diff --git a/static/calico-cloud/llms-full.txt b/static/calico-cloud/llms-full.txt
index 57da0d4565..fd2919965f 100644
--- a/static/calico-cloud/llms-full.txt
+++ b/static/calico-cloud/llms-full.txt
@@ -1146,8 +1146,9 @@ The Calico Cloud installer may be able to successfully connect
 
 ## Kubernetes versions[​](#kubernetes-versions)
 
-To install Calico Cloud v22.4.0, your Kubernetes distribution must be based on one of the following Kubernetes versions:
+To install Calico Cloud v22.5.0, your Kubernetes distribution must be based on one of the following Kubernetes versions:
 
+- Kubernetes 1.35
 - Kubernetes 1.34
 - Kubernetes 1.33
 - Kubernetes 1.32
@@ -1157,6 +1158,9 @@ Kubernetes compatibility for older versions of Calico Cloud
 
 | Calico Cloud version | Kubernetes versions |
 | -------------------- | ------------------- |
+| 22.4.0               | 1.31-1.34           |
+| 22.3.0               | 1.31-1.34           |
+| 22.2.0               | 1.31-1.34           |
 | 22.1.0               | 1.31-1.34           |
 | 22.0.1               | 1.31-1.33           |
 | 22.0.0               | 1.31-1.33           |
@@ -1388,7 +1392,7 @@ You can quickly connect a cluster to Calico Cloud by generating a unique kubectl
    Example of generated kubectl command with alternate manifest
 
    ```bash
-   kubectl apply -f https://installer.calicocloud.io/manifests/cc-operator/latest/deploy-with-container-security.yaml && curl -H "Authorization: Bearer ..." "https://www.calicocloud.io/api/managed-cluster/deploy-with-container-security.yaml?version=v22.4.0" | kubectl apply -f -
+   kubectl apply -f https://installer.calicocloud.io/manifests/cc-operator/latest/deploy-with-container-security.yaml && curl -H "Authorization: Bearer ..." "https://www.calicocloud.io/api/managed-cluster/deploy-with-container-security.yaml?version=v22.5.0" | kubectl apply -f -
    ```
 
 6. From a terminal, paste and run the command.
@@ -1598,7 +1602,7 @@ The following parameters are required for all Calico Cloud installations.
 | Parameter                      | Value  | Example        | Description                                             |
 | ------------------------------ | ------ | -------------- | ------------------------------------------------------- |
 | `installer.clusterName`        | string | `cluster-name` | The name given to your managed cluster in Calico Cloud. |
-| `installer.calicoCloudVersion` | string | `v22.4.0`      | The version of Calico Cloud you're installing.          |
+| `installer.calicoCloudVersion` | string | `v22.5.0`      | The version of Calico Cloud you're installing.          |
 
 Example from values.yaml with clusterName and calicoCloudVersion
 
@@ -1607,7 +1611,7 @@ installer:
 
  clusterName: example-cluster
 
- calicoCloudVersion: v22.4.0
+ calicoCloudVersion: v22.5.0
 ```
 
 ### Optional parameters for private registries[​](#optional-parameters-for-private-registries)
@@ -1693,7 +1697,7 @@ For many Calico Cloud components, you can specify node selectors, tolerations, a
 
     clusterName: example-cluster
 
-    calicoCloudVersion: v22.4.0
+    calicoCloudVersion: v22.5.0
    ```
 
 4. Add values for the optional parameters. For each resource you want to edit, uncomment the object, add a value, and save.
@@ -1808,7 +1812,7 @@ Add the required Calico Cloud images to a private registry.
 
 ### Select your version:
 
-v22.4.0 (latest)Helm command to add images for Calico Cloud v22.4.0 (latest)
+v22.5.0 (latest)Helm command to add images for Calico Cloud v22.5.0 (latest)
 
 ```javascript
 helm repo add calico-cloud https://installer.calicocloud.io/charts
@@ -1819,97 +1823,97 @@ IMAGES=(
 
 $INSTALLER_IMAGE
 
-quay.io/tigera/apiserver:v3.22.4
+quay.io/tigera/apiserver:v3.22.6
 
-quay.io/tigera/compliance-benchmarker:v3.22.4
+quay.io/tigera/compliance-benchmarker:v3.22.6
 
-quay.io/tigera/compliance-controller:v3.22.4
+quay.io/tigera/compliance-controller:v3.22.6
 
-quay.io/tigera/compliance-reporter:v3.22.4
+quay.io/tigera/compliance-reporter:v3.22.6
 
-quay.io/tigera/compliance-snapshotter:v3.22.4
+quay.io/tigera/compliance-snapshotter:v3.22.6
 
-quay.io/tigera/key-cert-provisioner:v3.22.4
+quay.io/tigera/key-cert-provisioner:v3.22.6
 
-quay.io/tigera/deep-packet-inspection:v3.22.4
+quay.io/tigera/deep-packet-inspection:v3.22.6
 
-quay.io/tigera/ui-apis:v3.22.4
+quay.io/tigera/ui-apis:v3.22.6
 
-quay.io/tigera/fluentd:v3.22.4
+quay.io/tigera/fluentd:v3.22.6
 
-quay.io/tigera/fluentd-windows:v3.22.4
+quay.io/tigera/fluentd-windows:v3.22.6
 
-quay.io/tigera/guardian:v3.22.4
+quay.io/tigera/guardian:v3.22.6
 
-quay.io/tigera/intrusion-detection-controller:v3.22.4
+quay.io/tigera/intrusion-detection-controller:v3.22.6
 
-quay.io/tigera/waf-http-filter:v3.22.4
+quay.io/tigera/waf-http-filter:v3.22.6
 
-quay.io/tigera/webhooks-processor:v3.22.4
+quay.io/tigera/webhooks-processor:v3.22.6
 
-quay.io/tigera/manager:v3.22.4
+quay.io/tigera/manager:v3.22.6
 
-quay.io/tigera/packetcapture:v3.22.4
+quay.io/tigera/packetcapture:v3.22.6
 
-quay.io/tigera/policy-recommendation:v3.22.4
+quay.io/tigera/policy-recommendation:v3.22.6
 
-quay.io/tigera/egress-gateway:v3.22.4
+quay.io/tigera/egress-gateway:v3.22.6
 
-quay.io/tigera/l7-collector:v3.22.4
+quay.io/tigera/l7-collector:v3.22.6
 
-quay.io/tigera/gateway-l7-collector:v3.22.4
+quay.io/tigera/gateway-l7-collector:v3.22.6
 
-quay.io/tigera/envoy:v3.22.4
+quay.io/tigera/envoy:v3.22.6
 
-quay.io/tigera/prometheus:v3.22.4
+quay.io/tigera/prometheus:v3.22.6
 
-quay.io/tigera/prometheus-service:v3.22.4
+quay.io/tigera/prometheus-service:v3.22.6
 
-quay.io/tigera/alertmanager:v3.22.4
+quay.io/tigera/alertmanager:v3.22.6
 
-quay.io/tigera/queryserver:v3.22.4
+quay.io/tigera/queryserver:v3.22.6
 
-quay.io/tigera/kube-controllers:v3.22.4
+quay.io/tigera/kube-controllers:v3.22.6
 
-quay.io/tigera/node:v3.22.4
+quay.io/tigera/node:v3.22.6
 
-quay.io/tigera/node-windows:v3.22.4
+quay.io/tigera/node-windows:v3.22.6
 
-quay.io/tigera/typha:v3.22.4
+quay.io/tigera/typha:v3.22.6
 
-quay.io/tigera/cni:v3.22.4
+quay.io/tigera/cni:v3.22.6
 
-quay.io/tigera/cni-windows:v3.22.4
+quay.io/tigera/cni-windows:v3.22.6
 
-quay.io/tigera/es-gateway:v3.22.4
+quay.io/tigera/es-gateway:v3.22.6
 
-quay.io/tigera/linseed:v3.22.4
+quay.io/tigera/linseed:v3.22.6
 
-quay.io/tigera/dikastes:v3.22.4
+quay.io/tigera/dikastes:v3.22.6
 
-quay.io/tigera/l7-admission-controller:v3.22.4
+quay.io/tigera/l7-admission-controller:v3.22.6
 
-quay.io/tigera/pod2daemon-flexvol:v3.22.4
+quay.io/tigera/pod2daemon-flexvol:v3.22.6
 
-quay.io/tigera/csi:v3.22.4
+quay.io/tigera/csi:v3.22.6
 
-quay.io/tigera/node-driver-registrar:v3.22.4
+quay.io/tigera/node-driver-registrar:v3.22.6
 
-quay.io/tigera/envoy-gateway:v3.22.4
+quay.io/tigera/envoy-gateway:v3.22.6
 
-quay.io/tigera/envoy-proxy:v3.22.4
+quay.io/tigera/envoy-proxy:v3.22.6
 
-quay.io/tigera/envoy-ratelimit:v3.22.4
+quay.io/tigera/envoy-ratelimit:v3.22.6
 
-quay.io/tigera/istio-pilot:v3.22.4
+quay.io/tigera/istio-pilot:v3.22.6
 
-quay.io/tigera/istio-install-cni:v3.22.4
+quay.io/tigera/istio-install-cni:v3.22.6
 
-quay.io/tigera/istio-ztunnel:v3.22.4
+quay.io/tigera/istio-ztunnel:v3.22.6
 
-quay.io/tigera/istio-proxyv2:v3.22.4
+quay.io/tigera/istio-proxyv2:v3.22.6
 
-quay.io/tigera/operator:v1.40.10
+quay.io/tigera/operator:v1.40.12
 
 quay.io/tigera/image-assurance-admission-controller:v1.22.9
 
@@ -1923,13 +1927,13 @@ quay.io/tigera/runtime-security-operator:v1.23.2
 
 quay.io/tigera/skimble:v1.23.2
 
-quay.io/tigera/cc-core:v0.3.5
+quay.io/tigera/cc-core:v0.3.6
 
-quay.io/tigera/prometheus-operator:v3.22.4
+quay.io/tigera/prometheus-operator:v3.22.6
 
-quay.io/tigera/prometheus-config-reloader:v3.22.4
+quay.io/tigera/prometheus-config-reloader:v3.22.6
 
-quay.io/tigera/cc-cni-config-scanner:v0.7.1
+quay.io/tigera/cc-cni-config-scanner:v0.7.2
 
