diff --git a/go.mod b/go.mod
index fb4c97d4789..1f2b20da781 100644
--- a/go.mod
+++ b/go.mod
@@ -49,7 +49,7 @@ replace (
 require (
 	code.gitea.io/sdk/gitea v0.17.1
 	github.com/goccy/kpoward v0.1.0
-	github.com/google/cel-go v0.20.0
+	github.com/google/cel-go v0.20.1
 	github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20240108195214-a0658aa1d0cc
 	github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20240108195214-a0658aa1d0cc
 	github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.2
diff --git a/go.sum b/go.sum
index ce4feccc93f..b0c7cc11735 100644
--- a/go.sum
+++ b/go.sum
@@ -578,8 +578,8 @@ github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
-github.com/google/cel-go v0.20.0 h1:h4n6DOCppEMpWERzllyNkntl7JrDyxoE543KWS6BLpc=
-github.com/google/cel-go v0.20.0/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
+github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
+github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
 github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
 github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0=
 github.com/google/gnostic v0.6.9/go.mod h1:Nm8234We1lq6iB9OmlgNv3nH91XLLVZHCDayfA3xq+E=
diff --git a/vendor/github.com/google/cel-go/cel/BUILD.bazel b/vendor/github.com/google/cel-go/cel/BUILD.bazel
index 33da216234b..6e2fc073d4d 100644
--- a/vendor/github.com/google/cel-go/cel/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/cel/BUILD.bazel
@@ -77,6 +77,7 @@ go_test(
         "//common/types:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
+        "//ext:go_default_library",
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
diff --git a/vendor/github.com/google/cel-go/cel/inlining.go b/vendor/github.com/google/cel-go/cel/inlining.go
index e3383b68bb1..78d5bea65b1 100644
--- a/vendor/github.com/google/cel-go/cel/inlining.go
+++ b/vendor/github.com/google/cel-go/cel/inlining.go
@@ -88,7 +88,7 @@ func (opt *inliningOptimizer) Optimize(ctx *OptimizerContext, a *ast.AST) *ast.A
 		if len(matches) == 1 || !isBindable(matches, inlineVar.Expr(), inlineVar.Type()) {
 			for _, match := range matches {
 				// Copy the inlined AST expr and source info.
-				copyExpr := copyASTAndMetadata(ctx, inlineVar.def)
+				copyExpr := ctx.CopyASTAndMetadata(inlineVar.def)
 				opt.inlineExpr(ctx, match, copyExpr, inlineVar.Type())
 			}
 			continue
@@ -121,26 +121,15 @@ func (opt *inliningOptimizer) Optimize(ctx *OptimizerContext, a *ast.AST) *ast.A
 		}
 
 		// Copy the inlined AST expr and source info.
-		copyExpr := copyASTAndMetadata(ctx, inlineVar.def)
+		copyExpr := ctx.CopyASTAndMetadata(inlineVar.def)
 		// Update the least common ancestor by inserting a cel.bind() call to the alias.
 		inlined, bindMacro := ctx.NewBindMacro(lca.ID(), inlineVar.Alias(), copyExpr, lca)
 		opt.inlineExpr(ctx, lca, inlined, inlineVar.Type())
-		ctx.sourceInfo.SetMacroCall(lca.ID(), bindMacro)
+		ctx.SetMacroCall(lca.ID(), bindMacro)
 	}
 	return a
 }
 
-// copyASTAndMetadata copies the input AST and propagates the macro metadata into the AST being
-// optimized.
-func copyASTAndMetadata(ctx *OptimizerContext, a *ast.AST) ast.Expr {
-	copyExpr, copyInfo := ctx.CopyAST(a)
-	// Add in the macro calls from the inlined AST
-	for id, call := range copyInfo.MacroCalls() {
-		ctx.sourceInfo.SetMacroCall(id, call)
-	}
-	return copyExpr
-}
-
 // inlineExpr replaces the current expression with the inlined one, unless the location of the inlining
 // happens within a presence test, e.g. has(a.b.c) -> inline alpha for a.b.c in which case an attempt is
 // made to determine whether the inlined value can be presence or existence tested.
@@ -168,11 +157,11 @@ func (opt *inliningOptimizer) rewritePresenceExpr(ctx *OptimizerContext, prev, i
 	if inlined.Kind() == ast.SelectKind {
 		presenceTest, hasMacro := ctx.NewHasMacro(prev.ID(), inlined)
 		ctx.UpdateExpr(prev, presenceTest)
-		ctx.sourceInfo.SetMacroCall(prev.ID(), hasMacro)
+		ctx.SetMacroCall(prev.ID(), hasMacro)
 		return
 	}
 
-	ctx.sourceInfo.ClearMacroCall(prev.ID())
+	ctx.ClearMacroCall(prev.ID())
 	if inlinedType.IsAssignableType(NullType) {
 		ctx.UpdateExpr(prev,
 			ctx.NewCall(operators.NotEquals,
diff --git a/vendor/github.com/google/cel-go/cel/optimizer.go b/vendor/github.com/google/cel-go/cel/optimizer.go
index 99aeeb81596..f26df462344 100644
--- a/vendor/github.com/google/cel-go/cel/optimizer.go
+++ b/vendor/github.com/google/cel-go/cel/optimizer.go
@@ -212,6 +212,12 @@ type optimizerExprFactory struct {
 	sourceInfo *ast.SourceInfo
 }
 
