diff --git a/contrib/tetragon-rthooks/go.mod b/contrib/tetragon-rthooks/go.mod
index 81b8c31de77..6fd9f8a8ddd 100644
--- a/contrib/tetragon-rthooks/go.mod
+++ b/contrib/tetragon-rthooks/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/containerd/containerd v1.7.25
 	github.com/containerd/nri v0.9.0
 	github.com/containers/common v0.61.1
-	github.com/google/cel-go v0.23.0
+	github.com/google/cel-go v0.23.1
 	github.com/opencontainers/runc v1.2.4
 	github.com/opencontainers/runtime-spec v1.2.0
 	github.com/pelletier/go-toml v1.9.5
diff --git a/contrib/tetragon-rthooks/go.sum b/contrib/tetragon-rthooks/go.sum
index f807de80db6..9659da97960 100644
--- a/contrib/tetragon-rthooks/go.sum
+++ b/contrib/tetragon-rthooks/go.sum
@@ -57,8 +57,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/cel-go v0.23.0 h1:knsnzeUOcREUFo0ZFJqZI8Rk6uEVyobAlir7GEbf5v0=
-github.com/google/cel-go v0.23.0/go.mod h1:52Pb6QsDbC5kvgxvZhiL9QX1oZEkcUF/ZqaPx1J5Wwo=
+github.com/google/cel-go v0.23.1 h1:91ThhEZlBcE5rB2adBVXqvDoqdL8BG2oyhd0bK1I/r4=
+github.com/google/cel-go v0.23.1/go.mod h1:52Pb6QsDbC5kvgxvZhiL9QX1oZEkcUF/ZqaPx1J5Wwo=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
diff --git a/contrib/tetragon-rthooks/vendor/github.com/google/cel-go/checker/cost.go b/contrib/tetragon-rthooks/vendor/github.com/google/cel-go/checker/cost.go
index 1b325eac402..b9cd8a2ed39 100644
--- a/contrib/tetragon-rthooks/vendor/github.com/google/cel-go/checker/cost.go
+++ b/contrib/tetragon-rthooks/vendor/github.com/google/cel-go/checker/cost.go
@@ -930,6 +930,14 @@ func (c *coster) computeSize(e ast.Expr) *SizeEstimate {
 	if size, ok := c.computedSizes[e.ID()]; ok {
 		return &size
 	}
+	// Ensure size estimates are computed first as users may choose to override the costs that
+	// CEL would otherwise ascribe to the type.
+	node := astNode{expr: e, path: c.getPath(e), t: c.getType(e)}
+	if size := c.estimator.EstimateSize(node); size != nil {
+		// storing the computed size should reduce calls to EstimateSize()
+		c.computedSizes[e.ID()] = *size
+		return size
+	}
 	if size := computeExprSize(e); size != nil {
 		return size
 	}
@@ -942,12 +950,6 @@ func (c *coster) computeSize(e ast.Expr) *SizeEstimate {
 			return v.size
 		}
 	}
-	node := astNode{expr: e, path: c.getPath(e), t: c.getType(e)}
-	if size := c.estimator.EstimateSize(node); size != nil {
-		// storing the computed size should reduce calls to EstimateSize()
-		c.computedSizes[e.ID()] = *size
-		return size
-	}
 	return nil
 }
 
@@ -1014,8 +1016,7 @@ func computeTypeSize(t *types.Type) *SizeEstimate {
 // in addition to protobuf.Any and protobuf.Value (their size is not knowable at compile time).
 func isScalar(t *types.Type) bool {
 	switch t.Kind() {
-	case types.BoolKind, types.DoubleKind, types.DurationKind, types.IntKind,
-		types.NullTypeKind, types.TimestampKind, types.TypeKind, types.UintKind:
+	case types.BoolKind, types.DoubleKind, types.DurationKind, types.IntKind, types.TimestampKind, types.UintKind:
 		return true
 	case types.OpaqueKind:
 		if t.TypeName() == "optional_type" {
diff --git a/contrib/tetragon-rthooks/vendor/modules.txt b/contrib/tetragon-rthooks/vendor/modules.txt
index 91324eca5a4..9f829578198 100644
--- a/contrib/tetragon-rthooks/vendor/modules.txt
+++ b/contrib/tetragon-rthooks/vendor/modules.txt
@@ -72,7 +72,7 @@ github.com/gogo/protobuf/gogoproto
 github.com/gogo/protobuf/proto
 github.com/gogo/protobuf/protoc-gen-gogo/descriptor
 github.com/gogo/protobuf/sortkeys
-# github.com/google/cel-go v0.23.0
+# github.com/google/cel-go v0.23.1
 ## explicit; go 1.21.1
 github.com/google/cel-go/cel
 github.com/google/cel-go/checker