 )
 ```
@@ -3257,7 +3261,7 @@ To upgrade a managed cluster to the latest version of Calico Cloud:
    Example of generated kubectl command with alternate manifest
 
    ```bash
-   kubectl apply -f https://installer.calicocloud.io/manifests/cc-operator/latest/deploy-with-container-security.yaml && curl -H "Authorization: Bearer ..." "https://www.calicocloud.io/api/managed-cluster/deploy-with-container-security.yaml?version=v22.4.0" | kubectl apply -f -
+   kubectl apply -f https://installer.calicocloud.io/manifests/cc-operator/latest/deploy-with-container-security.yaml && curl -H "Authorization: Bearer ..." "https://www.calicocloud.io/api/managed-cluster/deploy-with-container-security.yaml?version=v22.5.0" | kubectl apply -f -
    ```
 
 5. From a terminal, paste and run the command. The cluster's status under **Connection Status** changes to **Disconnected: Installing**. When the upgrade is complete, the status changes to **Connected**.
@@ -13249,7 +13253,7 @@ The basic workflow is:
 
 ### Create a config map with FortiGate and FortiManager information[​](#create-a-config-map-with-fortigate-and-fortimanager-information)
 
-1. In the [FortiGate ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.4/manifests/fortinet-device-configmap.yaml), add your FortiGate firewall information in the data section, `tigera.firewall.fortigate`.
+1. In the [FortiGate ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml), add your FortiGate firewall information in the data section, `tigera.firewall.fortigate`.
 
    Where:
 
@@ -13289,7 +13293,7 @@ The basic workflow is:
     key: apikey-fortigate-east2
    ```
 
-2. In the [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.4/manifests/fortinet-device-configmap.yaml), add your FortiManager information in the data section, `tigera.firewall.fortimgr`.
+2. In the [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml), add your FortiManager information in the data section, `tigera.firewall.fortimgr`.
 
    Where:
 
@@ -13328,7 +13332,7 @@ The basic workflow is:
 1. Apply the manifest.
 
    ```text
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/fortinet-device-configmap.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml
    ```
 
 ### Install FortiGate ApiKey and FortiManager password as secrets[​](#install-fortigate-apikey-and-fortimanager-password-as-secrets)
@@ -13368,7 +13372,7 @@ The basic workflow is:
 2. Apply the manifest.
 
    ```text
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/fortinet.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet.yaml
    ```
 
 ## Verify the integration[​](#verify-the-integration)
@@ -13463,7 +13467,7 @@ Create a [Calico Cloud tier](https://docs.tigera.io/calico-cloud/network-policy/
     kubectl create namespace tigera-firewall-controller
    ```
 
-2. In this [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.4/manifests/fortimanager-device-configmap.yaml), add your FortiManager device information in the data section: `tigera.firewall.fortimanager-policies`. For example:
+2. In this [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager-device-configmap.yaml), add your FortiManager device information in the data section: `tigera.firewall.fortimanager-policies`. For example:
 
    ```yaml
     tigera.firewall.fortimanager-policies: |
@@ -13506,7 +13510,7 @@ Create a [Calico Cloud tier](https://docs.tigera.io/calico-cloud/network-policy/
 3. Apply the manifest.
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/fortimanager-device-configmap.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager-device-configmap.yaml
    ```
 
 ## Install FortiManager password as secrets[​](#install-fortimanager-password-as-secrets)
@@ -13538,7 +13542,7 @@ kubectl create secret generic fortimgr-east1 \
 2. Apply the manifest.
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/fortimanager.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager.yaml
    ```
 
 ## Verify the integration[​](#verify-the-integration)
@@ -18163,7 +18167,7 @@ In this section we will look at how to add Tor and VPN feeds to Calico Cloud. In
    <!-- -->
 
    ```shell
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/threatdef/vpn-feed.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/threatdef/vpn-feed.yaml
    ```
 
    <!-- -->
@@ -18173,7 +18177,7 @@ In this section we will look at how to add Tor and VPN feeds to Calico Cloud. In
    <!-- -->
 
    ```shell
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/threatdef/tor-exit-feed.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/threatdef/tor-exit-feed.yaml
    ```
 
 2. Now, you can monitor the Dashboard for any malicious activity. The dashboard can be found at the Calico Cloud web console, go to "kibana" and then go to "Dashboard". Select "Tor-VPN Dashboard".
@@ -19433,13 +19437,13 @@ If the CLI scanner is part of your pipeline, scanning is done before runtime and
    **Linux**
 
    ```shell
-   curl -Lo tigera-scanner https://installer.calicocloud.io/tigera-scanner/v3.22.4-1/image-assurance-scanner-cli-linux-amd64
+   curl -Lo tigera-scanner https://installer.calicocloud.io/tigera-scanner/v3.22.6-0/image-assurance-scanner-cli-linux-amd64
    ```
 
    **macOS**
 
    ```shell
-   curl -Lo tigera-scanner https://installer.calicocloud.io/tigera-scanner/v3.22.4-1/image-assurance-scanner-cli-darwin-amd64
+   curl -Lo tigera-scanner https://installer.calicocloud.io/tigera-scanner/v3.22.6-0/image-assurance-scanner-cli-darwin-amd64
    ```
 
 2. Set the executable flag on the binary.
@@ -20066,7 +20070,7 @@ Container admission policies are custom Kubernetes resources that allow you to c
    You can either generate the TLS key and certificate yourself and move them to the current folder under the names `admission_controller_key.pem` and `admission_controller_cert.pem`, or use the following command to generate the pair:
 
    ```bash
-   export URL="https://installer.calicocloud.io/manifests/v3.22.4-1/manifests" && curl ${URL}/generate-open-ssl-key-cert-pair.sh | bash
+   export URL="https://installer.calicocloud.io/manifests/v3.22.6-0/manifests" && curl ${URL}/generate-open-ssl-key-cert-pair.sh | bash
    ```
 
    > **WARNING:** If you generate the key and certificate pair yourself, you must set the SANS to `tigera-image-assurance-admission-controller-service.tigera-image-assurance.svc`.
@@ -20967,7 +20971,7 @@ To run a report on demand:
 1. Download the pod template corresponding to your installation method.
 
    ```bash
-   curl https://downloads.tigera.io/ee/v3.22.4/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
+   curl https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
    ```
 
 2. Edit the template as follows:
@@ -21154,7 +21158,7 @@ To manually run a report:
    **Operator**
 
    ```bash
-   curl https://downloads.tigera.io/ee/v3.22.4/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
+   curl https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
    ```
 
 2. Edit the template as follows:
@@ -31093,13 +31097,13 @@ In this section, we will create a `kubeconfig` for each cluster. This `kubeconfi
 1. Create the ServiceAccount used by remote clusters for authentication:
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/federation-remote-sa.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/federation-remote-sa.yaml
    ```
 
 2. Create the ClusterRole and ClusterRoleBinding used by remote clusters for authorization:
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/federation-rem-rbac-kdd.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/federation-rem-rbac-kdd.yaml
    ```
 
 3. Create the ServiceAccount token that will be used in the `kubeconfig`:
@@ -32148,7 +32152,7 @@ The script migrates all applicable Calico Cloud components to open-source Projec
 
 ### Run the migration script[​](#run-the-migration-script)
 
-1. Download the script `curl -O https://installer.calicocloud.io/manifests/v3.22.4-1/downgrade.sh`.
+1. Download the script `curl -O https://installer.calicocloud.io/manifests/v3.22.6-0/downgrade.sh`.
 
 2. Make the script executable `chmod +x downgrade.sh`.
 
@@ -33810,7 +33814,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/elasticsearch-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/elasticsearch-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -33852,7 +33856,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/fluentd-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/fluentd-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -33894,7 +33898,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/calico-node-monitor-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/calico-node-monitor-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in $NAMESPACE.
@@ -33936,7 +33940,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/kube-controller-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/kube-controller-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -34020,7 +34024,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/felix-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/felix-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -34054,7 +34058,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.4/manifests/prometheus/typha-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/typha-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -62622,10 +62626,22 @@ Go to [Calico Cloud Status](https://status.calicocloud.io) to view the current s
 
 ### Calico Cloud release notes
 
-## May 19, 2026 (version 22.4.0)
+## June 22, 2026 (version 22.5.0)
 
 ### New features and enhancements[​](#new-features-and-enhancements)
 
+- Security Updates
+
+## June 9, 2026 (version 22.4.1)
+
+### New features and enhancements[​](#new-features-and-enhancements-1)
+
+- Adds support for Kubernetes 1.35.
+
+## May 19, 2026 (version 22.4.0)
+
+### New features and enhancements[​](#new-features-and-enhancements-2)
+
 #### Audit logs[​](#audit-logs)
 
 Calico Cloud now records audit events for user activity, including user sign-ins and group assignments. To view them in the web console, go to **Activity > Audit logs**.
@@ -62636,7 +62652,7 @@ Calico Cloud now records audit events for user activity, including user sign-ins
 
 ## April 7, 2026 (version 22.3.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-1)
+### New features and enhancements[​](#new-features-and-enhancements-3)
 
 #### Notifications for cluster connections[​](#notifications-for-cluster-connections)
 
@@ -62646,7 +62662,7 @@ To configure notifications, click the user icon  **> Notifications**.
 
 ## March 5, 2026 (version 22.2.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-2)
+### New features and enhancements[​](#new-features-and-enhancements-4)
 
 #### Istio Ambient Mode (tech preview)[​](#istio-ambient-mode-tech-preview)
 
@@ -62660,7 +62676,7 @@ For more information, see [Istio Ambient Mode](https://docs.tigera.io/calico-clo
 
 ## February 5, 2026 (web console update)
 
-### New features and enhancements[​](#new-features-and-enhancements-3)
+### New features and enhancements[​](#new-features-and-enhancements-5)
 
 #### Projects[​](#projects)
 
@@ -62682,7 +62698,7 @@ For more information, see [Create and assign custom roles](https://docs.tigera.i
 
 ## December 1, 2025 (version 22.1.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-4)
+### New features and enhancements[​](#new-features-and-enhancements-6)
 
 #### Dashboards are GA[​](#dashboards-are-ga)
 
@@ -62716,7 +62732,7 @@ This release adds support for Kubernetes 1.34.
 
 ## October 21, 2025 (web console update)
 
-### New features and enhancements[​](#new-features-and-enhancements-5)
+### New features and enhancements[​](#new-features-and-enhancements-7)
 
 - Improved search and user experience for the **Policies** page in the Calico Cloud Free Tier web console.
 
@@ -62732,7 +62748,7 @@ This release adds support for Kubernetes 1.34.
 
 ## September 8, 2025 (version 22.0.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-6)
+### New features and enhancements[​](#new-features-and-enhancements-8)
 
 #### Calico Ingress Gateway is GA[​](#calico-ingress-gateway-is-ga)
 
@@ -62780,7 +62796,7 @@ You can now install or upgrade to the following versions:
 
 ## August 5, 2025 (web console update)
 
-### New features and enhancements[​](#new-features-and-enhancements-7)
+### New features and enhancements[​](#new-features-and-enhancements-9)
 
 #### Predefined user roles for Entra ID groups[​](#predefined-user-roles-for-entra-id-groups)
 
@@ -62790,7 +62806,7 @@ For more information, see [Give role-based access to an Entra ID group](https:/
 
 ## June 23, 2025 (version 21.3.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-8)
+### New features and enhancements[​](#new-features-and-enhancements-10)
 
 #### Policy recommendations for Calico Cloud Free Tier[​](#policy-recommendations-for-calico-cloud-free-tier)
 
@@ -62845,7 +62861,7 @@ This release adds support for Kubernetes 1.32 and 1.33.
 
 ## May 5, 2025 (web console update)[​](#may-5-2025-web-console-update)
 
-### New features and enhancements[​](#new-features-and-enhancements-9)
+### New features and enhancements[​](#new-features-and-enhancements-11)
 
 #### Introducing Calico Cloud Free Tier[​](#introducing-calico-cloud-free-tier)
 
@@ -62865,7 +62881,7 @@ For more information about Calico Cloud Free Tier, see the [overview](https://do
 
 ## April 29, 2025 (version 21.2.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-10)
+### New features and enhancements[​](#new-features-and-enhancements-12)
 
 #### New pre-defined user roles[​](#new-pre-defined-user-roles)
 
@@ -62922,7 +62938,7 @@ For more information, see [Install Calico Cloud](https://docs.tigera.io/calico-c
 
 ## March 10, 2025 (version 21.0.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-11)
+### New features and enhancements[​](#new-features-and-enhancements-13)
 
 #### Custom dashboards (tech preview)[​](#custom-dashboards-tech-preview)
 
@@ -62964,7 +62980,7 @@ You can now install or upgrade to the following versions:
 
 ## February 11, 2025 (version 20.4.0)
 
-### New features and enhancements[​](#new-features-and-enhancements-12)
+### New features and enhancements[​](#new-features-and-enhancements-14)
 
 #### Exporting custom dashboard cards as CSV files[​](#exporting-custom-dashboard-cards-as-csv-files)
 
@@ -62980,7 +62996,7 @@ We added support for customizing the namespace labels on AKS clusters. By defaul
 
 ## January 9, 2025 (web console update)[​](#january-9-2025-web-console-update)
 
-### New features and enhancements[​](#new-features-and-enhancements-13)
+### New features and enhancements[​](#new-features-and-enhancements-15)
 
 #### Secure web console access with IP allowlists[​](#secure-web-console-access-with-ip-allowlists)
 
@@ -62997,7 +63013,7 @@ To configure an IP allowlist, [open a support ticket](https://tigeraio.my.site.c
 
 ## December 17, 2024 (web console update)[​](#december-17-2024-web-console-update)
 
-### New features and enhancements[​](#new-features-and-enhancements-14)
+### New features and enhancements[​](#new-features-and-enhancements-16)
 
 #### Dashboards (tech preview)[​](#dashboards-tech-preview)
 
@@ -63011,7 +63027,7 @@ For more information, see [Dashboards](https://docs.tigera.io/calico-cloud/obser
 
 > **INFO:** Because of a breaking change, this version is no longer available. Upgrade instead to [Calico Cloud 20.3.1](#20.3.1) or later.
 
-### New features and enhancements[​](#new-features-and-enhancements-15)
+### New features and enhancements[​](#new-features-and-enhancements-17)
 
 #### Image Assurance scan result management[​](#image-assurance-scan-result-management)
 
@@ -63059,7 +63075,7 @@ For more information see [Deploy a dual ToR cluster](https://docs.tigera.io/cali
 
 ## November 6, 2024 (version 20.2.0)[​](#november-6-2024-version-2020)
 
-### New features and enhancements[​](#new-features-and-enhancements-16)
+### New features and enhancements[​](#new-features-and-enhancements-18)
 
 #### Image Assurance scan result management[​](#image-assurance-scan-result-management-1)
 
@@ -63077,7 +63093,7 @@ In this release, you can more easily manage your Image Assurance scan results by
 
 ## October 1, 2024 (version 20.1.0)[​](#october-1-2024-version-2010)
 
-### New features and enhancements[​](#new-features-and-enhancements-17)
+### New features and enhancements[​](#new-features-and-enhancements-19)
 
 #### View and manage detectors for Container Threat Detection[​](#view-and-manage-detectors-for-container-threat-detection)
 
@@ -63107,7 +63123,7 @@ Image Assurance scans results now include information using the [Exploit Predict
 
 ## September 10, 2024 (version 20.0.0)[​](#september-10-2024-version-2000)
 
-### New features and enhancements[​](#new-features-and-enhancements-18)
+### New features and enhancements[​](#new-features-and-enhancements-20)
 
 #### Helm customizations[​](#helm-customizations)
 
@@ -63156,7 +63172,7 @@ For information about upgrading, see [Upgrade Calico Cloud](https://docs.tigera.
 
 ## July 9, 2024 (version 19.4.0)[​](#july-9-2024-version-1940)
 
-## New features and enhancements[​](#new-features-and-enhancements-19)
+## New features and enhancements[​](#new-features-and-enhancements-21)
 
 ### Bulk vulnerability exceptions for Image Assurance[​](#bulk-vulnerability-exceptions-for-image-assurance)
 
@@ -63171,7 +63187,7 @@ For more information, see [Exclude vulnerabilities from scan results](https://do
 
 ## June 11, 2024 (version 19.3.0)[​](#june-11-2024-version-1930)
 
-### New features and enhancements[​](#new-features-and-enhancements-20)
+### New features and enhancements[​](#new-features-and-enhancements-22)
 
 #### Jira integration for Image Assurance scan results[​](#jira-integration-for-image-assurance-scan-results)
 
@@ -63223,7 +63239,7 @@ Calico Cloud now provides the ability to set resource requests and limits for th
 
 ## April 30, 2024 (version 19.2.0)[​](#april-30-2024-version-1920)
 
-### New features and enhancements[​](#new-features-and-enhancements-21)
+### New features and enhancements[​](#new-features-and-enhancements-23)
 
 #### Automated installation with client credentials[​](#automated-installation-with-client-credentials)
 
@@ -63251,7 +63267,7 @@ For more information, see [Configure exclusions for image scanning](https://docs
 
 ## February 28, 2024 (version 19.0.0)[​](#february-28-2024-version-1900)
 
-### New features and enhancements[​](#new-features-and-enhancements-22)
+### New features and enhancements[​](#new-features-and-enhancements-24)
 
 #### Improved flow log filtering for destination domains[​](#improved-flow-log-filtering-for-destination-domains)
 
@@ -63280,7 +63296,7 @@ We've added the following improvements to the [Security events dashboard](https:
 
 ## January 31, 2024 (version 18.3.0)[​](#january-31-2024-version-1830)
 
-### New features and enhancements[​](#new-features-and-enhancements-23)
+### New features and enhancements[​](#new-features-and-enhancements-25)
 
 #### Assign custom roles to users automatically with Entra ID (formerly Azure AD) groups[​](#assign-custom-roles-to-users-automatically-with-entra-id-formerly-azure-ad-groups)
 
@@ -63324,7 +63340,7 @@ This release adds support for Kubernetes 1.28.
 
 ## December 21, 2023 (version 18.2.0)[​](#december-21-2023-version-1820)
 
-### New features and enhancements[​](#new-features-and-enhancements-24)
+### New features and enhancements[​](#new-features-and-enhancements-26)
 
 #### Security Posture Overview dashboard[​](#security-posture-overview-dashboard)
 
@@ -63344,7 +63360,7 @@ This release comes with support for connecting RKE2 clusters to Calico Cloud.
 
 ## November 29, 2023 (version 18.1.0)[​](#november-29-2023-version-1810)
 
-### New features and enhancements[​](#new-features-and-enhancements-25)
+### New features and enhancements[​](#new-features-and-enhancements-27)
 
 - We limited the permissions that are assigned to the Calico Cloud installer. Previously, the installer had cluster administrator privileges. Now the installer gets access only to what is required to install Calico Cloud.
 - **Image Assurance**. We added a filter that lets you sort your list of running images by severity rating.
@@ -63360,7 +63376,7 @@ This release comes with support for connecting RKE2 clusters to Calico Cloud.
 
 ## October 23, 2023 (version 18.0.0)[​](#october-23-2023-version-1800)
 
-### New features and enhancements[​](#new-features-and-enhancements-26)
+### New features and enhancements[​](#new-features-and-enhancements-28)
 
 #### Image Assurance registry scanner[​](#image-assurance-registry-scanner)
 
@@ -63419,7 +63435,7 @@ If you are experiencing any login issues, go to [https://calicocloud.io](https:/
 
 ## September 11, 2023 (version 17.1.1)[​](#september-11-2023-version-1711)
 
-### New features and enhancements[​](#new-features-and-enhancements-27)
+### New features and enhancements[​](#new-features-and-enhancements-29)
 
 - We redesigned a section of the Image Assurance UI to make it easier to see how vulnerable an image is.
 - We made improvements to the way Container Threat Detection processes large volumes of alerts.
@@ -63431,7 +63447,7 @@ If you are experiencing any login issues, go to [https://calicocloud.io](https:/
 
 ## September 5, 2023 (version 17.1.0)[​](#september-5-2023-version-1710)
 
-### New features and enhancements[​](#new-features-and-enhancements-28)
+### New features and enhancements[​](#new-features-and-enhancements-30)
 
 #### Improvements to software versioning for Calico Cloud installations on managed clusters[​](#improvements-to-software-versioning-for-calico-cloud-installations-on-managed-clusters)
 
@@ -63486,7 +63502,7 @@ This allows you to successfully reinstall or upgrade to Calico Cloud by followin
 
 ## August 21, 2023 (version 17.0.0)[​](#august-21-2023-version-1700)
 
-### New features and enhancements[​](#new-features-and-enhancements-29)
+### New features and enhancements[​](#new-features-and-enhancements-31)
 
 #### New policy recommendations engine for namespace isolation[​](#new-policy-recommendations-engine-for-namespace-isolation)
 
@@ -63525,7 +63541,7 @@ You can now create custom role-based access controls for two new roles: "Usage M
 
 ## June 6, 2023[​](#june-6-2023)
 
-### New features and enhancements[​](#new-features-and-enhancements-30)
+### New features and enhancements[​](#new-features-and-enhancements-32)
 
 #### In-cluster scanning with Image Assurance[​](#in-cluster-scanning-with-image-assurance)
 
@@ -63547,7 +63563,7 @@ Calico Cloud no longer supports installation on RKE or RKE2.
 
 ## April 11, 2023[​](#april-11-2023)
 
-## New features and enhancements[​](#new-features-and-enhancements-31)
+## New features and enhancements[​](#new-features-and-enhancements-33)
 
 ### Updates to Managed Clusters[​](#updates-to-managed-clusters)
 
@@ -63584,7 +63600,7 @@ Calico Cloud components were updated with more restrictive access for pods and c
 
 ## February 28, 2023[​](#february-28-2023)
 
-### New features and enhancements[​](#new-features-and-enhancements-32)
+### New features and enhancements[​](#new-features-and-enhancements-34)
 
 - Adds Bottlerocket support for Container Threat Detection.
 - Adds support for scanning multiple images with Image Assurance
@@ -63596,7 +63612,7 @@ Calico Cloud components were updated with more restrictive access for pods and c
 
 ## February 7, 2023[​](#february-7-2023)
 
-### New features and enhancements[​](#new-features-and-enhancements-33)
+### New features and enhancements[​](#new-features-and-enhancements-35)
 
 #### New and improved Dashboards[​](#new-and-improved-dashboards)
 
@@ -63632,7 +63648,7 @@ Calico Cloud has improved the probes to check readiness and outbound connectivit
 
 ## December 13, 2022[​](#december-13-2022)
 
-### New features and enhancements[​](#new-features-and-enhancements-34)
+### New features and enhancements[​](#new-features-and-enhancements-36)
 
 #### Search by CVE in Image Assurance[​](#search-by-cve-in-image-assurance)
 
diff --git a/static/calico-enterprise/llms-full.txt b/static/calico-enterprise/llms-full.txt
index ed4fb43ef6..b48c20e65b 100644
--- a/static/calico-enterprise/llms-full.txt
+++ b/static/calico-enterprise/llms-full.txt
@@ -629,7 +629,7 @@ Kubernetes version support aligns with [upstream Kubernetes](#kubernetes-kubeadm
 
 | Calico Enterprise version | Kubernetes/kubeadm versions | Calico Enterprise support                 |
 | ------------------------- | --------------------------- | ----------------------------------------- |
-| 3.22                      | 1.31 - 1.34                 | Calico Enterprise CNI with network policy |
+| 3.22                      | 1.31 - 1.35                 | Calico Enterprise CNI with network policy |
 | 3.21                      | 1.31 - 1.33                 | Calico Enterprise CNI with network policy |
 | 3.20                      | 1.29 - 1.31                 | Calico Enterprise CNI with network policy |
 
@@ -870,9 +870,9 @@ A Linux host that meets the following requirements.
 2. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
@@ -880,7 +880,7 @@ A Linux host that meets the following requirements.
    > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -898,13 +898,13 @@ A Linux host that meets the following requirements.
 5. Optional: Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    Monitor progress with the following command:
@@ -1139,11 +1139,11 @@ The geeky details of what you get:
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -1161,7 +1161,7 @@ The geeky details of what you get:
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -1185,13 +1185,13 @@ The geeky details of what you get:
 5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Install the Tigera custom resources. For more information on configuration options available, see<!-- --> [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -1265,7 +1265,7 @@ helm repo add tigera-ee https://downloads.tigera.io/ee/charts
 
 helm repo update
 
-helm pull tigera-ee/tigera-operator --version v3.22.5
+helm pull tigera-ee/tigera-operator --version v3.22.6
 ```
 
 ### Prepare the Installation Configuration[​](#prepare-the-installation-configuration)
@@ -1321,13 +1321,13 @@ To install a standard Calico Enterprise cluster with Helm:
 2. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install.
 
    ```bash
-   helm show values ./tigera-operator-v3.22.5-0.tgz >values.yaml
+   helm show values ./tigera-operator-v3.22.6-0.tgz >values.yaml
    ```
 
 3. Install the Tigera Operator and custom resource definitions using the Helm 3 chart:
 
    ```bash
-   helm install calico-enterprise tigera-operator-v3.22.5-0.tgz \
+   helm install calico-enterprise tigera-operator-v3.22.6-0.tgz \
 
    --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -1339,7 +1339,7 @@ To install a standard Calico Enterprise cluster with Helm:
    or if you created a `values.yaml` above:
 
    ```bash
-   helm install calico-enterprise tigera-operator-v3.22.5-0.tgz -f values.yaml \
+   helm install calico-enterprise tigera-operator-v3.22.6-0.tgz -f values.yaml \
 
    --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -1677,7 +1677,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift and add t
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
 
 cp calico/* manifests/
 ```
@@ -1747,7 +1747,7 @@ oc create -f </path/to/license.yaml>
 Apply the custom resources for enterprise features.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-enterprise-resources.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-enterprise-resources.yaml
 ```
 
 Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operator.
@@ -1773,7 +1773,7 @@ Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operato
 >  that you manage yourself.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
 ```
 
 You can now monitor progress with the following command:
@@ -1787,7 +1787,7 @@ When it shows all components with status `Available`, proceed to the next step.
 (Optional) Apply the full CRDs including descriptions.
 
 ```bash
-oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 ```
 
 ## Next steps[​](#next-steps)
@@ -1931,7 +1931,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift:
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
 ```
 
 ### Add an image pull secret[​](#add-an-image-pull-secret)
@@ -2011,7 +2011,7 @@ oc create -f </path/to/license.yaml>
 Apply the custom resources for enterprise features.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-enterprise-resources.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-enterprise-resources.yaml
 ```
 
 Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operator.
@@ -2037,7 +2037,7 @@ Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operato
 >  that you manage yourself.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
 ```
 
 You can now monitor progress with the following command:
@@ -2051,7 +2051,7 @@ When it shows all components with status `Available`, proceed to the next step.
 (Optional) Apply the full CRDs including descriptions.
 
 ```bash
-oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 ```
 
 ## Next steps[​](#next-steps)
@@ -2154,7 +2154,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift:
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
 ```
 
 ### Add an image pull secret[​](#add-an-image-pull-secret)
@@ -2234,7 +2234,7 @@ oc create -f </path/to/license.yaml>
 Apply the custom resources for enterprise features.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-enterprise-resources.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-enterprise-resources.yaml
 ```
 
 Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operator.
@@ -2260,7 +2260,7 @@ Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operato
 >  that you manage yourself.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
 ```
 
 You can now monitor progress with the following command:
@@ -2274,7 +2274,7 @@ When it shows all components with status `Available`, proceed to the next step.
 (Optional) Apply the full CRDs including descriptions.
 
 ```bash
-oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 ```
 
 ## Next steps[​](#next-steps)
@@ -2373,11 +2373,11 @@ Install Calico Enterprise on an AKS managed Kubernetes cluster.
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -2395,7 +2395,7 @@ Install Calico Enterprise on an AKS managed Kubernetes cluster.
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -2415,7 +2415,7 @@ Install Calico Enterprise on an AKS managed Kubernetes cluster.
 5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/aks/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/aks/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -2433,11 +2433,11 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to<!-- --
 2. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -2455,7 +2455,7 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to<!-- --
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -2475,7 +2475,7 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to<!-- --
 6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/aks/custom-resources-calico-cni.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/aks/custom-resources-calico-cni.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -2557,11 +2557,11 @@ Install Calico Enterprise on an EKS managed Kubernetes cluster.
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -2579,7 +2579,7 @@ Install Calico Enterprise on an EKS managed Kubernetes cluster.
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -2599,7 +2599,7 @@ Install Calico Enterprise on an EKS managed Kubernetes cluster.
 5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/eks/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/eks/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -2639,11 +2639,11 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
 2. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -2661,7 +2661,7 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -2681,7 +2681,7 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
 6. To configure <!-- -->Calico Enterprise<!-- --> for use with the Calico CNI plugin, we must create an `Installation` <!-- -->resource that has `spec.cni.type: Calico`. Install the<!-- --> `custom-resources-calico-cni.yaml` manifest, which includes this configuration. For more information on configuration options available in this manifest, see<!-- --> [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/eks/custom-resources-calico-cni.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/eks/custom-resources-calico-cni.yaml
    ```
 
 7. Finally, add nodes to the cluster.
@@ -2779,11 +2779,11 @@ The geeky details of what you get:
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -2801,7 +2801,7 @@ The geeky details of what you get:
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -2821,7 +2821,7 @@ The geeky details of what you get:
 5. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -3080,9 +3080,9 @@ The geeky details of what you get:
 3. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 4. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
@@ -3090,7 +3090,7 @@ The geeky details of what you get:
    > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 5. Install your pull secret.
@@ -3110,7 +3110,7 @@ The geeky details of what you get:
 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    Monitor progress with the following command:
@@ -3251,9 +3251,9 @@ In a new terminal, install the Calico Enterprise CNI.
 2. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl apply --server-side -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl apply --server-side -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -3275,13 +3275,13 @@ In a new terminal, install the Calico Enterprise CNI.
 5. Optional: Compliance and packet capture features are optional. To enable these features during installation, download and review the `custom-resources.yaml` file. Uncomment the necessary CRs and use this `custom-resources.yaml` for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 7. Restrict privileged container access in the `tigera-elasticsearch` namespace to only the necessary Tigera and Elasticsearch service accounts using an MKE admission policy annotation.
@@ -3383,9 +3383,9 @@ The geeky details of what you get:
 2. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator is used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
@@ -3393,7 +3393,7 @@ The geeky details of what you get:
    > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -3413,7 +3413,7 @@ The geeky details of what you get:
 6. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    Monitor progress with the following command:
@@ -3506,9 +3506,9 @@ The geeky details of what you get:
 2. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator is used to deploy Prometheus server and Alertmanager to monitor Calico Enterprise metrics.
@@ -3516,7 +3516,7 @@ The geeky details of what you get:
    > **SECONDARY:** If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -3536,7 +3536,7 @@ The geeky details of what you get:
 6. Install the Tigera custom resources. For more information on configuration options available, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/rancher/custom-resources-rke2.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/rancher/custom-resources-rke2.yaml
    ```
 
    Monitor progress with the following command:
@@ -3771,11 +3771,11 @@ The geeky details of what you get:
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -3793,7 +3793,7 @@ The geeky details of what you get:
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -3817,13 +3817,13 @@ The geeky details of what you get:
 5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Install the Tigera custom resources. For more information on configuration options available, see<!-- --> [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -4438,11 +4438,11 @@ To create a Charmed Kubernetes cluster without a CNI, you can customize your dep
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -4460,7 +4460,7 @@ To create a Charmed Kubernetes cluster without a CNI, you can customize your dep
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -4484,13 +4484,13 @@ To create a Charmed Kubernetes cluster without a CNI, you can customize your dep
 5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Install the Tigera custom resources. For more information on configuration options available, see<!-- --> [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    You can now monitor progress with the following command:
@@ -5319,15 +5319,15 @@ The following steps will outline the installation of Calico Enterprise networkin
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Download the necessary Installation custom resources.
 
    ```bash
-   wget https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   wget https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 3. Update the `calicoNetwork` options, ensuring that the correct pod CIDR is set. (Rancher uses `10.42.0.0/16` by default.) Below are sample installations for VXLAN and BGP networking using the default Rancher pod CIDR:
@@ -6620,361 +6620,361 @@ In order to install images from your private registry, you must first pull the i
 1. Use the following commands to pull the required <!-- -->Calico Enterprise<!-- --> images.
 
 2. ```bash
-   docker pull quay.io/tigera/operator:v1.40.11
+   docker pull quay.io/tigera/operator:v1.40.12
 
-   docker pull quay.io/tigera/alertmanager:v3.22.5
+   docker pull quay.io/tigera/alertmanager:v3.22.6
 
-   docker pull quay.io/tigera/apiserver:v3.22.5
+   docker pull quay.io/tigera/apiserver:v3.22.6
 
-   docker pull quay.io/tigera/calicoctl:v3.22.5
+   docker pull quay.io/tigera/calicoctl:v3.22.6
 
-   docker pull quay.io/tigera/calicoq:v3.22.5
+   docker pull quay.io/tigera/calicoq:v3.22.6
 
-   docker pull quay.io/tigera/compliance-benchmarker:v3.22.5
+   docker pull quay.io/tigera/compliance-benchmarker:v3.22.6
 
-   docker pull quay.io/tigera/compliance-controller:v3.22.5
+   docker pull quay.io/tigera/compliance-controller:v3.22.6
 
-   docker pull quay.io/tigera/compliance-reporter:v3.22.5
+   docker pull quay.io/tigera/compliance-reporter:v3.22.6
 
-   docker pull quay.io/tigera/compliance-server:v3.22.5
+   docker pull quay.io/tigera/compliance-server:v3.22.6
 
-   docker pull quay.io/tigera/compliance-snapshotter:v3.22.5
+   docker pull quay.io/tigera/compliance-snapshotter:v3.22.6
 
-   docker pull quay.io/tigera/csi:v3.22.5
+   docker pull quay.io/tigera/csi:v3.22.6
 
-   docker pull quay.io/tigera/node-driver-registrar:v3.22.5
+   docker pull quay.io/tigera/node-driver-registrar:v3.22.6
 
-   docker pull quay.io/tigera/deep-packet-inspection:v3.22.5
+   docker pull quay.io/tigera/deep-packet-inspection:v3.22.6
 
-   docker pull quay.io/tigera/dex:v3.22.5
+   docker pull quay.io/tigera/dex:v3.22.6
 
-   docker pull quay.io/tigera/dikastes:v3.22.5
+   docker pull quay.io/tigera/dikastes:v3.22.6
 
-   docker pull quay.io/tigera/egress-gateway:v3.22.5
+   docker pull quay.io/tigera/egress-gateway:v3.22.6
 
-   docker pull quay.io/tigera/intrusion-detection-job-installer:v3.22.5
+   docker pull quay.io/tigera/intrusion-detection-job-installer:v3.22.6
 
-   docker pull quay.io/tigera/elasticsearch:v3.22.5
+   docker pull quay.io/tigera/elasticsearch:v3.22.6
 
-   docker pull quay.io/tigera/elasticsearch-metrics:v3.22.5
+   docker pull quay.io/tigera/elasticsearch-metrics:v3.22.6
 
-   docker pull quay.io/tigera/eck-operator:v3.22.5
+   docker pull quay.io/tigera/eck-operator:v3.22.6
 
-   docker pull quay.io/tigera/envoy:v3.22.5
+   docker pull quay.io/tigera/envoy:v3.22.6
 
-   docker pull quay.io/tigera/es-gateway:v3.22.5
+   docker pull quay.io/tigera/es-gateway:v3.22.6
 
-   docker pull quay.io/tigera/firewall-integration:v3.22.5
+   docker pull quay.io/tigera/firewall-integration:v3.22.6
 
-   docker pull quay.io/tigera/pod2daemon-flexvol:v3.22.5
+   docker pull quay.io/tigera/pod2daemon-flexvol:v3.22.6
 
-   docker pull quay.io/tigera/fluentd:v3.22.5
+   docker pull quay.io/tigera/fluentd:v3.22.6
 
-   docker pull quay.io/tigera/envoy-gateway:v3.22.5
+   docker pull quay.io/tigera/envoy-gateway:v3.22.6
 
-   docker pull quay.io/tigera/envoy-proxy:v3.22.5
+   docker pull quay.io/tigera/envoy-proxy:v3.22.6
 
-   docker pull quay.io/tigera/envoy-ratelimit:v3.22.5
+   docker pull quay.io/tigera/envoy-ratelimit:v3.22.6
 
-   docker pull quay.io/tigera/gateway-l7-collector:v3.22.5
+   docker pull quay.io/tigera/gateway-l7-collector:v3.22.6
 
-   docker pull quay.io/tigera/guardian:v3.22.5
+   docker pull quay.io/tigera/guardian:v3.22.6
 
-   docker pull quay.io/tigera/ingress-collector:v3.22.5
+   docker pull quay.io/tigera/ingress-collector:v3.22.6
 
-   docker pull quay.io/tigera/intrusion-detection-controller:v3.22.5
+   docker pull quay.io/tigera/intrusion-detection-controller:v3.22.6
 
-   docker pull quay.io/tigera/istio-install-cni:v3.22.5
+   docker pull quay.io/tigera/istio-install-cni:v3.22.6
 
-   docker pull quay.io/tigera/istio-pilot:v3.22.5
+   docker pull quay.io/tigera/istio-pilot:v3.22.6
 
-   docker pull quay.io/tigera/istio-proxyv2:v3.22.5
+   docker pull quay.io/tigera/istio-proxyv2:v3.22.6
 
-   docker pull quay.io/tigera/istio-ztunnel:v3.22.5
+   docker pull quay.io/tigera/istio-ztunnel:v3.22.6
 
-   docker pull quay.io/tigera/key-cert-provisioner:v3.22.5
+   docker pull quay.io/tigera/key-cert-provisioner:v3.22.6
 
-   docker pull quay.io/tigera/kibana:v3.22.5
+   docker pull quay.io/tigera/kibana:v3.22.6
 
-   docker pull quay.io/tigera/kube-controllers:v3.22.5
+   docker pull quay.io/tigera/kube-controllers:v3.22.6
 
-   docker pull quay.io/tigera/l7-admission-controller:v3.22.5
+   docker pull quay.io/tigera/l7-admission-controller:v3.22.6
 
-   docker pull quay.io/tigera/l7-collector:v3.22.5
+   docker pull quay.io/tigera/l7-collector:v3.22.6
 
-   docker pull quay.io/tigera/license-agent:v3.22.5
+   docker pull quay.io/tigera/license-agent:v3.22.6
 
-   docker pull quay.io/tigera/linseed:v3.22.5
+   docker pull quay.io/tigera/linseed:v3.22.6
 
-   docker pull quay.io/tigera/manager:v3.22.5
+   docker pull quay.io/tigera/manager:v3.22.6
 
-   docker pull quay.io/tigera/node:v3.22.5
+   docker pull quay.io/tigera/node:v3.22.6
 
-   docker pull quay.io/tigera/packetcapture:v3.22.5
+   docker pull quay.io/tigera/packetcapture:v3.22.6
 
-   docker pull quay.io/tigera/policy-recommendation:v3.22.5
+   docker pull quay.io/tigera/policy-recommendation:v3.22.6
 
-   docker pull quay.io/tigera/prometheus:v3.22.5
+   docker pull quay.io/tigera/prometheus:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-config-reloader:v3.22.5
+   docker pull quay.io/tigera/prometheus-config-reloader:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-operator:v3.22.5
+   docker pull quay.io/tigera/prometheus-operator:v3.22.6
 
-   docker pull quay.io/tigera/queryserver:v3.22.5
+   docker pull quay.io/tigera/queryserver:v3.22.6
 
-   docker pull quay.io/tigera/cni:v3.22.5
+   docker pull quay.io/tigera/cni:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-service:v3.22.5
+   docker pull quay.io/tigera/prometheus-service:v3.22.6
 
-   docker pull quay.io/tigera/typha:v3.22.5
+   docker pull quay.io/tigera/typha:v3.22.6
 
-   docker pull quay.io/tigera/ui-apis:v3.22.5
+   docker pull quay.io/tigera/ui-apis:v3.22.6
 
-   docker pull quay.io/tigera/voltron:v3.22.5
+   docker pull quay.io/tigera/voltron:v3.22.6
 
-   docker pull quay.io/tigera/waf-http-filter:v3.22.5
+   docker pull quay.io/tigera/waf-http-filter:v3.22.6
 
-   docker pull quay.io/tigera/webhooks-processor:v3.22.5
+   docker pull quay.io/tigera/webhooks-processor:v3.22.6
    ```
 
    Retag the images with the name of your private registry `$PRIVATE_REGISTRY`.
 
    ```bash
-   docker tag quay.io/tigera/operator:v1.40.11 $PRIVATE_REGISTRY/tigera/operator:v1.40.11
+   docker tag quay.io/tigera/operator:v1.40.12 $PRIVATE_REGISTRY/tigera/operator:v1.40.12
 
-   docker tag quay.io/tigera/alertmanager:v3.22.5 $PRIVATE_REGISTRY/tigera/alertmanager:v3.22.5
+   docker tag quay.io/tigera/alertmanager:v3.22.6 $PRIVATE_REGISTRY/tigera/alertmanager:v3.22.6
 
-   docker tag quay.io/tigera/apiserver:v3.22.5 $PRIVATE_REGISTRY/tigera/apiserver:v3.22.5
+   docker tag quay.io/tigera/apiserver:v3.22.6 $PRIVATE_REGISTRY/tigera/apiserver:v3.22.6
 
-   docker tag quay.io/tigera/calicoctl:v3.22.5 $PRIVATE_REGISTRY/tigera/calicoctl:v3.22.5
+   docker tag quay.io/tigera/calicoctl:v3.22.6 $PRIVATE_REGISTRY/tigera/calicoctl:v3.22.6
 
-   docker tag quay.io/tigera/calicoq:v3.22.5 $PRIVATE_REGISTRY/tigera/calicoq:v3.22.5
+   docker tag quay.io/tigera/calicoq:v3.22.6 $PRIVATE_REGISTRY/tigera/calicoq:v3.22.6
 
-   docker tag quay.io/tigera/compliance-benchmarker:v3.22.5 $PRIVATE_REGISTRY/tigera/compliance-benchmarker:v3.22.5
+   docker tag quay.io/tigera/compliance-benchmarker:v3.22.6 $PRIVATE_REGISTRY/tigera/compliance-benchmarker:v3.22.6
 
-   docker tag quay.io/tigera/compliance-controller:v3.22.5 $PRIVATE_REGISTRY/tigera/compliance-controller:v3.22.5
+   docker tag quay.io/tigera/compliance-controller:v3.22.6 $PRIVATE_REGISTRY/tigera/compliance-controller:v3.22.6
 
-   docker tag quay.io/tigera/compliance-reporter:v3.22.5 $PRIVATE_REGISTRY/tigera/compliance-reporter:v3.22.5
+   docker tag quay.io/tigera/compliance-reporter:v3.22.6 $PRIVATE_REGISTRY/tigera/compliance-reporter:v3.22.6
 
-   docker tag quay.io/tigera/compliance-server:v3.22.5 $PRIVATE_REGISTRY/tigera/compliance-server:v3.22.5
+   docker tag quay.io/tigera/compliance-server:v3.22.6 $PRIVATE_REGISTRY/tigera/compliance-server:v3.22.6
 
-   docker tag quay.io/tigera/compliance-snapshotter:v3.22.5 $PRIVATE_REGISTRY/tigera/compliance-snapshotter:v3.22.5
+   docker tag quay.io/tigera/compliance-snapshotter:v3.22.6 $PRIVATE_REGISTRY/tigera/compliance-snapshotter:v3.22.6
 
-   docker tag quay.io/tigera/csi:v3.22.5 $PRIVATE_REGISTRY/tigera/csi:v3.22.5
+   docker tag quay.io/tigera/csi:v3.22.6 $PRIVATE_REGISTRY/tigera/csi:v3.22.6
 
-   docker tag quay.io/tigera/node-driver-registrar:v3.22.5 $PRIVATE_REGISTRY/tigera/node-driver-registrar:v3.22.5
+   docker tag quay.io/tigera/node-driver-registrar:v3.22.6 $PRIVATE_REGISTRY/tigera/node-driver-registrar:v3.22.6
 
-   docker tag quay.io/tigera/deep-packet-inspection:v3.22.5 $PRIVATE_REGISTRY/tigera/deep-packet-inspection:v3.22.5
+   docker tag quay.io/tigera/deep-packet-inspection:v3.22.6 $PRIVATE_REGISTRY/tigera/deep-packet-inspection:v3.22.6
 
-   docker tag quay.io/tigera/dex:v3.22.5 $PRIVATE_REGISTRY/tigera/dex:v3.22.5
+   docker tag quay.io/tigera/dex:v3.22.6 $PRIVATE_REGISTRY/tigera/dex:v3.22.6
 
-   docker tag quay.io/tigera/dikastes:v3.22.5 $PRIVATE_REGISTRY/tigera/dikastes:v3.22.5
+   docker tag quay.io/tigera/dikastes:v3.22.6 $PRIVATE_REGISTRY/tigera/dikastes:v3.22.6
 
-   docker tag quay.io/tigera/egress-gateway:v3.22.5 $PRIVATE_REGISTRY/tigera/egress-gateway:v3.22.5
+   docker tag quay.io/tigera/egress-gateway:v3.22.6 $PRIVATE_REGISTRY/tigera/egress-gateway:v3.22.6
 
-   docker tag quay.io/tigera/intrusion-detection-job-installer:v3.22.5 $PRIVATE_REGISTRY/tigera/intrusion-detection-job-installer:v3.22.5
+   docker tag quay.io/tigera/intrusion-detection-job-installer:v3.22.6 $PRIVATE_REGISTRY/tigera/intrusion-detection-job-installer:v3.22.6
 
-   docker tag quay.io/tigera/elasticsearch:v3.22.5 $PRIVATE_REGISTRY/tigera/elasticsearch:v3.22.5
+   docker tag quay.io/tigera/elasticsearch:v3.22.6 $PRIVATE_REGISTRY/tigera/elasticsearch:v3.22.6
 
-   docker tag quay.io/tigera/elasticsearch-metrics:v3.22.5 $PRIVATE_REGISTRY/tigera/elasticsearch-metrics:v3.22.5
+   docker tag quay.io/tigera/elasticsearch-metrics:v3.22.6 $PRIVATE_REGISTRY/tigera/elasticsearch-metrics:v3.22.6
 
-   docker tag quay.io/tigera/eck-operator:v3.22.5 $PRIVATE_REGISTRY/tigera/eck-operator:v3.22.5
+   docker tag quay.io/tigera/eck-operator:v3.22.6 $PRIVATE_REGISTRY/tigera/eck-operator:v3.22.6
 
-   docker tag quay.io/tigera/envoy:v3.22.5 $PRIVATE_REGISTRY/tigera/envoy:v3.22.5
+   docker tag quay.io/tigera/envoy:v3.22.6 $PRIVATE_REGISTRY/tigera/envoy:v3.22.6
 
-   docker tag quay.io/tigera/es-gateway:v3.22.5 $PRIVATE_REGISTRY/tigera/es-gateway:v3.22.5
+   docker tag quay.io/tigera/es-gateway:v3.22.6 $PRIVATE_REGISTRY/tigera/es-gateway:v3.22.6
 
-   docker tag quay.io/tigera/firewall-integration:v3.22.5 $PRIVATE_REGISTRY/tigera/firewall-integration:v3.22.5
+   docker tag quay.io/tigera/firewall-integration:v3.22.6 $PRIVATE_REGISTRY/tigera/firewall-integration:v3.22.6
 
-   docker tag quay.io/tigera/pod2daemon-flexvol:v3.22.5 $PRIVATE_REGISTRY/tigera/pod2daemon-flexvol:v3.22.5
+   docker tag quay.io/tigera/pod2daemon-flexvol:v3.22.6 $PRIVATE_REGISTRY/tigera/pod2daemon-flexvol:v3.22.6
 
-   docker tag quay.io/tigera/fluentd:v3.22.5 $PRIVATE_REGISTRY/tigera/fluentd:v3.22.5
+   docker tag quay.io/tigera/fluentd:v3.22.6 $PRIVATE_REGISTRY/tigera/fluentd:v3.22.6
 
-   docker tag quay.io/tigera/envoy-gateway:v3.22.5 $PRIVATE_REGISTRY/tigera/envoy-gateway:v3.22.5
+   docker tag quay.io/tigera/envoy-gateway:v3.22.6 $PRIVATE_REGISTRY/tigera/envoy-gateway:v3.22.6
 
-   docker tag quay.io/tigera/envoy-proxy:v3.22.5 $PRIVATE_REGISTRY/tigera/envoy-proxy:v3.22.5
+   docker tag quay.io/tigera/envoy-proxy:v3.22.6 $PRIVATE_REGISTRY/tigera/envoy-proxy:v3.22.6
 
-   docker tag quay.io/tigera/envoy-ratelimit:v3.22.5 $PRIVATE_REGISTRY/tigera/envoy-ratelimit:v3.22.5
+   docker tag quay.io/tigera/envoy-ratelimit:v3.22.6 $PRIVATE_REGISTRY/tigera/envoy-ratelimit:v3.22.6
 
-   docker tag quay.io/tigera/gateway-l7-collector:v3.22.5 $PRIVATE_REGISTRY/tigera/gateway-l7-collector:v3.22.5
+   docker tag quay.io/tigera/gateway-l7-collector:v3.22.6 $PRIVATE_REGISTRY/tigera/gateway-l7-collector:v3.22.6
 
-   docker tag quay.io/tigera/guardian:v3.22.5 $PRIVATE_REGISTRY/tigera/guardian:v3.22.5
+   docker tag quay.io/tigera/guardian:v3.22.6 $PRIVATE_REGISTRY/tigera/guardian:v3.22.6
 
-   docker tag quay.io/tigera/ingress-collector:v3.22.5 $PRIVATE_REGISTRY/tigera/ingress-collector:v3.22.5
+   docker tag quay.io/tigera/ingress-collector:v3.22.6 $PRIVATE_REGISTRY/tigera/ingress-collector:v3.22.6
 
-   docker tag quay.io/tigera/intrusion-detection-controller:v3.22.5 $PRIVATE_REGISTRY/tigera/intrusion-detection-controller:v3.22.5
+   docker tag quay.io/tigera/intrusion-detection-controller:v3.22.6 $PRIVATE_REGISTRY/tigera/intrusion-detection-controller:v3.22.6
 
-   docker tag quay.io/tigera/istio-install-cni:v3.22.5 $PRIVATE_REGISTRY/tigera/istio-install-cni:v3.22.5
+   docker tag quay.io/tigera/istio-install-cni:v3.22.6 $PRIVATE_REGISTRY/tigera/istio-install-cni:v3.22.6
 
-   docker tag quay.io/tigera/istio-pilot:v3.22.5 $PRIVATE_REGISTRY/tigera/istio-pilot:v3.22.5
+   docker tag quay.io/tigera/istio-pilot:v3.22.6 $PRIVATE_REGISTRY/tigera/istio-pilot:v3.22.6
 
-   docker tag quay.io/tigera/istio-proxyv2:v3.22.5 $PRIVATE_REGISTRY/tigera/istio-proxyv2:v3.22.5
+   docker tag quay.io/tigera/istio-proxyv2:v3.22.6 $PRIVATE_REGISTRY/tigera/istio-proxyv2:v3.22.6
 
-   docker tag quay.io/tigera/istio-ztunnel:v3.22.5 $PRIVATE_REGISTRY/tigera/istio-ztunnel:v3.22.5
+   docker tag quay.io/tigera/istio-ztunnel:v3.22.6 $PRIVATE_REGISTRY/tigera/istio-ztunnel:v3.22.6
 
-   docker tag quay.io/tigera/key-cert-provisioner:v3.22.5 $PRIVATE_REGISTRY/tigera/key-cert-provisioner:v3.22.5
+   docker tag quay.io/tigera/key-cert-provisioner:v3.22.6 $PRIVATE_REGISTRY/tigera/key-cert-provisioner:v3.22.6
 
-   docker tag quay.io/tigera/kibana:v3.22.5 $PRIVATE_REGISTRY/tigera/kibana:v3.22.5
+   docker tag quay.io/tigera/kibana:v3.22.6 $PRIVATE_REGISTRY/tigera/kibana:v3.22.6
 
-   docker tag quay.io/tigera/kube-controllers:v3.22.5 $PRIVATE_REGISTRY/tigera/kube-controllers:v3.22.5
+   docker tag quay.io/tigera/kube-controllers:v3.22.6 $PRIVATE_REGISTRY/tigera/kube-controllers:v3.22.6
 
-   docker tag quay.io/tigera/l7-admission-controller:v3.22.5 $PRIVATE_REGISTRY/tigera/l7-admission-controller:v3.22.5
+   docker tag quay.io/tigera/l7-admission-controller:v3.22.6 $PRIVATE_REGISTRY/tigera/l7-admission-controller:v3.22.6
 
-   docker tag quay.io/tigera/l7-collector:v3.22.5 $PRIVATE_REGISTRY/tigera/l7-collector:v3.22.5
+   docker tag quay.io/tigera/l7-collector:v3.22.6 $PRIVATE_REGISTRY/tigera/l7-collector:v3.22.6
 
-   docker tag quay.io/tigera/license-agent:v3.22.5 $PRIVATE_REGISTRY/tigera/license-agent:v3.22.5
+   docker tag quay.io/tigera/license-agent:v3.22.6 $PRIVATE_REGISTRY/tigera/license-agent:v3.22.6
 
-   docker tag quay.io/tigera/linseed:v3.22.5 $PRIVATE_REGISTRY/tigera/linseed:v3.22.5
+   docker tag quay.io/tigera/linseed:v3.22.6 $PRIVATE_REGISTRY/tigera/linseed:v3.22.6
 
-   docker tag quay.io/tigera/manager:v3.22.5 $PRIVATE_REGISTRY/tigera/manager:v3.22.5
+   docker tag quay.io/tigera/manager:v3.22.6 $PRIVATE_REGISTRY/tigera/manager:v3.22.6
 
-   docker tag quay.io/tigera/node:v3.22.5 $PRIVATE_REGISTRY/tigera/node:v3.22.5
+   docker tag quay.io/tigera/node:v3.22.6 $PRIVATE_REGISTRY/tigera/node:v3.22.6
 
-   docker tag quay.io/tigera/packetcapture:v3.22.5 $PRIVATE_REGISTRY/tigera/packetcapture:v3.22.5
+   docker tag quay.io/tigera/packetcapture:v3.22.6 $PRIVATE_REGISTRY/tigera/packetcapture:v3.22.6
 
-   docker tag quay.io/tigera/policy-recommendation:v3.22.5 $PRIVATE_REGISTRY/tigera/policy-recommendation:v3.22.5
+   docker tag quay.io/tigera/policy-recommendation:v3.22.6 $PRIVATE_REGISTRY/tigera/policy-recommendation:v3.22.6
 
-   docker tag quay.io/tigera/prometheus:v3.22.5 $PRIVATE_REGISTRY/tigera/prometheus:v3.22.5
+   docker tag quay.io/tigera/prometheus:v3.22.6 $PRIVATE_REGISTRY/tigera/prometheus:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-config-reloader:v3.22.5 $PRIVATE_REGISTRY/tigera/prometheus-config-reloader:v3.22.5
+   docker tag quay.io/tigera/prometheus-config-reloader:v3.22.6 $PRIVATE_REGISTRY/tigera/prometheus-config-reloader:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-operator:v3.22.5 $PRIVATE_REGISTRY/tigera/prometheus-operator:v3.22.5
+   docker tag quay.io/tigera/prometheus-operator:v3.22.6 $PRIVATE_REGISTRY/tigera/prometheus-operator:v3.22.6
 
-   docker tag quay.io/tigera/queryserver:v3.22.5 $PRIVATE_REGISTRY/tigera/queryserver:v3.22.5
+   docker tag quay.io/tigera/queryserver:v3.22.6 $PRIVATE_REGISTRY/tigera/queryserver:v3.22.6
 
-   docker tag quay.io/tigera/cni:v3.22.5 $PRIVATE_REGISTRY/tigera/cni:v3.22.5
+   docker tag quay.io/tigera/cni:v3.22.6 $PRIVATE_REGISTRY/tigera/cni:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-service:v3.22.5 $PRIVATE_REGISTRY/tigera/prometheus-service:v3.22.5
+   docker tag quay.io/tigera/prometheus-service:v3.22.6 $PRIVATE_REGISTRY/tigera/prometheus-service:v3.22.6
 
-   docker tag quay.io/tigera/typha:v3.22.5 $PRIVATE_REGISTRY/tigera/typha:v3.22.5
+   docker tag quay.io/tigera/typha:v3.22.6 $PRIVATE_REGISTRY/tigera/typha:v3.22.6
 
-   docker tag quay.io/tigera/ui-apis:v3.22.5 $PRIVATE_REGISTRY/tigera/ui-apis:v3.22.5
+   docker tag quay.io/tigera/ui-apis:v3.22.6 $PRIVATE_REGISTRY/tigera/ui-apis:v3.22.6
 
-   docker tag quay.io/tigera/voltron:v3.22.5 $PRIVATE_REGISTRY/tigera/voltron:v3.22.5
+   docker tag quay.io/tigera/voltron:v3.22.6 $PRIVATE_REGISTRY/tigera/voltron:v3.22.6
 
-   docker tag quay.io/tigera/waf-http-filter:v3.22.5 $PRIVATE_REGISTRY/tigera/waf-http-filter:v3.22.5
+   docker tag quay.io/tigera/waf-http-filter:v3.22.6 $PRIVATE_REGISTRY/tigera/waf-http-filter:v3.22.6
 
-   docker tag quay.io/tigera/webhooks-processor:v3.22.5 $PRIVATE_REGISTRY/tigera/webhooks-processor:v3.22.5
+   docker tag quay.io/tigera/webhooks-processor:v3.22.6 $PRIVATE_REGISTRY/tigera/webhooks-processor:v3.22.6
    ```
 
 3. Push the images to your private registry.
 
    ```bash
-   docker push $PRIVATE_REGISTRY/tigera/operator:v1.40.11
+   docker push $PRIVATE_REGISTRY/tigera/operator:v1.40.12
 
-   docker push $PRIVATE_REGISTRY/tigera/alertmanager:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/alertmanager:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/apiserver:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/apiserver:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/calicoctl:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/calicoctl:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/calicoq:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/calicoq:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/compliance-benchmarker:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/compliance-benchmarker:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/compliance-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/compliance-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/compliance-reporter:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/compliance-reporter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/compliance-server:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/compliance-server:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/compliance-snapshotter:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/compliance-snapshotter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/csi:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/csi:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/node-driver-registrar:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/node-driver-registrar:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/deep-packet-inspection:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/deep-packet-inspection:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/dex:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/dex:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/dikastes:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/dikastes:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/egress-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/egress-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/intrusion-detection-job-installer:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/intrusion-detection-job-installer:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/elasticsearch:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/elasticsearch:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/elasticsearch-metrics:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/elasticsearch-metrics:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/eck-operator:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/eck-operator:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/envoy:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/envoy:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/es-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/es-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/firewall-integration:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/firewall-integration:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/pod2daemon-flexvol:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/pod2daemon-flexvol:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/fluentd:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/fluentd:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/envoy-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/envoy-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/envoy-proxy:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/envoy-proxy:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/envoy-ratelimit:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/envoy-ratelimit:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/gateway-l7-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/gateway-l7-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/guardian:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/guardian:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/ingress-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/ingress-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/intrusion-detection-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/intrusion-detection-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/istio-install-cni:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/istio-install-cni:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/istio-pilot:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/istio-pilot:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/istio-proxyv2:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/istio-proxyv2:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/istio-ztunnel:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/istio-ztunnel:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/key-cert-provisioner:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/key-cert-provisioner:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/kibana:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/kibana:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/kube-controllers:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/kube-controllers:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/l7-admission-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/l7-admission-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/l7-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/l7-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/license-agent:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/license-agent:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/linseed:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/linseed:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/manager:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/manager:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/node:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/node:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/packetcapture:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/packetcapture:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/policy-recommendation:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/policy-recommendation:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/prometheus:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/prometheus:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/prometheus-config-reloader:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/prometheus-config-reloader:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/prometheus-operator:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/prometheus-operator:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/queryserver:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/queryserver:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/cni:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/cni:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/prometheus-service:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/prometheus-service:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/typha:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/typha:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/ui-apis:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/ui-apis:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/voltron:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/voltron:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/waf-http-filter:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/waf-http-filter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/tigera/webhooks-processor:v3.22.5
+   docker push $PRIVATE_REGISTRY/tigera/webhooks-processor:v3.22.6
    ```
 
    > **WARNING:**
@@ -6994,11 +6994,11 @@ In order to install images from your private registry, you must first pull the i
    For hybrid Linux + Windows clusters, use `crane cp` on the following Windows images to copy them to your private registry.
 
    ```bash
-   crane cp quay.io/tigera/fluentd-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd-windows:v3.22.5
+   crane cp quay.io/tigera/fluentd-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd-windows:v3.22.6
 
-   crane cp quay.io/tigera/node-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/node-windows:v3.22.5
+   crane cp quay.io/tigera/node-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/node-windows:v3.22.6
 
-   crane cp quay.io/tigera/cni-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/cni-windows:v3.22.5
+   crane cp quay.io/tigera/cni-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/cni-windows:v3.22.6
    ```
 
    > **WARNING:**
@@ -7110,359 +7110,359 @@ In order to install images from your private registry, you must first pull the i
 1. Use the following commands to pull the required <!-- -->Calico Enterprise<!-- --> images.
 
 2. ```bash
-   docker pull quay.io/tigera/operator:v1.40.11
+   docker pull quay.io/tigera/operator:v1.40.12
 
-   docker pull quay.io/tigera/alertmanager:v3.22.5
+   docker pull quay.io/tigera/alertmanager:v3.22.6
 
-   docker pull quay.io/tigera/apiserver:v3.22.5
+   docker pull quay.io/tigera/apiserver:v3.22.6
 
-   docker pull quay.io/tigera/calicoctl:v3.22.5
+   docker pull quay.io/tigera/calicoctl:v3.22.6
 
-   docker pull quay.io/tigera/calicoq:v3.22.5
+   docker pull quay.io/tigera/calicoq:v3.22.6
 
-   docker pull quay.io/tigera/compliance-benchmarker:v3.22.5
+   docker pull quay.io/tigera/compliance-benchmarker:v3.22.6
 
-   docker pull quay.io/tigera/compliance-controller:v3.22.5
+   docker pull quay.io/tigera/compliance-controller:v3.22.6
 
-   docker pull quay.io/tigera/compliance-reporter:v3.22.5
+   docker pull quay.io/tigera/compliance-reporter:v3.22.6
 
-   docker pull quay.io/tigera/compliance-server:v3.22.5
+   docker pull quay.io/tigera/compliance-server:v3.22.6
 
-   docker pull quay.io/tigera/compliance-snapshotter:v3.22.5
+   docker pull quay.io/tigera/compliance-snapshotter:v3.22.6
 
-   docker pull quay.io/tigera/csi:v3.22.5
+   docker pull quay.io/tigera/csi:v3.22.6
 
-   docker pull quay.io/tigera/node-driver-registrar:v3.22.5
+   docker pull quay.io/tigera/node-driver-registrar:v3.22.6
 
-   docker pull quay.io/tigera/deep-packet-inspection:v3.22.5
+   docker pull quay.io/tigera/deep-packet-inspection:v3.22.6
 
-   docker pull quay.io/tigera/dex:v3.22.5
+   docker pull quay.io/tigera/dex:v3.22.6
 
-   docker pull quay.io/tigera/dikastes:v3.22.5
+   docker pull quay.io/tigera/dikastes:v3.22.6
 
-   docker pull quay.io/tigera/egress-gateway:v3.22.5
+   docker pull quay.io/tigera/egress-gateway:v3.22.6
 
-   docker pull quay.io/tigera/intrusion-detection-job-installer:v3.22.5
+   docker pull quay.io/tigera/intrusion-detection-job-installer:v3.22.6
 
-   docker pull quay.io/tigera/elasticsearch:v3.22.5
+   docker pull quay.io/tigera/elasticsearch:v3.22.6
 
-   docker pull quay.io/tigera/elasticsearch-metrics:v3.22.5
+   docker pull quay.io/tigera/elasticsearch-metrics:v3.22.6
 
-   docker pull quay.io/tigera/eck-operator:v3.22.5
+   docker pull quay.io/tigera/eck-operator:v3.22.6
 
-   docker pull quay.io/tigera/envoy:v3.22.5
+   docker pull quay.io/tigera/envoy:v3.22.6
 
-   docker pull quay.io/tigera/es-gateway:v3.22.5
+   docker pull quay.io/tigera/es-gateway:v3.22.6
 
-   docker pull quay.io/tigera/firewall-integration:v3.22.5
+   docker pull quay.io/tigera/firewall-integration:v3.22.6
 
-   docker pull quay.io/tigera/pod2daemon-flexvol:v3.22.5
+   docker pull quay.io/tigera/pod2daemon-flexvol:v3.22.6
 
-   docker pull quay.io/tigera/fluentd:v3.22.5
+   docker pull quay.io/tigera/fluentd:v3.22.6
 
-   docker pull quay.io/tigera/envoy-gateway:v3.22.5
+   docker pull quay.io/tigera/envoy-gateway:v3.22.6
 
-   docker pull quay.io/tigera/envoy-proxy:v3.22.5
+   docker pull quay.io/tigera/envoy-proxy:v3.22.6
 
-   docker pull quay.io/tigera/envoy-ratelimit:v3.22.5
+   docker pull quay.io/tigera/envoy-ratelimit:v3.22.6
 
-   docker pull quay.io/tigera/gateway-l7-collector:v3.22.5
+   docker pull quay.io/tigera/gateway-l7-collector:v3.22.6
 
-   docker pull quay.io/tigera/guardian:v3.22.5
+   docker pull quay.io/tigera/guardian:v3.22.6
 
-   docker pull quay.io/tigera/ingress-collector:v3.22.5
+   docker pull quay.io/tigera/ingress-collector:v3.22.6
 
-   docker pull quay.io/tigera/intrusion-detection-controller:v3.22.5
+   docker pull quay.io/tigera/intrusion-detection-controller:v3.22.6
 
-   docker pull quay.io/tigera/istio-install-cni:v3.22.5
+   docker pull quay.io/tigera/istio-install-cni:v3.22.6
 
-   docker pull quay.io/tigera/istio-pilot:v3.22.5
+   docker pull quay.io/tigera/istio-pilot:v3.22.6
 
-   docker pull quay.io/tigera/istio-proxyv2:v3.22.5
+   docker pull quay.io/tigera/istio-proxyv2:v3.22.6
 
-   docker pull quay.io/tigera/istio-ztunnel:v3.22.5
+   docker pull quay.io/tigera/istio-ztunnel:v3.22.6
 
-   docker pull quay.io/tigera/key-cert-provisioner:v3.22.5
+   docker pull quay.io/tigera/key-cert-provisioner:v3.22.6
 
-   docker pull quay.io/tigera/kibana:v3.22.5
+   docker pull quay.io/tigera/kibana:v3.22.6
 
-   docker pull quay.io/tigera/kube-controllers:v3.22.5
+   docker pull quay.io/tigera/kube-controllers:v3.22.6
 
-   docker pull quay.io/tigera/l7-admission-controller:v3.22.5
+   docker pull quay.io/tigera/l7-admission-controller:v3.22.6
 
-   docker pull quay.io/tigera/l7-collector:v3.22.5
+   docker pull quay.io/tigera/l7-collector:v3.22.6
 
-   docker pull quay.io/tigera/license-agent:v3.22.5
+   docker pull quay.io/tigera/license-agent:v3.22.6
 
-   docker pull quay.io/tigera/linseed:v3.22.5
+   docker pull quay.io/tigera/linseed:v3.22.6
 
-   docker pull quay.io/tigera/manager:v3.22.5
+   docker pull quay.io/tigera/manager:v3.22.6
 
-   docker pull quay.io/tigera/node:v3.22.5
+   docker pull quay.io/tigera/node:v3.22.6
 
-   docker pull quay.io/tigera/packetcapture:v3.22.5
+   docker pull quay.io/tigera/packetcapture:v3.22.6
 
-   docker pull quay.io/tigera/policy-recommendation:v3.22.5
+   docker pull quay.io/tigera/policy-recommendation:v3.22.6
 
-   docker pull quay.io/tigera/prometheus:v3.22.5
+   docker pull quay.io/tigera/prometheus:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-config-reloader:v3.22.5
+   docker pull quay.io/tigera/prometheus-config-reloader:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-operator:v3.22.5
+   docker pull quay.io/tigera/prometheus-operator:v3.22.6
 
-   docker pull quay.io/tigera/queryserver:v3.22.5
+   docker pull quay.io/tigera/queryserver:v3.22.6
 
-   docker pull quay.io/tigera/cni:v3.22.5
+   docker pull quay.io/tigera/cni:v3.22.6
 
-   docker pull quay.io/tigera/prometheus-service:v3.22.5
+   docker pull quay.io/tigera/prometheus-service:v3.22.6
 
-   docker pull quay.io/tigera/typha:v3.22.5
+   docker pull quay.io/tigera/typha:v3.22.6
 
-   docker pull quay.io/tigera/ui-apis:v3.22.5
+   docker pull quay.io/tigera/ui-apis:v3.22.6
 
-   docker pull quay.io/tigera/voltron:v3.22.5
+   docker pull quay.io/tigera/voltron:v3.22.6
 
-   docker pull quay.io/tigera/waf-http-filter:v3.22.5
+   docker pull quay.io/tigera/waf-http-filter:v3.22.6
 
-   docker pull quay.io/tigera/webhooks-processor:v3.22.5
+   docker pull quay.io/tigera/webhooks-processor:v3.22.6
    ```
 
    Retag the images with the name of your private registry `$PRIVATE_REGISTRY` and<!-- --> `$IMAGE_PATH`.
 