+// NewAST creates an AST from the current expression using the tracked source info which
+// is modified and managed by the OptimizerContext.
+func (opt *optimizerExprFactory) NewAST(expr ast.Expr) *ast.AST {
+	return ast.NewAST(expr, opt.sourceInfo)
+}
+
 // CopyAST creates a renumbered copy of `Expr` and `SourceInfo` values of the input AST, where the
 // renumbering uses the same scheme as the core optimizer logic ensuring there are no collisions
 // between copies.
@@ -226,6 +232,27 @@ func (opt *optimizerExprFactory) CopyAST(a *ast.AST) (ast.Expr, *ast.SourceInfo)
 	return copyExpr, copyInfo
 }
 
+// CopyASTAndMetadata copies the input AST and propagates the macro metadata into the AST being
+// optimized.
+func (opt *optimizerExprFactory) CopyASTAndMetadata(a *ast.AST) ast.Expr {
+	copyExpr, copyInfo := opt.CopyAST(a)
+	for macroID, call := range copyInfo.MacroCalls() {
+		opt.SetMacroCall(macroID, call)
+	}
+	return copyExpr
+}
+
+// ClearMacroCall clears the macro at the given expression id.
+func (opt *optimizerExprFactory) ClearMacroCall(id int64) {
+	opt.sourceInfo.ClearMacroCall(id)
+}
+
+// SetMacroCall sets the macro call metadata for the given macro id within the tracked source info
+// metadata.
+func (opt *optimizerExprFactory) SetMacroCall(id int64, expr ast.Expr) {
+	opt.sourceInfo.SetMacroCall(id, expr)
+}
+
 // NewBindMacro creates an AST expression representing the expanded bind() macro, and a macro expression
 // representing the unexpanded call signature to be inserted into the source info macro call metadata.
 func (opt *optimizerExprFactory) NewBindMacro(macroID int64, varName string, varInit, remaining ast.Expr) (astExpr, macroExpr ast.Expr) {
@@ -239,7 +266,7 @@ func (opt *optimizerExprFactory) NewBindMacro(macroID int64, varName string, var
 		return id
 	})
 	if call, exists := opt.sourceInfo.GetMacroCall(macroID); exists {
-		opt.sourceInfo.SetMacroCall(remainingID, opt.fac.CopyExpr(call))
+		opt.SetMacroCall(remainingID, opt.fac.CopyExpr(call))
 	}
 
 	astExpr = opt.fac.NewComprehension(macroID,
diff --git a/vendor/github.com/google/cel-go/checker/cost.go b/vendor/github.com/google/cel-go/checker/cost.go
index 3470d0a3f0b..04244694d81 100644
--- a/vendor/github.com/google/cel-go/checker/cost.go
+++ b/vendor/github.com/google/cel-go/checker/cost.go
@@ -506,6 +506,9 @@ func (c *coster) costComprehension(e ast.Expr) CostEstimate {
 	c.iterRanges.pop(comp.IterVar())
 	sum = sum.Add(c.cost(comp.Result()))
 	rangeCnt := c.sizeEstimate(c.newAstNode(comp.IterRange()))
+
+	c.computedSizes[e.ID()] = rangeCnt
+
 	rangeCost := rangeCnt.MultiplyByCost(stepCost.Add(loopCost))
 	sum = sum.Add(rangeCost)
 
diff --git a/vendor/github.com/google/cel-go/common/ast/BUILD.bazel b/vendor/github.com/google/cel-go/common/ast/BUILD.bazel
index c92a0f17972..5c40c37813b 100644
--- a/vendor/github.com/google/cel-go/common/ast/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/ast/BUILD.bazel
@@ -1,14 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 package(
-    default_visibility = [
-        "//cel:__subpackages__",
-        "//checker:__subpackages__",
-        "//common:__subpackages__",
-        "//ext:__subpackages__",
-        "//interpreter:__subpackages__",
-        "//parser:__subpackages__",
-    ],
+    default_visibility = ["//visibility:public"],
     licenses = ["notice"],  # Apache 2.0
 )
 
@@ -58,4 +51,4 @@ go_test(
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//encoding/prototext:go_default_library",
     ],
-)
\ No newline at end of file
+)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 9eaa7c9c306..064cd49c677 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -518,7 +518,7 @@ github.com/golang/protobuf/ptypes
 github.com/golang/protobuf/ptypes/any
 github.com/golang/protobuf/ptypes/duration
 github.com/golang/protobuf/ptypes/timestamp
-# github.com/google/cel-go v0.20.0
+# github.com/google/cel-go v0.20.1
 ## explicit; go 1.18
 github.com/google/cel-go/cel
 github.com/google/cel-go/checker