745dc4pGqZ/wDnlICRoxwZqZcB6c98jUcn+82Go=
 carvel.dev/imgpkg v0.41.1/go.mod h1:IbTI5FYOw8tV2rwmQJr1T20Fpzgte+nkzg5uJ02ys8M=
-carvel.dev/vendir v0.39.0 h1:4oBV3oPxBGCit84SPsM0OW2j24DumXCi0JaYAegePuY=
-carvel.dev/vendir v0.39.0/go.mod h1:XPdluJu7322RZNx05AA4gYnV52aKywBdh7Ma12GuM2Q=
+carvel.dev/vendir v0.40.0 h1:JdhCp/EjAPGI8F5zoAVYwZHf1sPEFee19RpgGb3ciT8=
+carvel.dev/vendir v0.40.0/go.mod h1:XPdluJu7322RZNx05AA4gYnV52aKywBdh7Ma12GuM2Q=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/carvel-dev/semver/v4 v4.0.1-0.20230221220520-8090ce423695 h1:naCDnpJeqQq5OHOYR6j01yIVVUk3WI5MuSHpDTy+M1A=
 github.com/carvel-dev/semver/v4 v4.0.1-0.20230221220520-8090ce423695/go.mod h1:4cFTBLAr/U11ykiEEQMccu4uJ1i0GS+atJmeETHCFtI=
diff --git a/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.pb.go b/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.pb.go
index 53865db4..56ab6b7d 100644
--- a/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.pb.go
+++ b/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.pb.go
@@ -24,12 +24,12 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 func (m *VersionSelection) Reset()      { *m = VersionSelection{} }
 func (*VersionSelection) ProtoMessage() {}
 func (*VersionSelection) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8d3ef80c738fc456, []int{0}
+	return fileDescriptor_f7fa722d77d11bd9, []int{0}
 }
 func (m *VersionSelection) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -57,7 +57,7 @@ var xxx_messageInfo_VersionSelection proto.InternalMessageInfo
 func (m *VersionSelectionSemver) Reset()      { *m = VersionSelectionSemver{} }
 func (*VersionSelectionSemver) ProtoMessage() {}
 func (*VersionSelectionSemver) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8d3ef80c738fc456, []int{1}
+	return fileDescriptor_f7fa722d77d11bd9, []int{1}
 }
 func (m *VersionSelectionSemver) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -85,7 +85,7 @@ var xxx_messageInfo_VersionSelectionSemver proto.InternalMessageInfo
 func (m *VersionSelectionSemverPrereleases) Reset()      { *m = VersionSelectionSemverPrereleases{} }
 func (*VersionSelectionSemverPrereleases) ProtoMessage() {}
 func (*VersionSelectionSemverPrereleases) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8d3ef80c738fc456, []int{2}
+	return fileDescriptor_f7fa722d77d11bd9, []int{2}
 }
 func (m *VersionSelectionSemverPrereleases) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -111,40 +111,38 @@ func (m *VersionSelectionSemverPrereleases) XXX_DiscardUnknown() {
 var xxx_messageInfo_VersionSelectionSemverPrereleases proto.InternalMessageInfo
 
 func init() {
-	proto.RegisterType((*VersionSelection)(nil), "github.com.vmware_tanzu.carvel_vendir.pkg.vendir.versions.v1alpha1.VersionSelection")
-	proto.RegisterType((*VersionSelectionSemver)(nil), "github.com.vmware_tanzu.carvel_vendir.pkg.vendir.versions.v1alpha1.VersionSelectionSemver")
-	proto.RegisterType((*VersionSelectionSemverPrereleases)(nil), "github.com.vmware_tanzu.carvel_vendir.pkg.vendir.versions.v1alpha1.VersionSelectionSemverPrereleases")
+	proto.RegisterType((*VersionSelection)(nil), "carvel.dev.vendir.pkg.vendir.versions.v1alpha1.VersionSelection")
+	proto.RegisterType((*VersionSelectionSemver)(nil), "carvel.dev.vendir.pkg.vendir.versions.v1alpha1.VersionSelectionSemver")
+	proto.RegisterType((*VersionSelectionSemverPrereleases)(nil), "carvel.dev.vendir.pkg.vendir.versions.v1alpha1.VersionSelectionSemverPrereleases")
 }
 
