diff --git a/go.mod b/go.mod
index 8e25d21b..c98be269 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/prometheus/client_golang v1.19.1
 	github.com/rs/cors v1.11.0
 	github.com/sapcc/go-api-declarations v1.11.3
-	github.com/sapcc/go-bits v0.0.0-20240708133634-c3fa8372671d
+	github.com/sapcc/go-bits v0.0.0-20240709125621-b1e90ef040ad
 	go.uber.org/automaxprocs v1.5.3
 	gopkg.in/yaml.v2 v2.4.0
 )
diff --git a/go.sum b/go.sum
index 1a3efea1..2f9a4402 100644
--- a/go.sum
+++ b/go.sum
@@ -139,8 +139,8 @@ github.com/rs/cors v1.11.0 h1:0B9GE/r9Bc2UxRMMtymBkHTenPkHDv0CW4Y98GBY+po=
 github.com/rs/cors v1.11.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/sapcc/go-api-declarations v1.11.3 h1:A8JgeSmOdziYXuiOes9Lp3LKZ0FsU2lc9FOxoM3kRR0=
 github.com/sapcc/go-api-declarations v1.11.3/go.mod h1:83R3hTANhuRXt/pXDby37IJetw8l7DG41s33Tp9NXxI=
-github.com/sapcc/go-bits v0.0.0-20240708133634-c3fa8372671d h1:T2+b3BdnLVgagXxNgTyk/1MTSKDk1wAEmt6tFwrQo2U=
-github.com/sapcc/go-bits v0.0.0-20240708133634-c3fa8372671d/go.mod h1:d9JN0Gm8lF5jUMQeH/3MS5iNhs6/AlR/wVQ8vxRAGmo=
+github.com/sapcc/go-bits v0.0.0-20240709125621-b1e90ef040ad h1:e0kDKCEhohs+oKwYRRAibCJdqd2DvLwWrK17yELxUpY=
+github.com/sapcc/go-bits v0.0.0-20240709125621-b1e90ef040ad/go.mod h1:d9JN0Gm8lF5jUMQeH/3MS5iNhs6/AlR/wVQ8vxRAGmo=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
diff --git a/vendor/github.com/sapcc/go-bits/gopherpolicy/cache.go b/vendor/github.com/sapcc/go-bits/gopherpolicy/cache.go
index 279eccf5..f84df8c8 100644
--- a/vendor/github.com/sapcc/go-bits/gopherpolicy/cache.go
+++ b/vendor/github.com/sapcc/go-bits/gopherpolicy/cache.go
@@ -19,6 +19,7 @@
 package gopherpolicy
 
 import (
+	"context"
 	"crypto/sha256"
 	"encoding/hex"
 
@@ -40,11 +41,11 @@ func InMemoryCacher() Cacher {
 	return inMemoryCacher{c}
 }
 
-func (c inMemoryCacher) StoreTokenPayload(token string, payload []byte) {
+func (c inMemoryCacher) StoreTokenPayload(_ context.Context, token string, payload []byte) {
 	c.Add(cacheKeyFor(token), payload)
 }
 
-func (c inMemoryCacher) LoadTokenPayload(token string) []byte {
+func (c inMemoryCacher) LoadTokenPayload(_ context.Context, token string) []byte {
 	payload, ok := c.Get(cacheKeyFor(token))
 	if !ok {
 		return nil
diff --git a/vendor/github.com/sapcc/go-bits/gopherpolicy/pkg.go b/vendor/github.com/sapcc/go-bits/gopherpolicy/pkg.go
index abe7929c..be3126fd 100644
--- a/vendor/github.com/sapcc/go-bits/gopherpolicy/pkg.go
+++ b/vendor/github.com/sapcc/go-bits/gopherpolicy/pkg.go
@@ -22,6 +22,7 @@
 package gopherpolicy
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -53,11 +54,11 @@ type Cacher interface {
 	// StoreTokenPayload attempts to store the token payload corresponding to the
 	// given credentials in the cache. Implementations shall treat `credentials`
 	// as an opaque string and only use it as a cache key.
-	StoreTokenPayload(credentials string, payload []byte)
+	StoreTokenPayload(ctx context.Context, credentials string, payload []byte)
 	// LoadTokenPayload attempts to retrieve the payload for the given credentials
 	// from the cache. If there nothing cached for these credentials, or if the
 	// retrieval fails, nil shall be returned.
-	LoadTokenPayload(credentials string) []byte
+	LoadTokenPayload(ctx context.Context, credentials string) []byte
 }
 
 // TokenValidator combines an Identity v3 client to validate tokens (AuthN), and
@@ -97,7 +98,7 @@ func (v *TokenValidator) CheckToken(r *http.Request) *Token {
 		return &Token{Err: errors.New("X-Auth-Token header missing")}
 	}
 
-	token := v.CheckCredentials(tokenStr, func() TokenResult {
+	token := v.CheckCredentials(r.Context(), tokenStr, func() TokenResult {
 		return tokens.Get(r.Context(), v.IdentityV3, tokenStr)
 	})
 	token.Context.Logger = logg.Debug
@@ -116,11 +117,11 @@ func (v *TokenValidator) CheckToken(r *http.Request) *Token {
 // The `cacheKey` argument shall be a string that identifies the given
 // credentials. This key is used for caching the TokenResult in `v.Cacher` if
 // that is non-nil.
-func (v *TokenValidator) CheckCredentials(cacheKey string, check func() TokenResult) *Token {
+func (v *TokenValidator) CheckCredentials(ctx context.Context, cacheKey string, check func() TokenResult) *Token {
 	// prefer cached token payload over actually talking to Keystone (but fallback
 	// to Keystone if the token payload deserialization fails)
 	if v.Cacher != nil {
-		payload := v.Cacher.LoadTokenPayload(cacheKey)
+		payload := v.Cacher.LoadTokenPayload(ctx, cacheKey)
 		if payload != nil {
 			var s serializableToken
 			err := json.Unmarshal(payload, &s)
@@ -139,7 +140,7 @@ func (v *TokenValidator) CheckCredentials(cacheKey string, check func() TokenRes
 	if t.Err == nil && v.Cacher != nil {
 		payload, err := json.Marshal(t.serializable)
 		if err == nil {
-			v.Cacher.StoreTokenPayload(cacheKey, payload)
+			v.Cacher.StoreTokenPayload(ctx, cacheKey, payload)
 		}
 	}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0c61b403..7a3635a3 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -101,7 +101,7 @@ github.com/rs/cors/internal
 ## explicit; go 1.21
 github.com/sapcc/go-api-declarations/bininfo
 github.com/sapcc/go-api-declarations/deployevent
-# github.com/sapcc/go-bits v0.0.0-20240708133634-c3fa8372671d
+# github.com/sapcc/go-bits v0.0.0-20240709125621-b1e90ef040ad
 ## explicit; go 1.22
 github.com/sapcc/go-bits/assert
 github.com/sapcc/go-bits/easypg