diff --git a/charts/chart_versions.yaml b/charts/chart_versions.yaml
index 9d7c2dcc65..251e7a8024 100644
--- a/charts/chart_versions.yaml
+++ b/charts/chart_versions.yaml
@@ -2,7 +2,7 @@ charts:
   - version: 1.14.400
     filename: /charts/rke2-cilium.yaml
     bootstrap: true
-  - version: v3.26.3-build2023110900
+  - version: v3.27.0-build2024020601
     filename: /charts/rke2-canal.yaml
     bootstrap: true
   - version: v3.26.300
diff --git a/scripts/build-images b/scripts/build-images
index d224767c69..e33c23ab94 100755
--- a/scripts/build-images
+++ b/scripts/build-images
@@ -29,8 +29,8 @@ xargs -n1 -t docker image pull --quiet << EOF >> build/images-core.txt
 EOF
 
 xargs -n1 -t docker image pull --quiet << EOF > build/images-canal.txt
-    ${REGISTRY}/rancher/hardened-calico:v3.26.3-build20231109
-    ${REGISTRY}/rancher/hardened-flannel:v0.23.0-build20231109
+    ${REGISTRY}/rancher/hardened-calico:v3.27.0-build20240206
+    ${REGISTRY}/rancher/hardened-flannel:v0.24.2-build20240122
 EOF
 
 if [ "${GOARCH}" != "s390x" ]; then
diff --git a/scripts/validate b/scripts/validate
index 5f46593c8b..2936cd2681 100755
--- a/scripts/validate
+++ b/scripts/validate
@@ -22,7 +22,7 @@ function check_win_binaries() {
     #fi
 
     CALICO_WINDOWS_VERSION=$(grep 'CALICO_VERSION=' Dockerfile.windows | cut -d '=' -f 2- | grep -oE "v([0-9]+)\.([0-9]+)")
-    CALICO_LINUX_VERSION=$(yq '.charts[] | select(.filename == "/charts/rke2-canal.yaml").version' charts/chart_versions.yaml | cut -d ',' -f 1- | grep -oE "v([0-9]+)\.([0-9]+)")
+    CALICO_LINUX_VERSION=$(yq '.charts[] | select(.filename == "/charts/rke2-calico.yaml").version' charts/chart_versions.yaml | cut -d ',' -f 1- | grep -oE "v([0-9]+)\.([0-9]+)")
     if [ ! "$CALICO_WINDOWS_VERSION" = "$CALICO_LINUX_VERSION" ]; then
         fatal "Calico windows binary version [$CALICO_WINDOWS_VERSION] does not match Calico chart version [$CALICO_LINUX_VERSION]"
     fi