 3. ```bash
-   docker tag quay.io/tigera/operator:v1.40.11 $PRIVATE_REGISTRY/$IMAGE_PATH/operator:v1.40.11
+   docker tag quay.io/tigera/operator:v1.40.12 $PRIVATE_REGISTRY/$IMAGE_PATH/operator:v1.40.12
 
-   docker tag quay.io/tigera/alertmanager:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/alertmanager:v3.22.5
+   docker tag quay.io/tigera/alertmanager:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/alertmanager:v3.22.6
 
-   docker tag quay.io/tigera/apiserver:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/apiserver:v3.22.5
+   docker tag quay.io/tigera/apiserver:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/apiserver:v3.22.6
 
-   docker tag quay.io/tigera/calicoctl:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/calicoctl:v3.22.5
+   docker tag quay.io/tigera/calicoctl:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/calicoctl:v3.22.6
 
-   docker tag quay.io/tigera/calicoq:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/calicoq:v3.22.5
+   docker tag quay.io/tigera/calicoq:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/calicoq:v3.22.6
 
-   docker tag quay.io/tigera/compliance-benchmarker:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-benchmarker:v3.22.5
+   docker tag quay.io/tigera/compliance-benchmarker:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-benchmarker:v3.22.6
 
-   docker tag quay.io/tigera/compliance-controller:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-controller:v3.22.5
+   docker tag quay.io/tigera/compliance-controller:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-controller:v3.22.6
 
-   docker tag quay.io/tigera/compliance-reporter:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-reporter:v3.22.5
+   docker tag quay.io/tigera/compliance-reporter:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-reporter:v3.22.6
 
-   docker tag quay.io/tigera/compliance-server:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-server:v3.22.5
+   docker tag quay.io/tigera/compliance-server:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-server:v3.22.6
 
-   docker tag quay.io/tigera/compliance-snapshotter:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-snapshotter:v3.22.5
+   docker tag quay.io/tigera/compliance-snapshotter:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-snapshotter:v3.22.6
 
-   docker tag quay.io/tigera/csi:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/csi:v3.22.5
+   docker tag quay.io/tigera/csi:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/csi:v3.22.6
 
-   docker tag quay.io/tigera/node-driver-registrar:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/node-driver-registrar:v3.22.5
+   docker tag quay.io/tigera/node-driver-registrar:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/node-driver-registrar:v3.22.6
 
-   docker tag quay.io/tigera/deep-packet-inspection:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/deep-packet-inspection:v3.22.5
+   docker tag quay.io/tigera/deep-packet-inspection:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/deep-packet-inspection:v3.22.6
 
-   docker tag quay.io/tigera/dex:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/dex:v3.22.5
+   docker tag quay.io/tigera/dex:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/dex:v3.22.6
 
-   docker tag quay.io/tigera/dikastes:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/dikastes:v3.22.5
+   docker tag quay.io/tigera/dikastes:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/dikastes:v3.22.6
 
-   docker tag quay.io/tigera/egress-gateway:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/egress-gateway:v3.22.5
+   docker tag quay.io/tigera/egress-gateway:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/egress-gateway:v3.22.6
 
-   docker tag quay.io/tigera/intrusion-detection-job-installer:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-job-installer:v3.22.5
+   docker tag quay.io/tigera/intrusion-detection-job-installer:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-job-installer:v3.22.6
 
-   docker tag quay.io/tigera/elasticsearch:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch:v3.22.5
+   docker tag quay.io/tigera/elasticsearch:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch:v3.22.6
 
-   docker tag quay.io/tigera/elasticsearch-metrics:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch-metrics:v3.22.5
+   docker tag quay.io/tigera/elasticsearch-metrics:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch-metrics:v3.22.6
 
-   docker tag quay.io/tigera/eck-operator:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/eck-operator:v3.22.5
+   docker tag quay.io/tigera/eck-operator:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/eck-operator:v3.22.6
 
-   docker tag quay.io/tigera/envoy:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy:v3.22.5
+   docker tag quay.io/tigera/envoy:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy:v3.22.6
 
-   docker tag quay.io/tigera/es-gateway:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/es-gateway:v3.22.5
+   docker tag quay.io/tigera/es-gateway:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/es-gateway:v3.22.6
 
-   docker tag quay.io/tigera/firewall-integration:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/firewall-integration:v3.22.5
+   docker tag quay.io/tigera/firewall-integration:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/firewall-integration:v3.22.6
 
-   docker tag quay.io/tigera/pod2daemon-flexvol:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/pod2daemon-flexvol:v3.22.5
+   docker tag quay.io/tigera/pod2daemon-flexvol:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/pod2daemon-flexvol:v3.22.6
 
-   docker tag quay.io/tigera/fluentd:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd:v3.22.5
+   docker tag quay.io/tigera/fluentd:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd:v3.22.6
 
-   docker tag quay.io/tigera/envoy-gateway:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-gateway:v3.22.5
+   docker tag quay.io/tigera/envoy-gateway:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-gateway:v3.22.6
 
-   docker tag quay.io/tigera/envoy-proxy:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-proxy:v3.22.5
+   docker tag quay.io/tigera/envoy-proxy:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-proxy:v3.22.6
 
-   docker tag quay.io/tigera/envoy-ratelimit:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-ratelimit:v3.22.5
+   docker tag quay.io/tigera/envoy-ratelimit:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-ratelimit:v3.22.6
 
-   docker tag quay.io/tigera/gateway-l7-collector:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/gateway-l7-collector:v3.22.5
+   docker tag quay.io/tigera/gateway-l7-collector:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/gateway-l7-collector:v3.22.6
 
-   docker tag quay.io/tigera/guardian:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/guardian:v3.22.5
+   docker tag quay.io/tigera/guardian:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/guardian:v3.22.6
 
-   docker tag quay.io/tigera/ingress-collector:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/ingress-collector:v3.22.5
+   docker tag quay.io/tigera/ingress-collector:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/ingress-collector:v3.22.6
 
-   docker tag quay.io/tigera/intrusion-detection-controller:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-controller:v3.22.5
+   docker tag quay.io/tigera/intrusion-detection-controller:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-controller:v3.22.6
 
-   docker tag quay.io/tigera/istio-install-cni:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-install-cni:v3.22.5
+   docker tag quay.io/tigera/istio-install-cni:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-install-cni:v3.22.6
 
-   docker tag quay.io/tigera/istio-pilot:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-pilot:v3.22.5
+   docker tag quay.io/tigera/istio-pilot:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-pilot:v3.22.6
 
-   docker tag quay.io/tigera/istio-proxyv2:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-proxyv2:v3.22.5
+   docker tag quay.io/tigera/istio-proxyv2:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-proxyv2:v3.22.6
 
-   docker tag quay.io/tigera/istio-ztunnel:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-ztunnel:v3.22.5
+   docker tag quay.io/tigera/istio-ztunnel:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/istio-ztunnel:v3.22.6
 
-   docker tag quay.io/tigera/key-cert-provisioner:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/key-cert-provisioner:v3.22.5
+   docker tag quay.io/tigera/key-cert-provisioner:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/key-cert-provisioner:v3.22.6
 
-   docker tag quay.io/tigera/kibana:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/kibana:v3.22.5
+   docker tag quay.io/tigera/kibana:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/kibana:v3.22.6
 
-   docker tag quay.io/tigera/kube-controllers:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/kube-controllers:v3.22.5
+   docker tag quay.io/tigera/kube-controllers:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/kube-controllers:v3.22.6
 
-   docker tag quay.io/tigera/l7-admission-controller:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/l7-admission-controller:v3.22.5
+   docker tag quay.io/tigera/l7-admission-controller:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/l7-admission-controller:v3.22.6
 
-   docker tag quay.io/tigera/l7-collector:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/l7-collector:v3.22.5
+   docker tag quay.io/tigera/l7-collector:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/l7-collector:v3.22.6
 
-   docker tag quay.io/tigera/license-agent:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/license-agent:v3.22.5
+   docker tag quay.io/tigera/license-agent:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/license-agent:v3.22.6
 
-   docker tag quay.io/tigera/linseed:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/linseed:v3.22.5
+   docker tag quay.io/tigera/linseed:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/linseed:v3.22.6
 
-   docker tag quay.io/tigera/manager:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/manager:v3.22.5
+   docker tag quay.io/tigera/manager:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/manager:v3.22.6
 
-   docker tag quay.io/tigera/node:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/node:v3.22.5
+   docker tag quay.io/tigera/node:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/node:v3.22.6
 
-   docker tag quay.io/tigera/packetcapture:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/packetcapture:v3.22.5
+   docker tag quay.io/tigera/packetcapture:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/packetcapture:v3.22.6
 
-   docker tag quay.io/tigera/policy-recommendation:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/policy-recommendation:v3.22.5
+   docker tag quay.io/tigera/policy-recommendation:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/policy-recommendation:v3.22.6
 
-   docker tag quay.io/tigera/prometheus:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus:v3.22.5
+   docker tag quay.io/tigera/prometheus:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-config-reloader:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-config-reloader:v3.22.5
+   docker tag quay.io/tigera/prometheus-config-reloader:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-config-reloader:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-operator:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-operator:v3.22.5
+   docker tag quay.io/tigera/prometheus-operator:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-operator:v3.22.6
 
-   docker tag quay.io/tigera/queryserver:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/queryserver:v3.22.5
+   docker tag quay.io/tigera/queryserver:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/queryserver:v3.22.6
 
-   docker tag quay.io/tigera/cni:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/cni:v3.22.5
+   docker tag quay.io/tigera/cni:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/cni:v3.22.6
 
-   docker tag quay.io/tigera/prometheus-service:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-service:v3.22.5
+   docker tag quay.io/tigera/prometheus-service:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-service:v3.22.6
 
-   docker tag quay.io/tigera/typha:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/typha:v3.22.5
+   docker tag quay.io/tigera/typha:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/typha:v3.22.6
 
-   docker tag quay.io/tigera/ui-apis:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/ui-apis:v3.22.5
+   docker tag quay.io/tigera/ui-apis:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/ui-apis:v3.22.6
 
-   docker tag quay.io/tigera/voltron:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/voltron:v3.22.5
+   docker tag quay.io/tigera/voltron:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/voltron:v3.22.6
 
-   docker tag quay.io/tigera/waf-http-filter:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/waf-http-filter:v3.22.5
+   docker tag quay.io/tigera/waf-http-filter:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/waf-http-filter:v3.22.6
 
-   docker tag quay.io/tigera/webhooks-processor:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/webhooks-processor:v3.22.5
+   docker tag quay.io/tigera/webhooks-processor:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/webhooks-processor:v3.22.6
    ```
 
    Push the images to your private registry.
 
 4. ```bash
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/operator:v1.40.11docker push $PRIVATE_REGISTRY/$IMAGE_PATH/alertmanager:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/operator:v1.40.12docker push $PRIVATE_REGISTRY/$IMAGE_PATH/alertmanager:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/apiserver:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/apiserver:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/calicoctl:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/calicoctl:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/calicoq:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/calicoq:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-benchmarker:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-benchmarker:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-reporter:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-reporter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-server:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-server:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-snapshotter:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/compliance-snapshotter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/csi:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/csi:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/node-driver-registrar:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/node-driver-registrar:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/deep-packet-inspection:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/deep-packet-inspection:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/dex:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/dex:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/dikastes:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/dikastes:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/egress-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/egress-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-job-installer:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-job-installer:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch-metrics:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/elasticsearch-metrics:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/eck-operator:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/eck-operator:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/es-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/es-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/firewall-integration:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/firewall-integration:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/pod2daemon-flexvol:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/pod2daemon-flexvol:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-gateway:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-gateway:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-proxy:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-proxy:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-ratelimit:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/envoy-ratelimit:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/gateway-l7-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/gateway-l7-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/guardian:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/guardian:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/ingress-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/ingress-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/intrusion-detection-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-install-cni:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-install-cni:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-pilot:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-pilot:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-proxyv2:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-proxyv2:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-ztunnel:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/istio-ztunnel:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/key-cert-provisioner:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/key-cert-provisioner:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/kibana:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/kibana:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/kube-controllers:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/kube-controllers:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/l7-admission-controller:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/l7-admission-controller:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/l7-collector:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/l7-collector:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/license-agent:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/license-agent:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/linseed:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/linseed:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/manager:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/manager:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/node:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/node:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/packetcapture:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/packetcapture:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/policy-recommendation:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/policy-recommendation:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-config-reloader:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-config-reloader:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-operator:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-operator:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/queryserver:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/queryserver:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/cni:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/cni:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-service:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/prometheus-service:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/typha:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/typha:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/ui-apis:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/ui-apis:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/voltron:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/voltron:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/waf-http-filter:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/waf-http-filter:v3.22.6
 
-   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/webhooks-processor:v3.22.5
+   docker push $PRIVATE_REGISTRY/$IMAGE_PATH/webhooks-processor:v3.22.6
    ```
 
    > **WARNING:**
@@ -7482,11 +7482,11 @@ In order to install images from your private registry, you must first pull the i
    For hybrid Linux + Windows clusters, use `crane cp` on the following Windows images to copy them to your private registry.
 
    ```bash
-   crane cp quay.io/tigera/fluentd-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd-windows:v3.22.5
+   crane cp quay.io/tigera/fluentd-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/fluentd-windows:v3.22.6
 
-   crane cp quay.io/tigera/node-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/node-windows:v3.22.5
+   crane cp quay.io/tigera/node-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/node-windows:v3.22.6
 
-   crane cp quay.io/tigera/cni-windows:v3.22.5 $PRIVATE_REGISTRY/$IMAGE_PATH/cni-windows:v3.22.5
+   crane cp quay.io/tigera/cni-windows:v3.22.6 $PRIVATE_REGISTRY/$IMAGE_PATH/cni-windows:v3.22.6
    ```
 
    > **WARNING:**
@@ -8197,17 +8197,17 @@ Calico Enterprise creates a default-deny for the calico-system namespace. If you
 1. Get the Helm chart
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/charts/tigera-operator-v3.22.5-0.tgz
+   curl -O -L https://downloads.tigera.io/ee/charts/tigera-operator-v3.22.6-0.tgz
    ```
 
 2. Install the Calico Enterprise custom resource definitions.
 
    ```bash
-   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus-operator-crds.yaml
+   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus-operator-crds.yaml
 
-   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/eck-operator-crds.yaml
+   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/eck-operator-crds.yaml
    ```
 
 3. If your cluster is v3.19 or older, update `values.yaml` with `packetCaptureAPI` enabled to true.
@@ -8225,7 +8225,7 @@ Calico Enterprise creates a default-deny for the calico-system namespace. If you
    If you are using default `values.yaml`, copy the custom `values.yaml` and update packetCaptureAPI's `enabled` to `true`. Then, replace `<path-to-values.yaml>` in the next step with this modified `values.yaml` for the Helm upgrade.
 
    ```bash
-   helm show values ./tigera-operator-v3.22.5-0.tgz >values.yaml
+   helm show values ./tigera-operator-v3.22.6-0.tgz >values.yaml
    ```
 
 4. Optional: Compliance and packetcapture features are optional. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`.
@@ -8247,13 +8247,13 @@ Calico Enterprise creates a default-deny for the calico-system namespace. If you
    If you are using default `values.yaml`, copy the custom `values.yaml` and update compliance and packetCaptureAPI's `enabled` to `true`. Then, replace `<path-to-values.yaml>` in the next step with this modified `values.yaml` for the Helm upgrade.
 
    ```bash
-   helm show values ./tigera-operator-v3.22.5-0.tgz >values.yaml
+   helm show values ./tigera-operator-v3.22.6-0.tgz >values.yaml
    ```
 
 5. Run the Helm upgrade command for `tigera-operator` and make sure to either update `values.yaml` with your configuration or use custom `values.yaml` file:
 
 ```bash
-helm upgrade calico-enterprise --values=<path-to-values-yaml> tigera-operator-v3.22.5-0.tgz \
+helm upgrade calico-enterprise --values=<path-to-values-yaml> tigera-operator-v3.22.6-0.tgz \
 
 --set-file imagePullSecrets.tigera-pull-secret=<path-to-pull-secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path-to-pull-secret> \
 
@@ -8331,7 +8331,7 @@ For Calico Enterprise, upgrading multi-cluster management setups must include up
 1. Download the new manifests for Tigera Operator.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Download the new manifests for Prometheus operator.
@@ -8341,7 +8341,7 @@ For Calico Enterprise, upgrading multi-cluster management setups must include up
    > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. If you previously<!-- --> [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to<!-- --> [push the new images<!-- --> ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#push-calico-enterprise-images-to-your-private-registry)and then<!-- --> [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#run-the-operator-using-images-from-your-private-registry) <!-- -->downloaded in the previous step.
@@ -8499,7 +8499,7 @@ If the `active-namespace` is `tigera-operator-enterprise`, then the cluster was
 1. Download the new manifests for Tigera Operator.
 
    ```bash
-   curl -L -o tigera-operator.yaml https://downloads.tigera.io/ee/v3.22.5/manifests/aks/tigera-operator-upgrade.yaml
+   curl -L -o tigera-operator.yaml https://downloads.tigera.io/ee/v3.22.6/manifests/aks/tigera-operator-upgrade.yaml
    ```
 
 2. Download the new manifests for Prometheus operator.
@@ -8509,7 +8509,7 @@ If the `active-namespace` is `tigera-operator-enterprise`, then the cluster was
    > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. If you previously<!-- --> [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to<!-- --> [push the new images<!-- --> ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#push-calico-enterprise-images-to-your-private-registry)and then<!-- --> [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#run-the-operator-using-images-from-your-private-registry) <!-- -->downloaded in the previous step.
@@ -8733,7 +8733,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift and add t
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico --exclude=03-cr-* --exclude=02-pull-secret.yaml
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico --exclude=03-cr-* --exclude=02-pull-secret.yaml
 
 cp calico/* manifests/
 ```
@@ -8771,7 +8771,7 @@ cp calico/* manifests/
    >  that you manage yourself.
 
