diff --git a/.drone.yml b/.drone.yml
index 1e8d578ede..d9413fc744 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -27,7 +27,7 @@ steps:
   - name: validate-release
     image: rancher/dapper:v0.5.5
     commands:
-      - docker pull --quiet rancher/hardened-build-base:v1.19.9b2
+      - docker pull --quiet rancher/hardened-build-base:v1.20.8b2
       - dapper -f Dockerfile --target dapper make validate-release
     volumes:
       - name: docker
@@ -47,7 +47,7 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: AWS_SECRET_ACCESS_KEY-rke2-ci-uploader     
     commands:
-      - docker pull --quiet rancher/hardened-build-base:v1.19.9b2
+      - docker pull --quiet rancher/hardened-build-base:v1.20.8b2
       - docker pull --quiet alpine:3.17
       - dapper -f Dockerfile --target dapper make dapper-ci
     volumes:
@@ -76,7 +76,7 @@ steps:
   - name: package-images
     image: rancher/dapper:v0.5.5
     commands:
-      - docker pull --quiet rancher/hardened-build-base:v1.19.9b2
+      - docker pull --quiet rancher/hardened-build-base:v1.20.8b2
       - dapper -f Dockerfile --target dapper make package-images
     volumes:
       - name: docker
@@ -115,7 +115,7 @@ steps:
         path: /var/run/docker.sock
 
   - name: publish-image-runtime
-    image: rancher/hardened-build-base:v1.19.9b2
+    image: rancher/hardened-build-base:v1.20.8b2
     commands:
       - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
       - DRONE_TAG=${DRONE_TAG} make publish-image-runtime
@@ -139,7 +139,7 @@ steps:
   - name: package-windows-images
     image: rancher/dapper:v0.5.5
     commands:
-      - docker pull --quiet rancher/hardened-build-base:v1.19.9b2
+      - docker pull --quiet rancher/hardened-build-base:v1.20.8b2
       - dapper -f Dockerfile --target dapper make package-windows-images
     when:
       event:
@@ -227,7 +227,7 @@ steps:
         - drone-publish.rancher.io
 
   - name: publish-image-runtime
-    image: rancher/hardened-build-base:v1.19.9b2
+    image: rancher/hardened-build-base:v1.20.8b2
     commands:
       - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
       - DRONE_TAG=${DRONE_TAG} make publish-image-runtime
diff --git a/Dockerfile b/Dockerfile
index a46b26195c..267a93df9d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 ARG KUBERNETES_VERSION=dev
 
 # Build environment
-FROM rancher/hardened-build-base:v1.20.7b3 AS build
+FROM rancher/hardened-build-base:v1.20.8b2 AS build
 ARG DAPPER_HOST_ARCH
 ENV ARCH $DAPPER_HOST_ARCH
 RUN set -x \
@@ -138,7 +138,7 @@ RUN rm -vf /charts/*.sh /charts/*.md
 # This image includes any host level programs that we might need. All binaries
 # must be placed in bin/ of the file image and subdirectories of bin/ will be flattened during installation.
 # This means bin/foo/bar will become bin/bar when rke2 installs this to the host
-FROM rancher/hardened-kubernetes:v1.26.8-rke2r1-build20230824 AS kubernetes
+FROM rancher/hardened-kubernetes:v1.26.9-rke2r1-build20230913 AS kubernetes
 FROM rancher/hardened-containerd:v1.7.3-k3s1-build20230802 AS containerd
 FROM rancher/hardened-crictl:v1.26.1-build20230406 AS crictl
 FROM rancher/hardened-runc:v1.1.8-build20230802 AS runc
diff --git a/scripts/version.sh b/scripts/version.sh
index 71d5874e80..33ec0b0ebc 100755
--- a/scripts/version.sh
+++ b/scripts/version.sh
@@ -31,8 +31,8 @@ REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code;
 PLATFORM=${GOOS}-${GOARCH}
 RELEASE=${PROG}.${PLATFORM}
 # hardcode versions unless set specifically
-KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.26.8}
-KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.26.8-rke2r1-build20230824}
+KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.26.9}
+KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.26.9-rke2r1-build20230913}
 ETCD_VERSION=${ETCD_VERSION:-v3.5.9-k3s1}
 PAUSE_VERSION=${PAUSE_VERSION:-3.6}
 CCM_VERSION=${CCM_VERSION:-v1.26.3-build20230406}