 func init() {
-	proto.RegisterFile("carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto", fileDescriptor_8d3ef80c738fc456)
-}
-
-var fileDescriptor_8d3ef80c738fc456 = []byte{
-	// 354 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x8f, 0x31, 0x4b, 0xf3, 0x40,
-	0x1c, 0xc6, 0x73, 0xef, 0x0b, 0xc5, 0x5e, 0x06, 0x25, 0x82, 0x14, 0x87, 0xab, 0x76, 0xea, 0xd2,
-	0x0b, 0x15, 0xfc, 0x02, 0x71, 0x72, 0x93, 0x14, 0x3a, 0x74, 0x29, 0xd7, 0xf4, 0xdf, 0xf4, 0x68,
-	0x7a, 0x17, 0x2e, 0xd7, 0x08, 0x0e, 0xe2, 0x47, 0x10, 0x27, 0x3f, 0x52, 0xc7, 0x8e, 0x9d, 0x8a,
-	0x8d, 0x9b, 0x9f, 0x42, 0x7a, 0xd7, 0x92, 0x20, 0x82, 0x83, 0xb8, 0x3d, 0xf7, 0xbf, 0x87, 0xdf,
-	0xf3, 0x3c, 0x38, 0x8c, 0xb9, 0x9e, 0x2e, 0x46, 0x34, 0x92, 0x73, 0x3f, 0x9f, 0xdf, 0x33, 0x05,
-	0x1d, 0xcd, 0xc4, 0xc3, 0xc2, 0x8f, 0x98, 0xca, 0x21, 0xe9, 0xe4, 0x20, 0xc6, 0x5c, 0xf9, 0xe9,
-	0x2c, 0xf6, 0xf7, 0x32, 0x07, 0x95, 0x71, 0x29, 0x32, 0x3f, 0xef, 0xb2, 0x24, 0x9d, 0xb2, 0xae,
-	0x1f, 0x83, 0x00, 0xc5, 0x34, 0x8c, 0x69, 0xaa, 0xa4, 0x96, 0x5e, 0x50, 0x32, 0xa9, 0x65, 0x0e,
-	0x0d, 0x93, 0x5a, 0xe6, 0xd0, 0x82, 0x68, 0x3a, 0x8b, 0xe9, 0x5e, 0x1e, 0x98, 0xf4, 0xc0, 0x3c,
-	0xef, 0x54, 0x7a, 0xc5, 0x32, 0x96, 0xbe, 0x41, 0x8f, 0x16, 0x13, 0xf3, 0x32, 0x0f, 0xa3, 0x6c,
-	0x64, 0xeb, 0x05, 0xe1, 0x93, 0xbe, 0x85, 0xf4, 0x20, 0x81, 0x48, 0x73, 0x29, 0xbc, 0x47, 0x5c,
-	0xcb, 0x60, 0x9e, 0x83, 0x6a, 0xa0, 0x0b, 0xd4, 0x76, 0xaf, 0x06, 0xf4, 0xf7, 0xc5, 0xe8, 0xd7,
-	0x94, 0x9e, 0x49, 0x08, 0x70, 0xb1, 0x69, 0xd6, 0xac, 0x0e, 0xf7, 0xa9, 0xad, 0x0f, 0x84, 0xcf,
-	0xbe, 0xb7, 0x7b, 0xd7, 0xd8, 0x8d, 0xa4, 0xc8, 0xb4, 0x62, 0x5c, 0xe8, 0xcc, 0xf4, 0xab, 0x07,
-	0xa7, 0xcb, 0x4d, 0xd3, 0x29, 0x36, 0x4d, 0xf7, 0xa6, 0xfc, 0x0a, 0xab, 0x3e, 0xef, 0x15, 0x61,
-	0x37, 0x55, 0xa0, 0x20, 0x01, 0x96, 0x41, 0xd6, 0xf8, 0x67, 0x76, 0xc1, 0xdf, 0xed, 0xba, 0x2b,
-	0xc3, 0x82, 0xe3, 0x5d, 0xb5, 0xca, 0x21, 0xac, 0x56, 0x69, 0xf5, 0xf1, 0xe5, 0x8f, 0x08, 0xaf,
-	0x8b, 0x5d, 0x3e, 0x06, 0xa1, 0xf9, 0x84, 0x83, 0xda, 0xcd, 0xfe, 0xdf, 0xae, 0x5b, 0xee, 0x6d,
-	0x79, 0x0e, 0xab, 0x9e, 0x80, 0x2e, 0xb7, 0xc4, 0x59, 0x6d, 0x89, 0xb3, 0xde, 0x12, 0xe7, 0xa9,
-	0x20, 0x68, 0x59, 0x10, 0xb4, 0x2a, 0x08, 0x5a, 0x17, 0x04, 0xbd, 0x15, 0x04, 0x3d, 0xbf, 0x13,