    ```bash
-   oc apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+   oc apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
    ```
 
 3. If your cluster is a management cluster, apply a [ManagementCluster](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api#managementcluster) CR to your cluster.
@@ -8867,13 +8867,13 @@ cp calico/* manifests/
    If your cluster is a **managed** cluster, run this command:
 
    ```bash
-   kubectl delete -f https://downloads.tigera.io/ee/v3.22.5/manifests/default-tier-policies-managed.yaml
+   kubectl delete -f https://downloads.tigera.io/ee/v3.22.6/manifests/default-tier-policies-managed.yaml
    ```
 
    For other clusters, run this command:
 
    ```bash
-   kubectl delete -f https://downloads.tigera.io/ee/v3.22.5/manifests/default-tier-policies.yaml
+   kubectl delete -f https://downloads.tigera.io/ee/v3.22.6/manifests/default-tier-policies.yaml
    ```
 
 ### Upgrade from Calico to Calico Enterprise
@@ -8945,7 +8945,7 @@ If you receive error indicating the custom resource definitions or resource type
 1. Download the new manifests for Tigera Operator.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Download the new manifests for Prometheus operator.
@@ -8955,7 +8955,7 @@ If you receive error indicating the custom resource definitions or resource type
    > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. If you previously<!-- --> [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to<!-- --> [push the new images<!-- --> ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#push-calico-enterprise-images-to-your-private-registry)and then<!-- --> [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#run-the-operator-using-images-from-your-private-registry) <!-- -->downloaded in the previous step.
@@ -8987,7 +8987,7 @@ If you receive error indicating the custom resource definitions or resource type
 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources-upgrade-from-calico.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources-upgrade-from-calico.yaml
    ```
 
 **Tab: EKS**
@@ -8995,7 +8995,7 @@ If you receive error indicating the custom resource definitions or resource type
 1. Download the new manifests for Tigera Operator.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Download the new manifests for Prometheus operator.
@@ -9005,7 +9005,7 @@ If you receive error indicating the custom resource definitions or resource type
    > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. If you previously<!-- --> [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to<!-- --> [push the new images<!-- --> ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#push-calico-enterprise-images-to-your-private-registry)and then<!-- --> [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#run-the-operator-using-images-from-your-private-registry) <!-- -->downloaded in the previous step.
@@ -9037,7 +9037,7 @@ If you receive error indicating the custom resource definitions or resource type
 7. Install the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/eks/custom-resources-upgrade-from-calico.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/eks/custom-resources-upgrade-from-calico.yaml
    ```
 
 **Tab: AKS**
@@ -9063,7 +9063,7 @@ These upgrade instructions will upgrade your AKS clusters with Azure CNI and an
 2. Download the new manifests for Tigera Operator.
 
    ```bash
-   curl -L -o tigera-operator.yaml https://downloads.tigera.io/ee/v3.22.5/manifests/aks/tigera-operator-upgrade.yaml
+   curl -L -o tigera-operator.yaml https://downloads.tigera.io/ee/v3.22.6/manifests/aks/tigera-operator-upgrade.yaml
    ```
 
 3. Download the new manifests for Prometheus operator.
@@ -9073,7 +9073,7 @@ These upgrade instructions will upgrade your AKS clusters with Azure CNI and an
    > If you have an existing Prometheus operator in your cluster that you want to use, skip this step. To work with Calico Enterprise, your Prometheus operator must be v0.40.0 or higher.
 
    ```bash
-   curl -L -O https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   curl -L -O https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. If you previously<!-- --> [installed using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to<!-- --> [push the new images<!-- --> ](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#push-calico-enterprise-images-to-your-private-registry)and then<!-- --> [update the manifest](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry/private-registry-regular#run-the-operator-using-images-from-your-private-registry) <!-- -->downloaded in the previous step.
@@ -9105,7 +9105,7 @@ These upgrade instructions will upgrade your AKS clusters with Azure CNI and an
 8. Download the custom resources manifest.
 
    ```bash
-   curl -L -o custom-resources.yaml https://downloads.tigera.io/ee/v3.22.5/manifests/aks/custom-resources-upgrade-from-calico.yaml
+   curl -L -o custom-resources.yaml https://downloads.tigera.io/ee/v3.22.6/manifests/aks/custom-resources-upgrade-from-calico.yaml
    ```
 
 9. If you are<!-- --> [installing using a private registry](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/private-registry), you will need to update the manifest downloaded in the previous step. Update the `spec.registry`, `spec.imagePath`, and `spec.imagePrefix` fields of the installation resource with the registry name, image path, and image prefix of your private registry.
@@ -9168,17 +9168,17 @@ If you receive error indicating the custom resource definitions or resource type
 1. Get the Helm chart
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/charts/tigera-operator-v3.22.5-0.tgz
+   curl -O -L https://downloads.tigera.io/ee/charts/tigera-operator-v3.22.6-0.tgz
    ```
 
 2. Install the Calico Enterprise custom resource definitions.
 
    ```bash
-   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus-operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus-operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/eck-operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/eck-operator-crds.yaml
    ```
 
 3. [Configure a storage class for Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/operations/logstorage/create-storage)
@@ -9186,7 +9186,7 @@ If you receive error indicating the custom resource definitions or resource type
 4. Run the Helm upgrade command for `tigera-operator`:
 
    ```bash
-   helm upgrade calico tigera-operator-v3.22.5-0.tgz \
+   helm upgrade calico tigera-operator-v3.22.6-0.tgz \
 
    --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -9267,7 +9267,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift and add t
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico --exclude=03-cr-*
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico --exclude=03-cr-*
 
 cp calico/* manifests/
 ```
@@ -9299,7 +9299,7 @@ sed -i "s/SECRET/${SECRET}/" manifests/02-pull-secret.yaml
 3. Create the custom resources for Calico Enterprise features, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   oc apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-enterprise-resources.yaml
+   oc apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-enterprise-resources.yaml
    ```
 
 4. Patch installation.
@@ -9349,7 +9349,7 @@ Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operato
 >  that you manage yourself.
 
 ```bash
-oc apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+oc apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
 ```
 
 You can now monitor progress with the following command:
@@ -9377,6 +9377,7 @@ This feature is:
 
    | Patch version | Release archive link                                                                                                                               |
    | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+   | v3.22.6       | [https://downloads.tigera.io/ee/archives/release-v3.22.6-v1.40.12.tgz](https://downloads.tigera.io/ee/archives/release-v3.22.6-v1.40.12.tgz)       |
    | v3.22.5       | [https://downloads.tigera.io/ee/archives/release-v3.22.5-v1.40.11.tgz](https://downloads.tigera.io/ee/archives/release-v3.22.5-v1.40.11.tgz)       |
    | v3.22.4       | [https://downloads.tigera.io/ee/archives/release-v3.22.4-v1.40.10.tgz](https://downloads.tigera.io/ee/archives/release-v3.22.4-v1.40.10.tgz)       |
    | v3.22.3       | [https://downloads.tigera.io/ee/archives/release-v3.22.3-v1.40.9.tgz](https://downloads.tigera.io/ee/archives/release-v3.22.3-v1.40.9.tgz)         |
@@ -25681,7 +25682,7 @@ The basic workflow is:
 
 ### Create a config map with FortiGate and FortiManager information[​](#create-a-config-map-with-fortigate-and-fortimanager-information)
 
-1. In the [FortiGate ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.5/manifests/fortinet-device-configmap.yaml), add your FortiGate firewall information in the data section, `tigera.firewall.fortigate`.
+1. In the [FortiGate ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml), add your FortiGate firewall information in the data section, `tigera.firewall.fortigate`.
 
    Where:
 
@@ -25726,7 +25727,7 @@ The basic workflow is:
     vdom: fortigate-vdom2
    ```
 
-2. In the [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.5/manifests/fortinet-device-configmap.yaml), add your FortiManager information in the data section, `tigera.firewall.fortimgr`.
+2. In the [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml), add your FortiManager information in the data section, `tigera.firewall.fortimgr`.
 
    Where:
 
@@ -25765,7 +25766,7 @@ The basic workflow is:
 1. Apply the manifest.
 
    ```text
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/fortinet-device-configmap.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet-device-configmap.yaml
    ```
 
 ### Install FortiGate ApiKey and FortiManager password as secrets[​](#install-fortigate-apikey-and-fortimanager-password-as-secrets)
@@ -25805,7 +25806,7 @@ The basic workflow is:
 2. Apply the manifest.
 
    ```text
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/fortinet.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortinet.yaml
    ```
 
 ## Verify the integration[​](#verify-the-integration)
@@ -25900,7 +25901,7 @@ Create a [Calico Enterprise tier](https://docs.tigera.io/calico-enterprise/lates
     kubectl create namespace tigera-firewall-controller
    ```
 
-2. In this [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.5/manifests/fortimanager-device-configmap.yaml), add your FortiManager device information in the data section: `tigera.firewall.fortimanager-policies`. For example:
+2. In this [FortiManager ConfigMap manifest](https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager-device-configmap.yaml), add your FortiManager device information in the data section: `tigera.firewall.fortimanager-policies`. For example:
 
    ```yaml
     tigera.firewall.fortimanager-policies: |
@@ -25943,7 +25944,7 @@ Create a [Calico Enterprise tier](https://docs.tigera.io/calico-enterprise/lates
 3. Apply the manifest.
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/fortimanager-device-configmap.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager-device-configmap.yaml
    ```
 
 ## Install FortiManager password as secrets[​](#install-fortimanager-password-as-secrets)
@@ -25975,7 +25976,7 @@ kubectl create secret generic fortimgr-east1 \
 2. Apply the manifest.
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/fortimanager.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/fortimanager.yaml
    ```
 
 ## Verify the integration[​](#verify-the-integration)
@@ -32714,11 +32715,11 @@ Follow these steps in the cluster you intend to use as the managed cluster.
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -32736,7 +32737,7 @@ Follow these steps in the cluster you intend to use as the managed cluster.
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -32760,13 +32761,13 @@ Follow these steps in the cluster you intend to use as the managed cluster.
 5. (Optional) Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation.
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 6. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -32914,11 +32915,11 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -32936,7 +32937,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -32956,7 +32957,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -33104,11 +33105,11 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -33126,7 +33127,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -33146,7 +33147,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/eks/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/eks/custom-resources.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -33232,11 +33233,11 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
 2. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -33254,7 +33255,7 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -33276,7 +33277,7 @@ Before you get started, make sure you have downloaded and configured the<!-- -->
 7. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/eks/custom-resources-calico-cni.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/eks/custom-resources-calico-cni.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -33438,11 +33439,11 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 2. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -33460,7 +33461,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 3. Install your pull secret.
@@ -33480,7 +33481,7 @@ kubectl create clusterrolebinding mcm-user-admin --serviceaccount=default:mcm-us
 5. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/aks/custom-resources.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/aks/custom-resources.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -33544,11 +33545,11 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to the ne
 2. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
    ```
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
 3. Install the Prometheus operator and related custom resource definitions. The Prometheus operator will be used to deploy Prometheus server and Alertmanager to monitor <!-- -->Calico Enterprise<!-- --> metrics.
@@ -33566,7 +33567,7 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to the ne
    > , your Prometheus operator must be v0.40.0 or higher.
 
    ```text
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-prometheus-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-prometheus-operator.yaml
    ```
 
 4. Install your pull secret.
@@ -33586,7 +33587,7 @@ Wait until the `apiserver` shows a status of `Available`, then proceed to the ne
 6. Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/aks/custom-resources-calico-cni.yaml
+   curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/aks/custom-resources-calico-cni.yaml
    ```
 
    Remove the `Manager` custom resource from the manifest file.
@@ -33836,7 +33837,7 @@ Download the <!-- -->Calico Enterprise<!-- --> manifests for OpenShift and add t
 ```bash
 mkdir calico
 
-wget -qO- https://downloads.tigera.io/ee/v3.22.5/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
+wget -qO- https://downloads.tigera.io/ee/v3.22.6/manifests/ocp.tgz | tar xvz --strip-components=1 -C calico
 
 cp calico/* manifests/
 ```
@@ -33890,7 +33891,7 @@ Calico Enterprise<!-- --> requires storage for logs and reports. Before finishin
 Download the Tigera custom resources. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
 ```bash
-curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-enterprise-resources.yaml
+curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-enterprise-resources.yaml
 ```
 
 Remove the `Manager` custom resource from the manifest file.
@@ -33962,7 +33963,7 @@ Apply the <!-- -->Calico Enterprise<!-- --> manifests for the Prometheus operato
 >  that you manage yourself.
 
 ```bash
-oc create -f https://downloads.tigera.io/ee/v3.22.5/manifests/ocp/tigera-prometheus-operator.yaml
+oc create -f https://downloads.tigera.io/ee/v3.22.6/manifests/ocp/tigera-prometheus-operator.yaml
 ```
 
 You can now monitor progress with the following command:
@@ -33976,7 +33977,7 @@ When it shows all components with status `Available`, proceed to the next step.
 (Optional) Apply the full CRDs including descriptions.
 
 ```bash
-oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+oc apply --server-side --force-conflicts -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 ```
 
 #### Create the connection manifest for your managed cluster[​](#create-the-connection-manifest-for-your-managed-cluster)
@@ -34117,7 +34118,7 @@ helm repo add tigera-ee https://downloads.tigera.io/ee/charts
 
 helm repo update
 
-helm pull tigera-ee/tigera-operator --version v3.22.5
+helm pull tigera-ee/tigera-operator --version v3.22.6
 ```
 
 ### Prepare the Installation Configuration[​](#prepare-the-installation-configuration)
@@ -34249,7 +34250,7 @@ managedClusters:
 1. Install the Tigera Operator and custom resource definitions using the Helm 3 chart:
 
 ```bash
-helm install calico-enterprise tigera-operator-v3.22.5-0.tgz -f values.yaml \
+helm install calico-enterprise tigera-operator-v3.22.6-0.tgz -f values.yaml \
 
 --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -34361,7 +34362,7 @@ managementCluster:
 1. Install the Tigera Operator and custom resource definitions using the Helm 3 chart:
 
 ```bash
-helm install calico-enterprise tigera-operator-v3.22.5-0.tgz -f values.yaml \
+helm install calico-enterprise tigera-operator-v3.22.6-0.tgz -f values.yaml \
 
 --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -34467,7 +34468,7 @@ helm repo add tigera-ee https://downloads.tigera.io/ee/charts
 
 helm repo update
 
-helm pull tigera-ee/tigera-operator --version v3.22.5
+helm pull tigera-ee/tigera-operator --version v3.22.6
 ```
 
 ### Prepare the Installation Configuration[​](#prepare-the-installation-configuration)
@@ -34579,7 +34580,7 @@ managementClusterConnection:
 1. Install the Tigera Operator and custom resource definitions using the Helm 3 chart:
 
 ```bash
-helm install calico-enterprise tigera-operator-v3.22.5-0.tgz -f values.yaml \
+helm install calico-enterprise tigera-operator-v3.22.6-0.tgz -f values.yaml \
 
 --set-file imagePullSecrets.tigera-pull-secret=<path/to/pull/secret>,tigera-prometheus-operator.imagePullSecrets.tigera-pull-secret=<path/to/pull/secret> \
 
@@ -34981,7 +34982,7 @@ The steps in this section assume that a management cluster is up and running.
 3. Install the Tigera custom resources. For more information, see [the installation reference](https://docs.tigera.io/calico-enterprise/latest/reference/installation/api).
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
    ```
 
 4. Monitor the progress with the following command:
@@ -35113,13 +35114,13 @@ In this section, we will create a `kubeconfig` for each cluster. This `kubeconfi
 1. Create the ServiceAccount used by remote clusters for authentication:
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/federation-remote-sa.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/federation-remote-sa.yaml
    ```
 
 2. Create the ClusterRole and ClusterRoleBinding used by remote clusters for authorization:
 
    ```bash
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/federation-rem-rbac-kdd.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/federation-rem-rbac-kdd.yaml
    ```
 
 3. Create the ServiceAccount token that will be used in the `kubeconfig`:
@@ -36917,7 +36918,7 @@ In this section we will look at how to add Tor and VPN feeds to Calico Enterpris
    <!-- -->
 
    ```shell
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/threatdef/vpn-feed.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/threatdef/vpn-feed.yaml
    ```
 
    <!-- -->
@@ -36927,7 +36928,7 @@ In this section we will look at how to add Tor and VPN feeds to Calico Enterpris
    <!-- -->
 
    ```shell
-   kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/threatdef/tor-exit-feed.yaml
+   kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/threatdef/tor-exit-feed.yaml
    ```
 
 2. Now, you can monitor the Dashboard for any malicious activity. The dashboard can be found at the Calico Enterprise web console, go to "kibana" and then go to "Dashboard". Select "Tor-VPN Dashboard".
@@ -38609,13 +38610,13 @@ To run a report on demand:
    For management and standalone clusters:
 
    ```bash
-   curl -O https://downloads.tigera.io/ee/v3.22.5/manifests/compliance-reporter-pod.yaml
+   curl -O https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod.yaml
    ```
 
    For managed clusters:
 
    ```bash
-   curl https://downloads.tigera.io/ee/v3.22.5/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
+   curl https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
    ```
 
 2. Edit the template as follows:
@@ -38804,13 +38805,13 @@ To manually run a report:
    For management and standalone clusters:
 
    ```bash
-   curl -O https://downloads.tigera.io/ee/v3.22.5/manifests/compliance-reporter-pod.yaml
+   curl -O https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod.yaml
    ```
 
    For managed clusters:
 
    ```bash
-   curl https://downloads.tigera.io/ee/v3.22.5/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
+   curl https://downloads.tigera.io/ee/v3.22.6/manifests/compliance-reporter-pod-managed.yaml -o compliance-reporter-pod.yaml
    ```
 
 2. Edit the template as follows:
@@ -41793,7 +41794,7 @@ Log into the host, open a terminal prompt, and navigate to the location where yo
 Use the following command to download the `calicoctl` binary.
 
 ```bash
-curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl
+curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl
 ```
 
 Set the file to be executable.
@@ -41815,13 +41816,13 @@ Use the following commands to download the `calicoctl` binary.
 - ARM64 (Apple Silicon):
 
   ```bash
-  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-darwin-arm64
+  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-darwin-arm64
   ```
 
 - AMD64 (Intel):
 
   ```bash
-  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-darwin-amd64
+  curl -o calicoctl -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-darwin-amd64
   ```
 
 Set the file to be executable.
@@ -41841,7 +41842,7 @@ Use the following PowerShell command to download the `calicoctl` binary.
 > **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`.
 
 ```bash
-Invoke-WebRequest -Uri "https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe"
+Invoke-WebRequest -Uri "https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe"
 ```
 
 <!-- /tabs -->
@@ -41859,7 +41860,7 @@ Log into the host, open a terminal prompt, and navigate to the location where yo
 Use the following command to download the `calicoctl` binary.
 
 ```bash
-curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl
+curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl
 ```
 
 Set the file to be executable.
@@ -41881,13 +41882,13 @@ Use the following commands to download the `calicoctl` binary.
 - ARM64 (Apple Silicon):
 
   ```bash
-  curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-darwin-arm64
+  curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-darwin-arm64
   ```
 
 - AMD64 (Intel):
 
   ```bash
-  curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-darwin-amd64
+  curl -o kubectl-calico -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-darwin-amd64
   ```
 
 Set the file to be executable.
@@ -41907,7 +41908,7 @@ Use the following PowerShell command to download the `calicoctl` binary.
 > **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`.
 
