diff --git a/charts/calico/values.yaml b/charts/calico/values.yaml
index 8f830a45b05..a5c0b11e287 100644
--- a/charts/calico/values.yaml
+++ b/charts/calico/values.yaml
@@ -1,5 +1,5 @@
 # The Calico version to use when generating manifests.
-version: v3.26.2
+version: v3.26.3
 
 # Configure the images to use when generating manifests.
 node:
diff --git a/charts/tigera-operator/values.yaml b/charts/tigera-operator/values.yaml
index d4ac4db8c66..5d60da9ec6f 100644
--- a/charts/tigera-operator/values.yaml
+++ b/charts/tigera-operator/values.yaml
@@ -41,8 +41,8 @@ podLabels: {}
 # Image and registry configuration for the tigera/operator pod.
 tigeraOperator:
   image: tigera/operator
-  version: v1.30.6
+  version: v1.30.7
   registry: quay.io
 calicoctl:
   image: docker.io/calico/ctl
-  tag: v3.26.2
+  tag: v3.26.3
diff --git a/manifests/alp/istio-inject-configmap-1.1.0.yaml b/manifests/alp/istio-inject-configmap-1.1.0.yaml
index bd5be1bb918..07dad5ebef3 100644
--- a/manifests/alp/istio-inject-configmap-1.1.0.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.0.yaml
@@ -178,7 +178,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.1.yaml b/manifests/alp/istio-inject-configmap-1.1.1.yaml
index 9068cbd2fc8..e310e6b448d 100644
--- a/manifests/alp/istio-inject-configmap-1.1.1.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.1.yaml
@@ -178,7 +178,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.10.yaml b/manifests/alp/istio-inject-configmap-1.1.10.yaml
index a2b0854a96f..3eee363716e 100644
--- a/manifests/alp/istio-inject-configmap-1.1.10.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.10.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.11.yaml b/manifests/alp/istio-inject-configmap-1.1.11.yaml
index fd566e8862b..73316dbf1d9 100644
--- a/manifests/alp/istio-inject-configmap-1.1.11.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.11.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.12.yaml b/manifests/alp/istio-inject-configmap-1.1.12.yaml
index 99c5f95e0b0..b11a419ca00 100644
--- a/manifests/alp/istio-inject-configmap-1.1.12.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.12.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.13.yaml b/manifests/alp/istio-inject-configmap-1.1.13.yaml
index 6c906a059ec..300464ab8fe 100644
--- a/manifests/alp/istio-inject-configmap-1.1.13.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.13.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.14.yaml b/manifests/alp/istio-inject-configmap-1.1.14.yaml
index 6c1d6b04a31..512f7339059 100644
--- a/manifests/alp/istio-inject-configmap-1.1.14.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.14.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.15.yaml b/manifests/alp/istio-inject-configmap-1.1.15.yaml
index 402507f0708..e6e382cd176 100644
--- a/manifests/alp/istio-inject-configmap-1.1.15.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.15.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.16.yaml b/manifests/alp/istio-inject-configmap-1.1.16.yaml
index c2b795f3eee..1630f2514ee 100644
--- a/manifests/alp/istio-inject-configmap-1.1.16.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.16.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.17.yaml b/manifests/alp/istio-inject-configmap-1.1.17.yaml
index bace46701c7..014f00c6784 100644
--- a/manifests/alp/istio-inject-configmap-1.1.17.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.17.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.2.yaml b/manifests/alp/istio-inject-configmap-1.1.2.yaml
index 688f9ade249..125d85e4bf5 100644
--- a/manifests/alp/istio-inject-configmap-1.1.2.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.2.yaml
@@ -178,7 +178,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.3.yaml b/manifests/alp/istio-inject-configmap-1.1.3.yaml
index accfa709d6f..99029a65078 100644
--- a/manifests/alp/istio-inject-configmap-1.1.3.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.3.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.4.yaml b/manifests/alp/istio-inject-configmap-1.1.4.yaml
index 504a77dbcba..13f6ac580ba 100644
--- a/manifests/alp/istio-inject-configmap-1.1.4.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.4.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.5.yaml b/manifests/alp/istio-inject-configmap-1.1.5.yaml
index 157c83557c7..f099391887a 100644
--- a/manifests/alp/istio-inject-configmap-1.1.5.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.5.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.6.yaml b/manifests/alp/istio-inject-configmap-1.1.6.yaml