-	0x67, 0x70, 0x74, 0xd8, 0xf1, 0x19, 0x00, 0x00, 0xff, 0xff, 0x97, 0x30, 0x55, 0x40, 0xd1, 0x02,
-	0x00, 0x00,
+	proto.RegisterFile("carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto", fileDescriptor_f7fa722d77d11bd9)
+}
+
+var fileDescriptor_f7fa722d77d11bd9 = []byte{
+	// 333 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x8f, 0x31, 0x4b, 0xfb, 0x40,
+	0x18, 0xc6, 0x73, 0xff, 0x3f, 0x14, 0x7b, 0x19, 0x94, 0x08, 0x52, 0x1c, 0xae, 0xda, 0xa9, 0x8b,
+	0x17, 0x2a, 0xb8, 0x3a, 0x44, 0x10, 0xdc, 0x34, 0x85, 0x0e, 0x6e, 0x69, 0xf2, 0x36, 0x3d, 0x9b,
+	0xde, 0x85, 0xbb, 0x6b, 0x46, 0x71, 0xf0, 0x03, 0xf8, 0xb1, 0x3a, 0x76, 0x92, 0x4e, 0xc5, 0x9e,
+	0x5f, 0x44, 0x7a, 0x31, 0x24, 0x88, 0x20, 0x82, 0xdb, 0x73, 0xef, 0xbd, 0xcf, 0xef, 0x7d, 0x1e,
+	0x7c, 0x19, 0x47, 0xb2, 0x80, 0x8c, 0x26, 0x50, 0xf8, 0x05, 0xf0, 0x84, 0x49, 0x3f, 0x9f, 0xa5,
+	0x95, 0x2c, 0x40, 0x2a, 0x26, 0xb8, 0xf2, 0x8b, 0x41, 0x94, 0xe5, 0xd3, 0x68, 0xe0, 0xa7, 0xc0,
+	0x41, 0x46, 0x1a, 0x12, 0x9a, 0x4b, 0xa1, 0x85, 0x47, 0x6b, 0x3f, 0x2d, 0x4d, 0x34, 0x9f, 0xa5,
+	0x95, 0xac, 0xfc, 0xb4, 0xf2, 0x1f, 0x9f, 0xa5, 0x4c, 0x4f, 0x17, 0x63, 0x1a, 0x8b, 0xb9, 0x9f,
+	0x8a, 0x54, 0xf8, 0x16, 0x33, 0x5e, 0x4c, 0xec, 0xcb, 0x3e, 0xac, 0x2a, 0xf1, 0xbd, 0x47, 0x7c,
+	0x30, 0x2a, 0x19, 0x43, 0xc8, 0x20, 0xd6, 0x4c, 0x70, 0xef, 0x01, 0xb7, 0x14, 0xcc, 0x0b, 0x90,
+	0x1d, 0x74, 0x82, 0xfa, 0xee, 0xf9, 0xf5, 0x2f, 0x33, 0xd0, 0xaf, 0xc4, 0xa1, 0xa5, 0x05, 0xd8,
+	0x6c, 0xba, 0xad, 0x52, 0x87, 0x9f, 0x17, 0x7a, 0xaf, 0x08, 0x1f, 0x7d, 0xbf, 0xee, 0x5d, 0x60,
+	0x37, 0x16, 0x5c, 0x69, 0x19, 0x31, 0xae, 0x95, 0xcd, 0xd2, 0x0e, 0x0e, 0x97, 0x9b, 0xae, 0x63,
+	0x36, 0x5d, 0xf7, 0xaa, 0xfe, 0x0a, 0x9b, 0x7b, 0xde, 0x33, 0xc2, 0x6e, 0x2e, 0x41, 0x42, 0x06,
+	0x91, 0x02, 0xd5, 0xf9, 0x67, 0x3b, 0xdc, 0xfd, 0x4d, 0x87, 0xdb, 0x1a, 0x1c, 0xec, 0xef, 0x62,
+	0x34, 0x06, 0x61, 0xf3, 0x6c, 0x6f, 0x84, 0x4f, 0x7f, 0x44, 0x78, 0x03, 0xec, 0xb2, 0x04, 0xb8,
+	0x66, 0x13, 0x06, 0x72, 0x57, 0xf1, 0x7f, 0xbf, 0x5d, 0x72, 0x6f, 0xea, 0x71, 0xd8, 0xdc, 0x09,
+	0xe8, 0x72, 0x4b, 0x9c, 0xd5, 0x96, 0x38, 0xeb, 0x2d, 0x71, 0x9e, 0x0c, 0x41, 0x4b, 0x43, 0xd0,
+	0xca, 0x10, 0xb4, 0x36, 0x04, 0xbd, 0x19, 0x82, 0x5e, 0xde, 0x89, 0x73, 0xbf, 0x57, 0xf5, 0xf8,
+	0x08, 0x00, 0x00, 0xff, 0xff, 0xff, 0x5f, 0x50, 0x3c, 0x80, 0x02, 0x00, 0x00,
 }
 