 ```bash
-Invoke-WebRequest -Uri "https://downloads.tigera.io/ee/binaries/v3.22.5/calicoctl-windows-amd64.exe" -OutFile "kubectl-calico.exe"
+Invoke-WebRequest -Uri "https://downloads.tigera.io/ee/binaries/v3.22.6/calicoctl-windows-amd64.exe" -OutFile "kubectl-calico.exe"
 ```
 
 <!-- /tabs -->
@@ -41961,7 +41962,7 @@ You can now run any `calicoctl` subcommands through `kubectl calico`.
 5. Use the following commands to pull the `calicoctl` image from the Tigera registry.
 
    ```bash
-   docker pull quay.io/tigera/calicoctl:v3.22.5
+   docker pull quay.io/tigera/calicoctl:v3.22.6
    ```
 
 6. Confirm that the image has loaded by typing `docker images`.
@@ -41969,7 +41970,7 @@ You can now run any `calicoctl` subcommands through `kubectl calico`.
    ```bash
    REPOSITORY TAG IMAGE ID CREATED SIZE
 
-   tigera/calicoctl v3.22.5 e07d59b0eb8a 2 minutes ago 42MB
+   tigera/calicoctl v3.22.6 e07d59b0eb8a 2 minutes ago 42MB
    ```
 
 **Next step**:
@@ -42166,7 +42167,7 @@ For step-by-step instructions, refer to the section that corresponds to your des
 2. Use the following command to download the `calicoq` binary.
 
    ```text
-   curl -o calicoq -O -L https://downloads.tigera.io/ee/binaries/v3.22.5/calicoq
+   curl -o calicoq -O -L https://downloads.tigera.io/ee/binaries/v3.22.6/calicoq
    ```
 
 3. Set the file to be executable.
@@ -42220,7 +42221,7 @@ For step-by-step instructions, refer to the section that corresponds to your des
 5. Use the following commands to pull the `calicoq` image from the Tigera registry.
 
    ```bash
-   docker pull quay.io/tigera/calicoq:v3.22.5
+   docker pull quay.io/tigera/calicoq:v3.22.6
    ```
 
 6. Confirm that the image has loaded by typing `docker images`.
@@ -42228,7 +42229,7 @@ For step-by-step instructions, refer to the section that corresponds to your des
    ```bash
    REPOSITORY TAG IMAGE ID CREATED SIZE
 
-   tigera/calicoq v3.22.5 e07d59b0eb8a 2 minutes ago 42MB
+   tigera/calicoq v3.22.6 e07d59b0eb8a 2 minutes ago 42MB
    ```
 
 **Next step**:
@@ -43108,7 +43109,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/elasticsearch-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/elasticsearch-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -43150,7 +43151,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/fluentd-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/fluentd-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -43192,7 +43193,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/calico-node-monitor-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/calico-node-monitor-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in $NAMESPACE.
@@ -43234,7 +43235,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/kube-controller-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/kube-controller-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -43318,7 +43319,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/felix-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/felix-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -43352,7 +43353,7 @@ export NAMESPACE=<my-prometheus-namespace>
 ```
 
 ```bash
-kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/prometheus/typha-metrics-service-monitor.yaml -n $NAMESPACE
+kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/prometheus/typha-metrics-service-monitor.yaml -n $NAMESPACE
 ```
 
 The .yamls have no namespace defined so when you apply `kubectl`, it is applied in the $NAMESPACE.
@@ -44758,7 +44759,7 @@ To add the license-agent component in a Kubernetes cluster for license metrics,
 3. Apply the manifest.
    <!-- -->
    ```text
-    kubectl apply -f https://downloads.tigera.io/ee/v3.22.5/manifests/licenseagent.yaml
+    kubectl apply -f https://downloads.tigera.io/ee/v3.22.6/manifests/licenseagent.yaml
    ```
 
 ### Create alerts using Prometheus metrics[​](#create-alerts-using-prometheus-metrics)
@@ -45770,7 +45771,7 @@ EOF
 When the main install guide tells you to apply the `custom-resources.yaml`, typically by running `kubectl create` with the URL of the file directly, you should instead download the file, so that you can edit it:
 
 ```bash
- curl -o custom-resources.yaml https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+ curl -o custom-resources.yaml https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
 ```
 
 Edit the file in your editor of choice and find the `Installation` resource, which should be at the top of the file. To enable eBPF mode, we need to add a new `calicoNetwork` section inside the `spec` of the Installation resource, including the `linuxDataplane` field. For EKS Bottlerocket OS only, you should also add the `flexVolumePath` setting as shown below.
@@ -46488,9 +46489,9 @@ To use nftables, your Kubernetes installation must be configured to use kube-pro
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/operator-crds.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/operator-crds.yaml
 
-   kubectl create -f https://downloads.tigera.io/ee/v3.22.5/manifests/tigera-operator.yaml
+   kubectl create -f https://downloads.tigera.io/ee/v3.22.6/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -46500,7 +46501,7 @@ To use nftables, your Kubernetes installation must be configured to use kube-pro
    1. Download the default `custom-resources.yaml` file:
 
       ```bash
-      curl -O -L https://downloads.tigera.io/ee/v3.22.5/manifests/custom-resources.yaml
+      curl -O -L https://downloads.tigera.io/ee/v3.22.6/manifests/custom-resources.yaml
       ```
 
    2. Enable nftables mode by setting `spec.linuxDataplane` to `nftables` in the `Installation` resource:
@@ -57425,7 +57426,7 @@ Increasing conntrack limit
 
 Running the following command:
 
-docker run --net=host --privileged --name=calico-node -d --restart=always -e ETCD_SCHEME=http -e HOSTNAME=calico -e ETCD_AUTHORITY=127.0.0.1:2379 -e AS= -e NO_DEFAULT_POOLS= -e ETCD_ENDPOINTS= -e IP= -e IP6= -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins quay.io/tigera/node:v3.22.5
+docker run --net=host --privileged --name=calico-node -d --restart=always -e ETCD_SCHEME=http -e HOSTNAME=calico -e ETCD_AUTHORITY=127.0.0.1:2379 -e AS= -e NO_DEFAULT_POOLS= -e ETCD_ENDPOINTS= -e IP= -e IP6= -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins quay.io/tigera/node:v3.22.6
 
 Waiting for etcd connection...
 
@@ -79151,6 +79152,89 @@ Then you should observe that the new Calico Enterprise policy is enforced for ne
 
 This page lists the specific component versions that go into each release of Calico Enterprise.
 
+## Component versions for <!-- -->Calico Enterprise<!-- --> <!-- -->3.22.6[​](#component-versions-v3.22.6)
+
+[Release archive](https://downloads.tigera.io/ee/archives/release-v3.22.6-v1.40.12.tgz) <!-- -->with Kubernetes manifests. Based on Calico <!-- -->v3.31<!-- -->.
+
+This release comprises the following components, and can be installed using
+
+<!-- -->
+
+`quay.io/tigera/operator:v1.40.12`
+
+| Component                      | Version |
+| ------------------------------ | ------- |
+| alertmanager                   | v3.22.6 |
+| apiserver                      | v3.22.6 |
+| calicoctl                      | v3.22.6 |
+| calicoq                        | v3.22.6 |
+| compliance-benchmarker         | v3.22.6 |
+| compliance-controller          | v3.22.6 |
+| compliance-reporter            | v3.22.6 |
+| compliance-server              | v3.22.6 |
+| compliance-snapshotter         | v3.22.6 |
+| coreos-alertmanager            | v0.32.0 |
+| coreos-config-reloader         | v0.90.1 |
+| coreos-dex                     | v2.45.1 |
+| coreos-fluentd                 | 1.19.2  |
+| coreos-prometheus              | v3.11.1 |
+| coreos-prometheus-operator     | v0.90.1 |
+| csi                            | v3.22.6 |
+| csi-node-driver-registrar      | v3.22.6 |
+| deep-packet-inspection         | v3.22.6 |
+| dex                            | v3.22.6 |
+| dikastes                       | v3.22.6 |
+| eck-elasticsearch              | 8.19.16 |
+| eck-elasticsearch-operator     | 2.16.1  |
+| eck-kibana                     | 8.19.16 |
+| egress-gateway                 | v3.22.6 |
+| elastic-tsee-installer         | v3.22.6 |
+| elasticsearch                  | v3.22.6 |
+| elasticsearch-metrics          | v3.22.6 |
+| elasticsearch-operator         | v3.22.6 |
+| envoy                          | v3.22.6 |
+| es-gateway                     | v3.22.6 |
+| firewall-integration           | v3.22.6 |
+| flexvol                        | v3.22.6 |
+| fluentd                        | v3.22.6 |
+| fluentd-windows                | v3.22.6 |
+| gateway-api-envoy-gateway      | v3.22.6 |
+| gateway-api-envoy-proxy        | v3.22.6 |
+| gateway-api-envoy-ratelimit    | v3.22.6 |
+| gateway-l7-collector           | v3.22.6 |
+| guardian                       | v3.22.6 |
+| ingress-collector              | v3.22.6 |
+| intrusion-detection-controller | v3.22.6 |
+| istio-install-cni              | v3.22.6 |
+| istio-pilot                    | v3.22.6 |
+| istio-proxyv2                  | v3.22.6 |
+| istio-ztunnel                  | v3.22.6 |
+| key-cert-provisioner           | v3.22.6 |
+| kibana                         | v3.22.6 |
+| kube-controllers               | v3.22.6 |
+| l7-admission-controller        | v3.22.6 |
+| l7-collector                   | v3.22.6 |
+| license-agent                  | v3.22.6 |
+| linseed                        | v3.22.6 |
+| manager                        | v3.22.6 |
+| node                           | v3.22.6 |
+| node-windows                   | v3.22.6 |
+| packetcapture                  | v3.22.6 |
+| policy-recommendation          | v3.22.6 |
+| prometheus                     | v3.22.6 |
+| prometheus-config-reloader     | v3.22.6 |
+| prometheus-operator            | v3.22.6 |
+| queryserver                    | v3.22.6 |
+| tigera-cni                     | v3.22.6 |
+| tigera-cni-windows             | v3.22.6 |
+| tigera-prometheus-service      | v3.22.6 |
+| typha                          | v3.22.6 |
+| ui-apis                        | v3.22.6 |
+| upstream-istio                 | 1.28.1  |
+| voltron                        | v3.22.6 |
+| waf-http-filter                | v3.22.6 |
+| webhooks-processor             | v3.22.6 |
+
 ## Component versions for <!-- -->Calico Enterprise<!-- --> <!-- -->3.22.5[​](#component-versions-v3.22.5)
 
 [Release archive](https://downloads.tigera.io/ee/archives/release-v3.22.5-v1.40.11.tgz) <!-- -->with Kubernetes manifests. Based on Calico <!-- -->v3.31<!-- -->.
@@ -80491,7 +80575,7 @@ May 6, 2026
 
 To update an existing installation of Calico Enterprise 3.22, see [Install a patch release](https://docs.tigera.io/calico-enterprise/latest/getting-started/manifest-archive).
 
-### Calico Enterprise 3.22.5[​](#calico-enterprise-3225)
+### Calico Enterprise 3.22.5 bug fix release[​](#calico-enterprise-3225-bug-fix-release)
 
 May 20, 2026
 
@@ -80507,3 +80591,18 @@ May 20, 2026
 - Fixes an issue where Felix makes unnecessary calls to nft when running in iptables mode.
 
 To update an existing installation of Calico Enterprise 3.22, see [Install a patch release](https://docs.tigera.io/calico-enterprise/latest/getting-started/manifest-archive).
+
+### Calico Enterprise 3.22.6 bug fix release[​](#calico-enterprise-3226-bug-fix-release)
+
+June 17, 2026
+
+#### Bug fixes[​](#bug-fixes-7)
+
+- Fixed an RBAC error that could prevent the operator from creating secrets in the `tigera-manager` namespace on fresh installs with the `Authentication` resource configured.
+- Security updates.
+
+#### Known issues[​](#known-issues-4)
+
+- After an automatic Elasticsearch CA rotation, Elasticsearch nodes may fail to rejoin the cluster (and Kibana may fail to connect) with `PKIX path validation failed: Path does not chain with any of the trust anchors` errors in the logs. This is caused by an upstream ECK issue where a renewed certificate authority is assigned a new Subject Key Identifier, breaking the certificate trust chain across pods that have not yet restarted. To resolve or prevent the issue, delete the Elasticsearch transport (and, if Kibana is affected, HTTP) certificate secrets so that ECK regenerates all certificates under the current CA; Elasticsearch hot-reloads them without a pod restart. For detection and exact remediation steps, see [this Elastic support article](https://support.elastic.co/knowledge/5198af8e). A fix is included in Calico Enterprise 3.22.7.
+
+To update an existing installation of Calico Enterprise 3.22, see [Install a patch release](https://docs.tigera.io/calico-enterprise/latest/getting-started/manifest-archive).
diff --git a/static/calico/llms-full.txt b/static/calico/llms-full.txt
index 361017eb2f..fbb59b1189 100644
--- a/static/calico/llms-full.txt
+++ b/static/calico/llms-full.txt
@@ -1428,13 +1428,13 @@ In this step, you will install Calico in your cluster.
 1. Install the Calico custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
    ```
 
 2. Install the Tigera Operator.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    Expected output
@@ -1458,7 +1458,7 @@ In this step, you will install Calico in your cluster.
 3. Install Calico by creating the necessary custom resources.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
    Expected output
@@ -2195,9 +2195,9 @@ The geeky details of what you get:
 3. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 4. Configure the Calico installation.
@@ -2319,9 +2319,9 @@ Before you get started, make sure you have downloaded and configured the [necess
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 2. Configure the Calico installation.
@@ -2403,7 +2403,7 @@ Before you get started, make sure you have downloaded and configured the [necess
 1. Install the Calico manifest.
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-vxlan.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-vxlan.yaml
    ```
 
 2. Configure Calico to disable AWS src/dst checks.
@@ -2438,10 +2438,10 @@ Before you get started, make sure you have downloaded and configured the [necess
    kubectl create namespace tigera-operator
    ```
 
-4. Install version v3.32.0 of the Calico operator and custom resource definitions.
+4. Install version v3.32.1 of the Calico operator and custom resource definitions.
 
    ```batch
-   helm install calico projectcalico/tigera-operator --version v3.32.0 --namespace tigera-operator
+   helm install calico projectcalico/tigera-operator --version v3.32.1 --namespace tigera-operator
    ```
 
 5. Patch the CNI type with value `Calico`.
@@ -2732,9 +2732,9 @@ The geeky details of what you get:
 3. Install the Tigera Operator and custom resource definitions:
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 4. Complete the installation by providing the configuration for Calico
@@ -2872,9 +2872,9 @@ The geeky details of what you get:
 4. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 5. Complete the installation by providing the configuration for Calico
@@ -3077,7 +3077,7 @@ During this migration, you will save your current network policies, remove the A
 4. Install Calico. Note that, unlike most Calico installs, we do not install CRDs here because they may already exist. Operator will check and create any missing ones.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 5. Complete the installation by providing the configuration for Calico
@@ -3533,15 +3533,15 @@ worker-2 NotReady <none> 5s v1.17.2
 1. On the controller, install the Tigera Operator and custom resource definitions:
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
 ```
 
 2. Download the custom resources necessary to configure Calico
 
 ```bash
-curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml -O
+curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml -O
 ```
 
 3. If you wish to customize the Calico install, customize the downloaded custom-resources.yaml manifest. Then create the manifest to install Calico.
@@ -3826,9 +3826,9 @@ Calico can also be installed using raw manifests as an alternative to the operat
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 2. Download the custom resources necessary to configure Calico.
@@ -3839,11 +3839,11 @@ Calico can also be installed using raw manifests as an alternative to the operat
    - iptables
 
    ```shell
-   curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources-bpf.yaml
+   curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources-bpf.yaml
    ```
 
    ```shell
-   curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
    If you wish to customize the Calico install, customize the downloaded custom-resources.yaml manifest locally.
@@ -3915,13 +3915,13 @@ Calico can also be installed using raw manifests as an alternative to the operat
 **Tab: Manifest (v3 CRDs)**
 
 ```shell
-curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources-bpf.yaml
+curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources-bpf.yaml
 ```
 
 **Tab: Migrate to v3 CRDs**
 
 ```shell
-curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
 ```
 
 **Tab: Manifest**
@@ -3987,7 +3987,7 @@ Native `projectcalico.org/v3` CRDs rely on MutatingAdmissionPolicies for default
 1. Download the Calico v3 CRD manifest.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-v3-crds.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-v3-crds.yaml -O
    ```
 
 2. If you are using pod CIDR `192.168.0.0/16`, skip to the next step. If you are using a different pod CIDR with kubeadm, no changes are required - Calico will automatically detect the CIDR based on the running configuration. For other platforms, make sure you uncomment the CALICO\_IPV4POOL\_CIDR variable in the manifest and set it to the same value as your chosen pod CIDR.
@@ -4098,13 +4098,13 @@ If you have an existing manifest-based Calico install using the legacy `crd.proj
 1. Install the v3 CRDs alongside the existing v1 CRDs.
 
    ```bash
-   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v3_projectcalico_org.yaml
+   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v3_projectcalico_org.yaml
    ```
 
 2. Install the DatastoreMigration CRD.
 
    ```bash
-   kubectl apply --server-side -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/kube-controllers/pkg/controllers/migration/crd/migration.projectcalico.org_datastoremigrations.yaml
+   kubectl apply --server-side -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/kube-controllers/pkg/controllers/migration/crd/migration.projectcalico.org_datastoremigrations.yaml
    ```
 
 3. Create a DatastoreMigration resource to start the migration. The migration controller copies all Calico resources from v1 CRDs to v3 CRDs.
@@ -4164,7 +4164,7 @@ If you have an existing manifest-based Calico install using the legacy `crd.proj
 8. Install the admission webhook resources. The Deployment, Service, RBAC, `MutatingAdmissionPolicy` resources, and `ValidatingWebhookConfiguration` are bundled into `calico-v3-crds.yaml` alongside the CRDs and core Calico components. Extract just the webhook resources with [`yq`](https://github.com/mikefarah/yq) and apply them, so the existing `calico-node` DaemonSet, `kube-controllers` Deployment, and `calico-typha` Deployment in your cluster (including the `CALICO_API_GROUP` env you set above) are not overwritten.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-v3-crds.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-v3-crds.yaml -O
 
    yq 'select(.metadata.name == "calico-webhooks" or .kind == "MutatingAdmissionPolicy" or .kind == "MutatingAdmissionPolicyBinding")' \
 
@@ -4262,7 +4262,7 @@ Based on your datastore and number of nodes, select a link below to install Cali
 1. Download the Calico networking manifest for the Kubernetes API datastore.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml -O
    ```
 
 2. If you are using pod CIDR `192.168.0.0/16`, skip to the next step. If you are using a different pod CIDR with kubeadm, no changes are required — Calico will automatically detect the CIDR based on the running configuration. For other platforms, make sure you uncomment the CALICO\_IPV4POOL\_CIDR variable in the manifest and set it to the same value as your chosen pod CIDR.
@@ -4290,7 +4290,7 @@ The geeky details of what you get:
 1. Download the Calico networking manifest for the Kubernetes API datastore.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-typha.yaml -o calico.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-typha.yaml -o calico.yaml
    ```
 
 2. If you are using pod CIDR `192.168.0.0/16`, skip to the next step. If you are using a different pod CIDR with kubeadm, no changes are required — Calico will automatically detect the CIDR based on the running configuration. For other platforms, make sure you uncomment the CALICO\_IPV4POOL\_CIDR variable in the manifest and set it to the same value as your chosen pod CIDR.
@@ -4349,7 +4349,7 @@ The geeky details of what you get:
 1. Download the Calico networking manifest for etcd.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-etcd.yaml -o calico.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-etcd.yaml -o calico.yaml
    ```
 
 2. If you are using pod CIDR `192.168.0.0/16`, skip to the next step. If you are using a different pod CIDR with kubeadm, no changes are required — Calico will automatically detect the CIDR based on the running configuration. For other platforms, make sure you uncomment the CALICO\_IPV4POOL\_CIDR variable in the manifest and set it to the same value as your chosen pod CIDR.
@@ -4576,13 +4576,13 @@ To use these manifests with a TLS-enabled etcd cluster you must do the following
    **Calico for policy and networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-etcd.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-etcd.yaml -O
    ```
 
    **Calico for policy and flannel for networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/canal.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal.yaml -O
    ```
 
 2. Within the `ConfigMap` section, uncomment the `etcd_ca`, `etcd_key`, and `etcd_cert` lines so that they look as follows.
@@ -4698,7 +4698,7 @@ Add a new container to the template.
 ```yaml
  - name: dikastes
 
- image: calico/dikastes:v3.32.0
+ image: calico/dikastes:v3.32.1
 
  args: ["server", "-l", "/var/run/dikastes/dikastes.sock", "-d", "/var/run/felix/nodeagent/socket"]
 
@@ -4763,7 +4763,7 @@ Add two new volumes.
 
 The volumes you added are used to create Unix domain sockets that allow communication between Envoy and Dikastes and between Dikastes and Felix. Once created, a Unix domain socket is an in-memory communications channel. The volumes are not used for any kind of stateful storage on disk.
 
-Refer to the [Calico ConfigMap manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-1.4.2.yaml) for an example with the above changes.
+Refer to the [Calico ConfigMap manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-1.4.2.yaml) for an example with the above changes.
 
