diff --git a/talos/controlplane.yaml b/talos/controlplane.yaml
index 1ac0f42f..21b7e3e8 100644
--- a/talos/controlplane.yaml
+++ b/talos/controlplane.yaml
@@ -31,7 +31,7 @@ machine:
         format: json_lines
   # -- Services
   kubelet:
-    image: ghcr.io/siderolabs/kubelet:v1.30.0
+    image: ghcr.io/siderolabs/kubelet:v1.31.2
     defaultRuntimeSeccompProfileEnabled: true
     disableManifestsDirectory: true
   # -- Talos features
@@ -86,7 +86,7 @@ cluster:
   proxy:
     disabled: true
   apiServer:
-    image: registry.k8s.io/kube-apiserver:v1.30.0
+    image: registry.k8s.io/kube-apiserver:v1.31.2
     extraArgs:
       oidc-issuer-url: https://oauth.id.jumpcloud.com/
       oidc-client-id: ${cluster_apiServer_extraArgs_oidc_client_id}
@@ -121,7 +121,7 @@ cluster:
       rules:
         - level: Metadata
   etcd:
-    image: gcr.io/etcd-development/etcd:v3.5.13-arm64
+    image: gcr.io/etcd-development/etcd:v3.5.17-arm64
     # Etcd CA
     ca:
       crt: ${cluster_etcd_ca_crt}
@@ -129,15 +129,15 @@ cluster:
     extraArgs:
       listen-metrics-urls: http://0.0.0.0:2381
   controllerManager:
-    image: registry.k8s.io/kube-controller-manager:v1.30.0
+    image: registry.k8s.io/kube-controller-manager:v1.31.2
     extraArgs:
       bind-address: 0.0.0.0
   scheduler:
-    image: registry.k8s.io/kube-scheduler:v1.30.0
+    image: registry.k8s.io/kube-scheduler:v1.31.2
     extraArgs:
       bind-address: 0.0.0.0
   coreDNS:
-    image: docker.io/coredns/coredns:1.11.1
+    image: docker.io/coredns/coredns:1.11.3
   # -- Extras
   extraManifests: []
   inlineManifests: []
diff --git a/talos/worker.yaml b/talos/worker.yaml
index 030d9904..b47584e6 100644
--- a/talos/worker.yaml
+++ b/talos/worker.yaml
@@ -25,7 +25,7 @@ machine:
         format: json_lines
   # -- Services
   kubelet:
-    image: ghcr.io/siderolabs/kubelet:v1.30.0
+    image: ghcr.io/siderolabs/kubelet:v1.31.2
     defaultRuntimeSeccompProfileEnabled: true
     disableManifestsDirectory: true
   # -- Talos features