diff --git a/pkg/constant/constant.go b/pkg/constant/constant.go
index 7c53347f46f9..e7264c286134 100644
--- a/pkg/constant/constant.go
+++ b/pkg/constant/constant.go
@@ -90,10 +90,10 @@ const (
 	CalicoCNIImage                        = "quay.io/k0sproject/calico-cni"
 	CalicoComponentImagesVersion          = "v3.29.6-0"
 	CalicoCNIWindowsImage                 = "docker.io/calico/cni-windows"
-	CalicoCNIWindowsImageVersion          = "v3.29.6"
+	CalicoCNIWindowsImageVersion          = "v3.31.2"
 	CalicoNodeImage                       = "quay.io/k0sproject/calico-node"
 	CalicoNodeWindowsImage                = "docker.io/calico/node-windows"
-	CalicoNodeWindowsImageVersion         = "v3.29.6"
+	CalicoNodeWindowsImageVersion         = "v3.31.2"
 	KubeControllerImage                   = "quay.io/k0sproject/calico-kube-controllers"
 	KubeRouterCNIImage                    = "quay.io/k0sproject/kube-router"
 	KubeRouterCNIImageVersion             = "v2.6.2-iptables1.8.11-0"
diff --git a/static/manifests/calico/DaemonSet/calico-node.yaml b/static/manifests/calico/DaemonSet/calico-node.yaml
index b0423b1a8b07..57665b79faa2 100644
--- a/static/manifests/calico/DaemonSet/calico-node.yaml
+++ b/static/manifests/calico/DaemonSet/calico-node.yaml
@@ -134,7 +134,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.29.3
+          image: docker.io/calico/node:v3.31.2
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts: