diff --git a/Dockerfile.windows b/Dockerfile.windows
index 822e2363a2..312eb96d11 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -44,7 +44,7 @@ ARG KUBERNETES_VERSION=dev
 
 # windows runtime image
 ENV CRICTL_VERSION="v1.29.0"
-ENV CALICO_VERSION="v3.27.3"
+ENV CALICO_VERSION="v3.28.1"
 ENV CNI_PLUGIN_VERSION="v1.4.1"
 ENV FLANNEL_VERSION="v0.25.4"
 ENV CNI_FLANNEL_VERSION="v1.4.1-flannel1"
diff --git a/charts/chart_versions.yaml b/charts/chart_versions.yaml
index b75a351b7a..d6fd77977f 100644
--- a/charts/chart_versions.yaml
+++ b/charts/chart_versions.yaml
@@ -5,10 +5,10 @@ charts:
   - version: v3.28.0-build2024062503
     filename: /charts/rke2-canal.yaml
     bootstrap: true
-  - version: v3.27.300
+  - version: v3.28.100
     filename: /charts/rke2-calico.yaml
     bootstrap: true
-  - version: v3.27.002
+  - version: v3.28.100
     filename: /charts/rke2-calico-crd.yaml
     bootstrap: true
   - version: 1.29.004
diff --git a/scripts/build-images b/scripts/build-images
index ceeeed755f..53b9378c06 100755
--- a/scripts/build-images
+++ b/scripts/build-images
@@ -54,16 +54,16 @@ xargs -n1 -t docker image pull --quiet << EOF > build/images-cilium.txt
 EOF
 
 xargs -n1 -t docker image pull --quiet << EOF > build/images-calico.txt
-    ${REGISTRY}/rancher/mirrored-calico-operator:v1.32.7
-    ${REGISTRY}/rancher/mirrored-calico-ctl:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-kube-controllers:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-typha:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-node:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-pod2daemon-flexvol:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-cni:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-apiserver:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-csi:v3.27.3
-    ${REGISTRY}/rancher/mirrored-calico-node-driver-registrar:v3.27.3
+    ${REGISTRY}/rancher/mirrored-calico-operator:v1.34.3
+    ${REGISTRY}/rancher/mirrored-calico-ctl:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-kube-controllers:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-typha:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-node:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-pod2daemon-flexvol:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-cni:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-apiserver:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-csi:v3.28.1
+    ${REGISTRY}/rancher/mirrored-calico-node-driver-registrar:v3.28.1
 EOF
 
 if [ "${GOARCH}" != "arm64" ]; then