 func (m *VersionSelection) Marshal() (dAtA []byte, err error) {
@@ -424,10 +422,7 @@ func (m *VersionSelection) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if skippy < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if (iNdEx + skippy) > l {
@@ -545,10 +540,7 @@ func (m *VersionSelectionSemver) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if skippy < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if (iNdEx + skippy) > l {
@@ -630,10 +622,7 @@ func (m *VersionSelectionSemverPrereleases) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if skippy < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if (iNdEx + skippy) > l {
@@ -651,6 +640,7 @@ func (m *VersionSelectionSemverPrereleases) Unmarshal(dAtA []byte) error {
 func skipGenerated(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
+	depth := 0
 	for iNdEx < l {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
@@ -682,10 +672,8 @@ func skipGenerated(dAtA []byte) (n int, err error) {
 					break
 				}
 			}
-			return iNdEx, nil
 		case 1:
 			iNdEx += 8
-			return iNdEx, nil
 		case 2:
 			var length int
 			for shift := uint(0); ; shift += 7 {
@@ -706,55 +694,30 @@ func skipGenerated(dAtA []byte) (n int, err error) {
 				return 0, ErrInvalidLengthGenerated
 			}
 			iNdEx += length
-			if iNdEx < 0 {
-				return 0, ErrInvalidLengthGenerated
-			}
-			return iNdEx, nil
 		case 3:
-			for {
-				var innerWire uint64
-				var start int = iNdEx
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return 0, ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return 0, io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					innerWire |= (uint64(b) & 0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				innerWireType := int(innerWire & 0x7)
-				if innerWireType == 4 {
-					break
-				}
-				next, err := skipGenerated(dAtA[start:])
-				if err != nil {
-					return 0, err
-				}
-				iNdEx = start + next
-				if iNdEx < 0 {
-					return 0, ErrInvalidLengthGenerated
-				}
-			}
-			return iNdEx, nil
+			depth++
 		case 4:
-			return iNdEx, nil
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
 		case 5:
 			iNdEx += 4
-			return iNdEx, nil
 		default:
 			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
 		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
 	}
-	panic("unreachable")
+	return 0, io.ErrUnexpectedEOF
 }
 
 var (
-	ErrInvalidLengthGenerated = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowGenerated   = fmt.Errorf("proto: integer overflow")
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
 )
diff --git a/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto b/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto
index c9b2f884..537db467 100644
--- a/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto
+++ b/vendor/carvel.dev/vendir/pkg/vendir/versions/v1alpha1/generated.proto
@@ -3,7 +3,7 @@
 
 syntax = 'proto2';
 
-package github.com.vmware_tanzu.carvel_vendir.pkg.vendir.versions.v1alpha1;
+package carvel.dev.vendir.pkg.vendir.versions.v1alpha1;
 
 // Package-wide variables from generator "generated".
 option go_package = "v1alpha1";
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 9c1ca948..4cc3c23c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,7 +1,7 @@
 # carvel.dev/imgpkg v0.41.1
 ## explicit; go 1.21
 carvel.dev/imgpkg/pkg/imgpkg/lockconfig
-# carvel.dev/vendir v0.39.0
+# carvel.dev/vendir v0.40.0
 ## explicit; go 1.21
 carvel.dev/vendir/pkg/vendir/versions
 carvel.dev/vendir/pkg/vendir/versions/v1alpha1