index e09eca5cff8..ba838d1908e 100644
--- a/manifests/alp/istio-inject-configmap-1.1.6.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.6.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.7.yaml b/manifests/alp/istio-inject-configmap-1.1.7.yaml
index 20b992d8334..625e44dfd08 100644
--- a/manifests/alp/istio-inject-configmap-1.1.7.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.7.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.8.yaml b/manifests/alp/istio-inject-configmap-1.1.8.yaml
index b20854660c4..6ecd8b39ca3 100644
--- a/manifests/alp/istio-inject-configmap-1.1.8.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.8.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.1.9.yaml b/manifests/alp/istio-inject-configmap-1.1.9.yaml
index 867bc6fe376..e810dae1f9a 100644
--- a/manifests/alp/istio-inject-configmap-1.1.9.yaml
+++ b/manifests/alp/istio-inject-configmap-1.1.9.yaml
@@ -180,7 +180,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.10.yaml b/manifests/alp/istio-inject-configmap-1.10.yaml
index f02c8675543..8c9a10b351a 100644
--- a/manifests/alp/istio-inject-configmap-1.10.yaml
+++ b/manifests/alp/istio-inject-configmap-1.10.yaml
@@ -433,7 +433,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
@@ -720,7 +720,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.15.yaml b/manifests/alp/istio-inject-configmap-1.15.yaml
index 5a8927e9a6e..8a7cc0c8cb5 100644
--- a/manifests/alp/istio-inject-configmap-1.15.yaml
+++ b/manifests/alp/istio-inject-configmap-1.15.yaml
@@ -434,7 +434,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
@@ -719,7 +719,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.0.yaml b/manifests/alp/istio-inject-configmap-1.2.0.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.0.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.0.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.1.yaml b/manifests/alp/istio-inject-configmap-1.2.1.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.1.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.1.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.2.yaml b/manifests/alp/istio-inject-configmap-1.2.2.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.2.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.2.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.3.yaml b/manifests/alp/istio-inject-configmap-1.2.3.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.3.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.3.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.4.yaml b/manifests/alp/istio-inject-configmap-1.2.4.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.4.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.4.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.5.yaml b/manifests/alp/istio-inject-configmap-1.2.5.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.5.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.5.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.6.yaml b/manifests/alp/istio-inject-configmap-1.2.6.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.6.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.6.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.7.yaml b/manifests/alp/istio-inject-configmap-1.2.7.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.7.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.7.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.8.yaml b/manifests/alp/istio-inject-configmap-1.2.8.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.8.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.8.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.2.9.yaml b/manifests/alp/istio-inject-configmap-1.2.9.yaml
index 02ebb7e7900..c2477e48e4d 100644
--- a/manifests/alp/istio-inject-configmap-1.2.9.yaml
+++ b/manifests/alp/istio-inject-configmap-1.2.9.yaml
@@ -301,7 +301,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.0.yaml b/manifests/alp/istio-inject-configmap-1.3.0.yaml
index 4f0d76a89b5..34dbdf7a497 100644
--- a/manifests/alp/istio-inject-configmap-1.3.0.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.0.yaml
@@ -327,7 +327,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.1.yaml b/manifests/alp/istio-inject-configmap-1.3.1.yaml
index ca81a4b9678..3d10292600d 100644
--- a/manifests/alp/istio-inject-configmap-1.3.1.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.1.yaml
@@ -333,7 +333,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.2.yaml b/manifests/alp/istio-inject-configmap-1.3.2.yaml
index ca81a4b9678..3d10292600d 100644
--- a/manifests/alp/istio-inject-configmap-1.3.2.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.2.yaml
@@ -333,7 +333,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.3.yaml b/manifests/alp/istio-inject-configmap-1.3.3.yaml
index ca81a4b9678..3d10292600d 100644
--- a/manifests/alp/istio-inject-configmap-1.3.3.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.3.yaml
@@ -333,7 +333,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.4.yaml b/manifests/alp/istio-inject-configmap-1.3.4.yaml
index ca81a4b9678..3d10292600d 100644
--- a/manifests/alp/istio-inject-configmap-1.3.4.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.4.yaml
@@ -333,7 +333,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.3.5.yaml b/manifests/alp/istio-inject-configmap-1.3.5.yaml
index ca81a4b9678..3d10292600d 100644
--- a/manifests/alp/istio-inject-configmap-1.3.5.yaml
+++ b/manifests/alp/istio-inject-configmap-1.3.5.yaml
@@ -333,7 +333,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.4.0.yaml b/manifests/alp/istio-inject-configmap-1.4.0.yaml
index 8e7fca11b17..ec2ed78b298 100644
--- a/manifests/alp/istio-inject-configmap-1.4.0.yaml
+++ b/manifests/alp/istio-inject-configmap-1.4.0.yaml
@@ -351,7 +351,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.4.1.yaml b/manifests/alp/istio-inject-configmap-1.4.1.yaml
index 8e7fca11b17..ec2ed78b298 100644
--- a/manifests/alp/istio-inject-configmap-1.4.1.yaml
+++ b/manifests/alp/istio-inject-configmap-1.4.1.yaml
@@ -351,7 +351,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.4.2.yaml b/manifests/alp/istio-inject-configmap-1.4.2.yaml
index 8e7fca11b17..ec2ed78b298 100644
--- a/manifests/alp/istio-inject-configmap-1.4.2.yaml
+++ b/manifests/alp/istio-inject-configmap-1.4.2.yaml
@@ -351,7 +351,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.6.yaml b/manifests/alp/istio-inject-configmap-1.6.yaml
index ce2786a0c3e..19d10988af0 100644
--- a/manifests/alp/istio-inject-configmap-1.6.yaml
+++ b/manifests/alp/istio-inject-configmap-1.6.yaml
@@ -363,7 +363,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.7.yaml b/manifests/alp/istio-inject-configmap-1.7.yaml
index 6dbb2b3dbe3..528f4f75758 100644
--- a/manifests/alp/istio-inject-configmap-1.7.yaml
+++ b/manifests/alp/istio-inject-configmap-1.7.yaml
@@ -369,7 +369,7 @@ data:
         - mountPath: /var/run/dikastes
           name: dikastes-sock
       - name: dikastes
-        image: calico/dikastes:v3.26.2
+        image: calico/dikastes:v3.26.3
         args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/alp/istio-inject-configmap-1.9.yaml b/manifests/alp/istio-inject-configmap-1.9.yaml
index e5fa0564cd8..265778994ba 100644
--- a/manifests/alp/istio-inject-configmap-1.9.yaml
+++ b/manifests/alp/istio-inject-configmap-1.9.yaml
@@ -428,7 +428,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
@@ -714,7 +714,7 @@ data:
               name: dikastes-sock
 
           - name: dikastes
-            image: calico/dikastes:v3.26.2
+            image: calico/dikastes:v3.26.3
             args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
             securityContext:
               allowPrivilegeEscalation: false
diff --git a/manifests/apiserver.yaml b/manifests/apiserver.yaml
index 4f97810ca21..3cd776564be 100644
--- a/manifests/apiserver.yaml
+++ b/manifests/apiserver.yaml
@@ -77,7 +77,7 @@ spec:
         env:
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: calico/apiserver:v3.26.2
+        image: calico/apiserver:v3.26.3
         livenessProbe:
           httpGet:
             path: /version
diff --git a/manifests/calico-bpf.yaml b/manifests/calico-bpf.yaml
index 1544f8de562..fca0f8044d5 100644
--- a/manifests/calico-bpf.yaml
+++ b/manifests/calico-bpf.yaml
@@ -4644,7 +4644,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -4683,7 +4683,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4737,7 +4737,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4763,7 +4763,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4994,7 +4994,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/manifests/calico-etcd.yaml b/manifests/calico-etcd.yaml
index 8b1d1d36a2e..98183aa73c2 100644
--- a/manifests/calico-etcd.yaml
+++ b/manifests/calico-etcd.yaml
@@ -302,7 +302,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -348,7 +348,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -374,7 +374,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -614,7 +614,7 @@ spec:
       hostNetwork: true
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # The location of the etcd cluster.
diff --git a/manifests/calico-policy-only.yaml b/manifests/calico-policy-only.yaml
index c10f64ef5f5..938c5a310d1 100644
--- a/manifests/calico-policy-only.yaml
+++ b/manifests/calico-policy-only.yaml
@@ -4625,7 +4625,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4662,7 +4662,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4688,7 +4688,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4876,7 +4876,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
@@ -4965,7 +4965,7 @@ spec:
       securityContext:
         fsGroup: 65534
       containers:
-      - image: docker.io/calico/typha:v3.26.2
+      - image: docker.io/calico/typha:v3.26.3
         imagePullPolicy: IfNotPresent
         name: calico-typha
         ports:
diff --git a/manifests/calico-typha.yaml b/manifests/calico-typha.yaml
index 893e19ace4b..24a126ae648 100644
--- a/manifests/calico-typha.yaml
+++ b/manifests/calico-typha.yaml
@@ -4675,7 +4675,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -4703,7 +4703,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4746,7 +4746,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4772,7 +4772,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4995,7 +4995,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
@@ -5084,7 +5084,7 @@ spec:
       securityContext:
         fsGroup: 65534
       containers:
-      - image: docker.io/calico/typha:v3.26.2
+      - image: docker.io/calico/typha:v3.26.3
         imagePullPolicy: IfNotPresent
         name: calico-typha
         ports:
diff --git a/manifests/calico-vxlan.yaml b/manifests/calico-vxlan.yaml
index cfd5c4177b6..6d904b587c2 100644
--- a/manifests/calico-vxlan.yaml
+++ b/manifests/calico-vxlan.yaml
@@ -4639,7 +4639,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -4667,7 +4667,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4710,7 +4710,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4736,7 +4736,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4951,7 +4951,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/manifests/calico-windows-bgp.yaml b/manifests/calico-windows-bgp.yaml
index 04ced9b3f41..50e4335fe46 100644
--- a/manifests/calico-windows-bgp.yaml
+++ b/manifests/calico-windows-bgp.yaml
@@ -60,7 +60,7 @@ spec:
           operator: Exists
       initContainers:
       - name: install
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         args:
           - ".\\host-process-install.ps1"
         imagePullPolicy: Always
@@ -76,7 +76,7 @@ spec:
               fieldPath: spec.nodeName
       containers:
       - name: node
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         imagePullPolicy: Always
         args:
           - ".\\node\\node-service.ps1"
@@ -94,7 +94,7 @@ spec:
               apiVersion: v1
               fieldPath: spec.nodeName
       - name: felix
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         imagePullPolicy: Always
         args:
         - ".\\felix\\felix-service.ps1"
@@ -128,7 +128,7 @@ spec:
           periodSeconds: 10
           timeoutSeconds: 10
       - name: confd
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         imagePullPolicy: Always
         args:
           - ".\\confd\\confd-service.ps1"
diff --git a/manifests/calico-windows-vxlan.yaml b/manifests/calico-windows-vxlan.yaml
index cecf4e108ce..64bfe2de8c8 100644
--- a/manifests/calico-windows-vxlan.yaml
+++ b/manifests/calico-windows-vxlan.yaml
@@ -60,7 +60,7 @@ spec:
           operator: Exists
       initContainers:
       - name: install
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         args:
           - ".\\host-process-install.ps1"
         imagePullPolicy: Always
@@ -76,7 +76,7 @@ spec:
               fieldPath: spec.nodeName
       containers:
       - name: node
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         imagePullPolicy: Always
         args:
           - ".\\node\\node-service.ps1"
@@ -94,7 +94,7 @@ spec:
               apiVersion: v1
               fieldPath: spec.nodeName
       - name: felix
-        image: calico/windows:v3.26.2
+        image: calico/windows:v3.26.3
         imagePullPolicy: Always
         args:
         - ".\\felix\\felix-service.ps1"
diff --git a/manifests/calico.yaml b/manifests/calico.yaml
index e44c48b50d7..ca55d391902 100644
--- a/manifests/calico.yaml
+++ b/manifests/calico.yaml
@@ -4639,7 +4639,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -4667,7 +4667,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4710,7 +4710,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4736,7 +4736,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4953,7 +4953,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/manifests/calicoctl-etcd.yaml b/manifests/calicoctl-etcd.yaml
index 672c7973882..0b000f734e2 100644
--- a/manifests/calicoctl-etcd.yaml
+++ b/manifests/calicoctl-etcd.yaml
@@ -1,7 +1,7 @@
 # Calico Version master
 # https://projectcalico.docs.tigera.io/releases#master
 # This manifest includes the following component versions:
-#   calico/ctl:v3.26.2
+#   calico/ctl:v3.26.3
 
 apiVersion: v1
 kind: Pod
@@ -14,7 +14,7 @@ spec:
   hostNetwork: true
   containers:
   - name: calicoctl
-    image: calico/ctl:v3.26.2
+    image: calico/ctl:v3.26.3
     command:
       - /calicoctl
     args:
diff --git a/manifests/calicoctl.yaml b/manifests/calicoctl.yaml
index eb244f7a8ff..f7fc8a13853 100644
--- a/manifests/calicoctl.yaml
+++ b/manifests/calicoctl.yaml
@@ -1,7 +1,7 @@
 # Calico Version master
 # https://projectcalico.docs.tigera.io/releases#master
 # This manifest includes the following component versions:
-#   calico/ctl:v3.26.2
+#   calico/ctl:v3.26.3
 
 apiVersion: v1
 kind: ServiceAccount
@@ -23,7 +23,7 @@ spec:
   serviceAccountName: calicoctl
   containers:
   - name: calicoctl
-    image: calico/ctl:v3.26.2
+    image: calico/ctl:v3.26.3
     command:
       - /calicoctl
     args:
diff --git a/manifests/canal-etcd.yaml b/manifests/canal-etcd.yaml
index 555bfdbace6..dae77f032fe 100644
--- a/manifests/canal-etcd.yaml
+++ b/manifests/canal-etcd.yaml
@@ -382,7 +382,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -452,7 +452,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -478,7 +478,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -774,7 +774,7 @@ spec:
       hostNetwork: true
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # The location of the etcd cluster.
