diff --git a/.mega-linter.yml b/.mega-linter.yml
index 3e768769ecd..cc93918d243 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -65,6 +65,10 @@ REPOSITORY_KINGFISHER_ARGUMENTS:
   - "docs"
   - "--exclude"
   - "gitleaks-default.toml"
+  # Same as gitleaks-default.toml above: the vendored betterleaks ruleset stores
+  # detection patterns that kingfisher v2 reports as the secrets themselves
+  - "--exclude"
+  - "betterleaks-default.toml"
 REPOSITORY_OSV_SCANNER_ARGUMENTS:
   - "--experimental-exclude=g:**/.automation/test/**"
   # Disable transitive-dep resolution: it calls deps.dev which has been
diff --git a/Dockerfile b/Dockerfile
index f2c5fd241d1..9a92f27cd76 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -370,7 +370,7 @@ ARG REPOSITORY_TRIVY_VERSION=0.74.0
 # renovate: datasource=github-tags depName=aquasecurity/trivy
 ARG REPOSITORY_TRIVY_SBOM_VERSION=0.74.0
 # renovate: datasource=github-tags depName=mongodb/kingfisher
-ARG REPOSITORY_KINGFISHER_VERSION=1.113.0
+ARG REPOSITORY_KINGFISHER_VERSION=2.0.0
 # renovate: datasource=pypi depName=robotframework-robocop
 ARG PIP_ROBOT_FRAMEWORK_ROBOCOP_VERSION=8.8.0
 # renovate: datasource=pypi depName=Pygments
diff --git a/flavors/security/Dockerfile b/flavors/security/Dockerfile
index 404caef323b..4c877249ab1 100644
--- a/flavors/security/Dockerfile
+++ b/flavors/security/Dockerfile
@@ -138,7 +138,7 @@ ARG REPOSITORY_TRIVY_VERSION=0.74.0
 # renovate: datasource=github-tags depName=aquasecurity/trivy
 ARG REPOSITORY_TRIVY_SBOM_VERSION=0.74.0
 # renovate: datasource=github-tags depName=mongodb/kingfisher
-ARG REPOSITORY_KINGFISHER_VERSION=1.113.0
+ARG REPOSITORY_KINGFISHER_VERSION=2.0.0
 # renovate: datasource=pypi depName=pip
 ARG PIP_PIP_VERSION=26.2.1
 # renovate: datasource=pypi depName=virtualenv
diff --git a/linters/repository_kingfisher/Dockerfile b/linters/repository_kingfisher/Dockerfile
index 4e2276d9f0f..e67e7c50368 100644
--- a/linters/repository_kingfisher/Dockerfile
+++ b/linters/repository_kingfisher/Dockerfile
@@ -62,7 +62,7 @@ RUN python -c 'import sys; assert sys.version_info >= (3, 14, 7), "Python 3.14.7
 ARG TARGETPLATFORM
 ARG TARGETARCH
 # renovate: datasource=github-tags depName=mongodb/kingfisher
-ARG REPOSITORY_KINGFISHER_VERSION=1.113.0
+ARG REPOSITORY_KINGFISHER_VERSION=2.0.0
 #ARG__END
 
 ####################
diff --git a/megalinter/descriptors/repository.megalinter-descriptor.yml b/megalinter/descriptors/repository.megalinter-descriptor.yml
index d5f0a5ac151..5d93bbc9ca6 100644
--- a/megalinter/descriptors/repository.megalinter-descriptor.yml
+++ b/megalinter/descriptors/repository.megalinter-descriptor.yml
@@ -1279,7 +1279,7 @@ linters:
       dockerfile:
         - |-
           # renovate: datasource=github-tags depName=mongodb/kingfisher
-          ARG REPOSITORY_KINGFISHER_VERSION=1.113.0
+          ARG REPOSITORY_KINGFISHER_VERSION=2.0.0
         - |
           RUN curl --silent --location https://raw.githubusercontent.com/mongodb/kingfisher/main/scripts/install-kingfisher.sh | bash -s -- /usr/local/bin --tag "v${REPOSITORY_KINGFISHER_VERSION}"
     supported_platforms: