diff --git a/kube/deploy/core/system-upgrade-controller/app/hr.yaml b/kube/deploy/core/system-upgrade-controller/app/hr.yaml
index 0e8e0ef51e..150db6d48e 100644
--- a/kube/deploy/core/system-upgrade-controller/app/hr.yaml
+++ b/kube/deploy/core/system-upgrade-controller/app/hr.yaml
@@ -32,7 +32,7 @@ spec:
               SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
               SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
               SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
-              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.29.2@sha256:ac66c804f411269a1caa8cc907447fcd00a4476cfb627a4756845c85e685a671
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.3@sha256:f5735dae787c62a225536142b5eb0fbfd5515f7a80fcf2b3a5035401b681d1db
               SYSTEM_UPGRADE_JOB_PRIVILEGED: true
               SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
               SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
diff --git a/kube/deploy/core/system-upgrade-controller/plans/talos/app/k8s.yaml b/kube/deploy/core/system-upgrade-controller/plans/talos/app/k8s.yaml
index c44a80bede..b64481ccb8 100644
--- a/kube/deploy/core/system-upgrade-controller/plans/talos/app/k8s.yaml
+++ b/kube/deploy/core/system-upgrade-controller/plans/talos/app/k8s.yaml
@@ -27,7 +27,7 @@ spec:
       operator: Exists
       effect: NoSchedule
   prepare: &prepare
-    image: "registry.k8s.io/kubectl:v1.29.2@sha256:ac66c804f411269a1caa8cc907447fcd00a4476cfb627a4756845c85e685a671"
+    image: "registry.k8s.io/kubectl:v1.31.3@sha256:f5735dae787c62a225536142b5eb0fbfd5515f7a80fcf2b3a5035401b681d1db"
     args: # if Ceph is completely healthy, surely k8s is healthy, right?
       - "wait"
       - "--timeout=300s"
diff --git a/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml b/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
index 4358ce4b5e..967ee18933 100644
--- a/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
+++ b/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
@@ -21,7 +21,7 @@ spec:
         operator: NotIn
         values: [*v]
   prepare: &prepare
-    image: "registry.k8s.io/kubectl:v1.29.2@sha256:ac66c804f411269a1caa8cc907447fcd00a4476cfb627a4756845c85e685a671"
+    image: "registry.k8s.io/kubectl:v1.31.3@sha256:f5735dae787c62a225536142b5eb0fbfd5515f7a80fcf2b3a5035401b681d1db"
     args: # if Ceph is completely healthy, surely k8s is healthy, right?
       - "wait"
       - "--timeout=3600s"