diff --git a/manifests/canal.yaml b/manifests/canal.yaml
index 6670a584510..4b82acee177 100644
--- a/manifests/canal.yaml
+++ b/manifests/canal.yaml
@@ -4648,7 +4648,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4697,7 +4697,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4723,7 +4723,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4951,7 +4951,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/manifests/csi-driver.yaml b/manifests/csi-driver.yaml
index eeef60e5195..da53d1135f3 100644
--- a/manifests/csi-driver.yaml
+++ b/manifests/csi-driver.yaml
@@ -50,7 +50,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: calico-csi
-        image: calico/csi:v3.26.2
+        image: calico/csi:v3.26.3
         imagePullPolicy: IfNotPresent
         args:
         - --nodeid=$(KUBE_NODE_NAME)
@@ -75,7 +75,7 @@ spec:
           mountPath: /var/lib/kubelet/
           mountPropagation: "Bidirectional"
       - name: csi-node-driver-registrar
-        image: calico/node-driver-registrar:v3.26.2
+        image: calico/node-driver-registrar:v3.26.3
         imagePullPolicy: IfNotPresent
         args:
         - --v=5
diff --git a/manifests/flannel-migration/calico.yaml b/manifests/flannel-migration/calico.yaml
index 1dd6d6123c4..af8f68956f0 100644
--- a/manifests/flannel-migration/calico.yaml
+++ b/manifests/flannel-migration/calico.yaml
@@ -4641,7 +4641,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -4669,7 +4669,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.26.2
+          image: docker.io/calico/cni:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -4712,7 +4712,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -4738,7 +4738,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.26.2
+          image: docker.io/calico/node:v3.26.3
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -4953,7 +4953,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.26.2
+          image: docker.io/calico/kube-controllers:v3.26.3
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/manifests/ocp/02-tigera-operator.yaml b/manifests/ocp/02-tigera-operator.yaml
index b0811393ad8..d7038498bd4 100644
--- a/manifests/ocp/02-tigera-operator.yaml
+++ b/manifests/ocp/02-tigera-operator.yaml
@@ -29,7 +29,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: tigera-operator
-          image: quay.io/tigera/operator:v1.30.6
+          image: quay.io/tigera/operator:v1.30.7
           imagePullPolicy: IfNotPresent
           command:
             - operator
@@ -47,7 +47,7 @@ spec:
             - name: OPERATOR_NAME
               value: "tigera-operator"
             - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION
-              value: v1.30.6
+              value: v1.30.7
           envFrom:
             - configMapRef:
                 name: kubernetes-services-endpoint
@@ -66,7 +66,7 @@ spec:
             name: install-resources-script
       initContainers:
         - name: create-initial-resources
-          image: docker.io/calico/ctl:v3.26.2
+          image: docker.io/calico/ctl:v3.26.3
           env:
             - name: DATASTORE_TYPE
               value: kubernetes
diff --git a/manifests/tigera-operator.yaml b/manifests/tigera-operator.yaml
index 5055306352b..a905df5f7d2 100644
--- a/manifests/tigera-operator.yaml
+++ b/manifests/tigera-operator.yaml
@@ -21481,7 +21481,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: tigera-operator
-          image: quay.io/tigera/operator:v1.30.6
+          image: quay.io/tigera/operator:v1.30.7
           imagePullPolicy: IfNotPresent
           command:
             - operator
@@ -21499,7 +21499,7 @@ spec:
             - name: OPERATOR_NAME
               value: "tigera-operator"
             - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION
-              value: v1.30.6
+              value: v1.30.7
           envFrom:
             - configMapRef:
                 name: kubernetes-services-endpoint
diff --git a/release-notes/v3.26.3-release-notes.md b/release-notes/v3.26.3-release-notes.md
new file mode 100644
index 00000000000..1c3af978368
--- /dev/null
+++ b/release-notes/v3.26.3-release-notes.md
@@ -0,0 +1,6 @@
+05 Oct 2023
+
+
+#### Announcement
+
+This release fixes improperly tagged dependencies in v3.26.2 and should be used instead of v3.26.2. See the v3.26.2 release notes for more details on the bug fixes and changes.