 <!-- /tabs -->
 
@@ -5099,7 +5099,7 @@ ExecStart=/usr/bin/docker run --net=host --privileged \
 
  -v /etc/pki:/pki \
 
- calico/node:v3.32.0 /bin/calico-node -felix
+ calico/node:v3.32.1 /bin/calico-node -felix
 
 ExecStop=-/usr/bin/docker stop calico-node
 
@@ -5297,7 +5297,7 @@ This step requires Docker, but it can be run from any machine with Docker instal
 1. Use the following command to download the calico/node image.
 
    ```bash
-   docker pull calico/node:v3.32.0
+   docker pull calico/node:v3.32.1
    ```
 
 2. Confirm that the image has loaded by typing `docker images`.
@@ -5305,13 +5305,13 @@ This step requires Docker, but it can be run from any machine with Docker instal
    ```bash
    REPOSITORY TAG IMAGE ID CREATED SIZE
 
-   calico/node v3.32.0 e07d59b0eb8a 2 minutes ago 42MB
+   calico/node v3.32.1 e07d59b0eb8a 2 minutes ago 42MB
    ```
 
 3. Create a temporary calico/node container.
 
    ```bash
-   docker create --name container calico/node:v3.32.0
+   docker create --name container calico/node:v3.32.1
    ```
 
 4. Copy the calico-node binary from the container to the local file system.
@@ -5652,7 +5652,7 @@ Download the <!-- -->Calico<!-- --> manifests for OpenShift and add them to the
 ```bash
 mkdir calico
 
-wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.0/ocp.tgz | \
+wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | \
 
 tar xvz --strip-components=1 -C calico
 
@@ -5806,7 +5806,7 @@ spec:
 
  sourceNamespace: openshift-marketplace
 
- startingCSV: tigera-operator.v1.42.0
+ startingCSV: tigera-operator.v1.42.3
 
 EOF
 ```
@@ -5950,7 +5950,7 @@ Download the <!-- -->Calico<!-- --> manifests for OpenShift:
 ```bash
 mkdir calico
 
-wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.0/ocp.tgz | \
+wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | \
 
 tar xvz --strip-components=1 -C calico
 ```
@@ -6153,7 +6153,7 @@ Download the Calico manifests for OpenShift.
 ```bash
 mkdir calico
 
-wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.0/ocp.tgz | tar xvz --strip-components=1 -C calico
+wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | tar xvz --strip-components=1 -C calico
 
 cd calico
 ```
@@ -6319,9 +6319,9 @@ The geeky details of what you get:
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -6329,7 +6329,7 @@ The geeky details of what you get:
 2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
    > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to change the default IP pool CIDR to match your pod network CIDR. Rancher uses `10.42.0.0/16` by default.
@@ -6398,7 +6398,7 @@ The procedure differs according to your datastore type. Refer to the section tha
 2. Download the flannel networking manifest for the Kubernetes API datastore.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/canal.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal.yaml -O
    ```
 
 3. If your cluster is configured to use pod CIDR `10.244.0.0/16`, skip to the next step. If your cluster is configured to use a different pod CIDR, replace `10.244.0.0/16` in the downloaded manifest with the correct pod CIDR.
@@ -6426,7 +6426,7 @@ We strongly recommend using the Kubernetes API datastore, but if you prefer to u
 1. Download the Calico networking manifest.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/canal-etcd.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal-etcd.yaml -O
    ```
 
 2. If your cluster is configured to use pod CIDR `10.244.0.0/16`, skip to the next step. If your cluster is configured to use a different pod CIDR, replace `10.244.0.0/16` in the downloaded manifest with the correct pod CIDR.
@@ -6520,13 +6520,13 @@ There are two ways to switch your cluster to use Calico networking. Both methods
 1. Install Calico.
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/flannel-migration/calico.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/flannel-migration/calico.yaml
    ```
 
 2. Start the migration controller.
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/flannel-migration/migration-job.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/flannel-migration/migration-job.yaml
    ```
 
    You will see nodes begin to update one at a time.
@@ -6548,7 +6548,7 @@ There are two ways to switch your cluster to use Calico networking. Both methods
 4. Delete the migration controller.
 
    ```bash
-   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/flannel-migration/migration-job.yaml
+   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/flannel-migration/migration-job.yaml
    ```
 
 ### Modify flannel configuration[​](#modify-flannel-configuration)
@@ -6594,9 +6594,9 @@ If you need to revert a cluster from Calico back to flannel, follow these steps.
 1. Remove the migration controller and Calico.
 
    ```bash
-   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/flannel-migration/migration-job.yaml
+   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/flannel-migration/migration-job.yaml
 
-   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/flannel-migration/calico.yaml
+   kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/flannel-migration/calico.yaml
    ```
 
 2. Determine the nodes that were migrated to Calico.
@@ -7421,9 +7421,9 @@ The following steps will outline the installation of Calico networking on the RK
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -7431,7 +7431,7 @@ The following steps will outline the installation of Calico networking on the RK
 2. Download the necessary Installation custom resources.
 
    ```bash
-   wget https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   wget https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
 3. Update the `calicoNetwork` options, ensuring that the correct pod CIDR is set. (Rancher uses `10.42.0.0/16` by default.) Below are sample installations for VXLAN and BGP networking using the default Rancher pod CIDR:
@@ -8666,9 +8666,9 @@ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC="--fla
 1. Install the Calico operator and custom resource definitions.
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
 ```
 
 > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Therefore, it is recommended to use `kubectl create` or `kubectl replace`.
@@ -8676,7 +8676,7 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api).
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
 ```
 
 > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to change the default IP pool CIDR to match your pod network CIDR.
@@ -8686,10 +8686,10 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 Install Calico by using the following command.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
 ```
 
-> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml).
+> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml).
 
 You should see the following output.
 
@@ -8893,9 +8893,9 @@ curl -sfL https://get.k3s.io | K3S_URL=https://serverip:6443 K3S_TOKEN=mytoken s
 Install the Calico operator and custom resource definitions.
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
 ```
 
 > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -8903,7 +8903,7 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api).
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
 ```
 
 > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to change the default IP pool CIDR to match your pod network CIDR.
@@ -8913,10 +8913,10 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 Install Calico by using the following command.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
 ```
 
-> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml).
+> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml).
 
 You should see the following output.
 
@@ -9131,13 +9131,13 @@ For more information about configurable options via `values.yaml` please see [He
 2. Install the necessary custom resource definitions.
 
    ```bash
-   helm template calico-crds projectcalico/crd.projectcalico.org.v1 --version v3.32.0 | kubectl apply --server-side -f -
+   helm template calico-crds projectcalico/crd.projectcalico.org.v1 --version v3.32.1 | kubectl apply --server-side -f -
    ```
 
    > **SUCCESS:** To install with [native v3 CRDs](https://docs.tigera.io/calico/latest/operations/native-v3-crds) (tech preview) instead, use the v3 CRD chart:
    >
    > ```bash
-   > helm template calico-crds projectcalico/projectcalico.org.v3 --version v3.32.0 | kubectl apply --server-side -f -
+   > helm template calico-crds projectcalico/projectcalico.org.v3 --version v3.32.1 | kubectl apply --server-side -f -
    > ```
    >
    > Native v3 CRDs eliminate the need for the aggregation API server and allows `kubectl` to manage `projectcalico.org/v3` resources directly.
@@ -9145,13 +9145,13 @@ For more information about configurable options via `values.yaml` please see [He
 3. Install the Tigera Operator using the Helm chart:
 
    ```bash
-   helm install calico projectcalico/tigera-operator --version v3.32.0 --namespace tigera-operator
+   helm install calico projectcalico/tigera-operator --version v3.32.1 --namespace tigera-operator
    ```
 
    or if you created a `values.yaml` above:
 
    ```bash
-   helm install calico projectcalico/tigera-operator --version v3.32.0 -f values.yaml --namespace tigera-operator
+   helm install calico projectcalico/tigera-operator --version v3.32.1 -f values.yaml --namespace tigera-operator
    ```
 
 4. Confirm that all of the pods are running with the following command.
@@ -9253,9 +9253,9 @@ The geeky details of what you get:
 1. Install the Tigera Operator and custom resource definitions.
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -9263,7 +9263,7 @@ The geeky details of what you get:
 2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api).
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources-bpf.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources-bpf.yaml
    ```
 
    This will complete the Calico Open Source installation with the eBPF data plane as the default.
@@ -9460,9 +9460,9 @@ minikube start --cni=calico
 2. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -9472,7 +9472,7 @@ minikube start --cni=calico
    > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, if you have replaced `pod-network-cidr` you must change it in this file as well.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
 **Tab: Manifest**
@@ -9486,7 +9486,7 @@ minikube start --network-plugin=cni
 Install Calico.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
 ```
 
 <!-- /tabs -->
@@ -9638,9 +9638,9 @@ dev-worker2 NotReady <none> 4m v1.25.0 172.18.0.3 <none> Ubuntu 22.04.1 LTS 5.10
 1. Install the Calico operator and custom resource definitions.
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
 ```
 
 2. Install Calico by creating the necessary custom resource. For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api).
@@ -9648,7 +9648,7 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 > **SECONDARY:** Before creating this manifest, read its contents and make sure its settings are correct for your environment. For example, if you have replaced `pod-network-cidr` you must change it in this file as well.
 
 ```bash
-kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
 ```
 
 **Tab: Manifest**
@@ -9656,12 +9656,12 @@ kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0
 Install Calico by using the following command.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
 ```
 
 > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
 
-> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml).
+> **SECONDARY:** You can also [view the YAML in a new tab](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml).
 
 You should see the following output.
 
@@ -9939,7 +9939,7 @@ To use Kubernetes as the Calico datastore, we need to define the custom resource
 Download and examine the list of Calico custom resource definitions, and open it in a file editor.
 
 ```bash
-wget https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/crds.yaml
+wget https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/crds.yaml
 ```
 
 Create the custom resource definitions in Kubernetes.
@@ -12602,7 +12602,7 @@ Calico uses a Container Storage Interface (CSI) driver to enable secure connecti
 Execute the following command to install the CSI driver.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/csi-driver.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/csi-driver.yaml
 ```
 
 Verify the `csi-node-driver` pods are running.
@@ -12696,7 +12696,7 @@ Starting in Calico v3.28, a change in the way UIDs are generated for projectcali
 1. Apply the v3.32 CRDs:
 
    ```bash
-   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
    ```
 
 2. Run the Helm upgrade:
@@ -12710,9 +12710,9 @@ Starting in Calico v3.28, a change in the way UIDs are generated for projectcali
 1. Download the Tigera Operator manifest and custom resource definitions.
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml -O
 
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml -O
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml -O
    ```
 
 2. Use the following command to initiate an upgrade.
@@ -12758,19 +12758,19 @@ Starting in Calico v3.28, a change in the way UIDs are generated for projectcali
    **Calico for policy and networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml -o upgrade.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml -o upgrade.yaml
    ```
 
    **Calico for policy and flannel for networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/canal.yaml -o upgrade.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal.yaml -o upgrade.yaml
    ```
 
    **Calico for policy (advanced)**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-policy-only.yaml -o upgrade.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-policy-only.yaml -o upgrade.yaml
    ```
 
    > **SECONDARY:** If you manually modified the manifest, you must manually apply the same changes to the downloaded manifest.
@@ -12820,13 +12820,13 @@ Starting in Calico v3.28, a change in the way UIDs are generated for projectcali
    **Calico for policy and networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-etcd.yaml -o upgrade.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-etcd.yaml -o upgrade.yaml
    ```
 
    **Calico for policy and flannel for networking**
 
    ```bash
-   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/canal-etcd.yaml -o upgrade.yaml
+   curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal-etcd.yaml -o upgrade.yaml
    ```
 
    > **SECONDARY:** You must manually apply the changes you made to the manifest during installation to the downloaded v3.32 manifest. At a minimum, you must set the `etcd_endpoints` value.
@@ -12882,7 +12882,7 @@ If you have [enabled application layer policy](https://docs.tigera.io/calico/lat
 1. Update the Istio sidecar injector template to use the new version of Dikastes. Replace `<your Istio version>` below with the full version string of your Istio install, for example `1.4.2`.
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-<your Istio version>.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-<your Istio version>.yaml
    ```
 
 2. Once the new template is in place, newly created pods use the upgraded version of Dikastes. Perform a rolling update of each of your service deployments to get them on the new version of Dikastes.
@@ -12934,7 +12934,7 @@ Starting in Calico v3.28, a change in the way UIDs are generated for projectcali
 Apply the updated manifests.
 
 ```bash
-oc apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator-ocp-upgrade.yaml
+oc apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator-ocp-upgrade.yaml
 ```
 
 Optional: To enable the flow logs API and Calico Whisker (introduced in version 3.30), apply the `Goldmane` and `Whisker` custom resources.
@@ -14004,7 +14004,7 @@ EOF
 When the main install guide tells you to apply the `custom-resources.yaml`, typically by running `kubectl create` with the URL of the file directly, you should instead download the file, so that you can edit it:
 
 ```bash
- curl -o custom-resources.yaml https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+ curl -o custom-resources.yaml https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
 ```
 
 Edit the file in your editor of choice and find the `Installation` resource, which should be at the top of the file. To enable eBPF mode, we need to add a new `calicoNetwork` section inside the `spec` of the Installation resource, including the `linuxDataplane` field. For EKS Bottlerocket OS only, you should also add the `flexVolumePath` setting as shown below.
@@ -14769,9 +14769,9 @@ Kubernetes introduced a beta status [kube-proxy Service implementation based on
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -14987,9 +14987,9 @@ Before you get started, make sure you have downloaded and configured the [necess
 1. Now that you have an empty cluster configured, you can install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -14999,13 +14999,13 @@ Before you get started, make sure you have downloaded and configured the [necess
    > **SECONDARY:** Before applying this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to specify the default IP pool CIDR to match your desired pod network CIDR.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/calico/installation-eks.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/calico/installation-eks.yaml
    ```
 
 3. Now is time to install the VPP data plane components.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/generated/calico-vpp-eks.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/generated/calico-vpp-eks.yaml
    ```
 
 4. Finally, add nodes to the cluster.
@@ -15022,7 +15022,7 @@ Before you get started, make sure you have downloaded and configured the [necess
 
 ### Requirements[​](#requirements-1)
 
-DPDK provides better performance compared to the standard install but it requires some additional customisations (hugepages, for instance) in the EKS worker instances. We have a bash script, [init\_eks.sh](https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/scripts/init_eks.sh), which takes care of applying the required customizations and we make use of the `preBootstrapCommands` property of `eksctl` [configuration file](https://eksctl.io/usage/schema) to execute the script during the worker node creation. These instructions require the latest version of `eksctl`.
+DPDK provides better performance compared to the standard install but it requires some additional customisations (hugepages, for instance) in the EKS worker instances. We have a bash script, [init\_eks.sh](https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/scripts/init_eks.sh), which takes care of applying the required customizations and we make use of the `preBootstrapCommands` property of `eksctl` [configuration file](https://eksctl.io/usage/schema) to execute the script during the worker node creation. These instructions require the latest version of `eksctl`.
 
 ### Provision the cluster[​](#provision-the-cluster-1)
 
@@ -15043,9 +15043,9 @@ DPDK provides better performance compared to the standard install but it require
 1. Now that you have an empty cluster configured, you can install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -15055,13 +15055,13 @@ DPDK provides better performance compared to the standard install but it require
    > **SECONDARY:** Before applying this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to specify the default IP pool CIDR to match your desired pod network CIDR.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/calico/installation-eks.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/calico/installation-eks.yaml
    ```
 
 3. Now is time to install the VPP data plane components.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/generated/calico-vpp-eks-dpdk.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/generated/calico-vpp-eks-dpdk.yaml
    ```
 
 4. Finally, time to add nodes to the cluster. Since we need to customize the nodes for DPDK, we will use an `eksctl` config file with the `preBootstrapCommands` property to create the worker nodes. The following command will create a managed nodegroup with 2 t3.large worker nodes in the cluster:
@@ -15091,7 +15091,7 @@ DPDK provides better performance compared to the standard install but it require
 
     preBootstrapCommands:
 
-    - sudo curl -o /tmp/init_eks.sh "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/scripts/init_eks.sh"
+    - sudo curl -o /tmp/init_eks.sh "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/scripts/init_eks.sh"
 
     - sudo chmod +x /tmp/init_eks.sh
 
@@ -15155,9 +15155,9 @@ For some hardware, the following hugepages configuration may enable VPP to use m
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -15167,7 +15167,7 @@ For some hardware, the following hugepages configuration may enable VPP to use m
    > **SECONDARY:** Before applying this manifest, read its contents and make sure its settings are correct for your environment. For example, you may need to specify the default IP pool CIDR to match your desired pod network CIDR.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/calico/installation-default.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/calico/installation-default.yaml
    ```
 
 ### Install the VPP data plane components[​](#install-the-vpp-data-plane-components)
@@ -15177,13 +15177,13 @@ Start by getting the appropriate yaml manifest file for the VPP data plane resou
 ```bash
 # If you have configured hugepages on your machines
 
-curl -o calico-vpp.yaml https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/generated/calico-vpp.yaml
+curl -o calico-vpp.yaml https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/generated/calico-vpp.yaml
 ```
 
 ```bash
 # If not, or if you're unsure
 
-curl -o calico-vpp.yaml https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/generated/calico-vpp-nohuge.yaml
+curl -o calico-vpp.yaml https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/generated/calico-vpp-nohuge.yaml
 ```
 
 Then locate the `calico-vpp-config` ConfigMap in this yaml manifest file and configure it as follows.
@@ -15682,7 +15682,7 @@ Download the <!-- -->Calico<!-- --> manifests for OpenShift and add them to the
 ```bash
 mkdir calico
 
-wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.0/ocp.tgz | \
+wget -qO- https://github.com/projectcalico/calico/releases/download/v3.32.1/ocp.tgz | \
 
 tar xvz --exclude=ocp/01-configmap-kubernetes-services-endpoint.yaml --exclude=ocp/cluster-network-operator.yaml --strip-components=1 -C calico
 
@@ -15696,19 +15696,19 @@ mkdir vpp
 
 cd vpp
 
-curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/00-namespace-calico-vpp-dataplane.yaml"
+curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/00-namespace-calico-vpp-dataplane.yaml"
 
-curl -o 03-cr-installation.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/01-cr-installation.yaml"
+curl -o 03-cr-installation.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/01-cr-installation.yaml"
 
-curl -o 02-configmap-calico-vpp-resources.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/03-configmap-calico-vpp-resources.yaml"
+curl -o 02-configmap-calico-vpp-resources.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-configmap-calico-vpp-resources.yaml"
 
-curl -o 02-role-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/03-role-calico-vpp-dataplane.yaml"
+curl -o 02-role-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-role-calico-vpp-dataplane.yaml"
 
-curl -o 02-rolebinding-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/03-rolebinding-calico-vpp-dataplane.yaml"
+curl -o 02-rolebinding-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-rolebinding-calico-vpp-dataplane.yaml"
 
-curl -o 02-serviceaccount-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/03-serviceaccount-calico-vpp-dataplane.yaml"
+curl -o 02-serviceaccount-calico-vpp-dataplane.yaml "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/03-serviceaccount-calico-vpp-dataplane.yaml"
 
-curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/yaml/platforms/openshift/04-calico-vpp-nohuge.yaml"
+curl -O "https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/yaml/platforms/openshift/04-calico-vpp-nohuge.yaml"
 
 cd ..
 
@@ -15814,7 +15814,7 @@ spec:
 
  sourceNamespace: openshift-marketplace
 
- startingCSV: tigera-operator.v1.42.0
+ startingCSV: tigera-operator.v1.42.3
 
 EOF
 ```
@@ -17537,7 +17537,7 @@ EOF
 
 ## Customizing an ingress gateway with a custom Envoy configuration[​](#customizing-an-ingress-gateway-with-a-custom-envoy-configuration)
 
-For greater control over your ingress gateway deployment, you can create a custom Envoy configuration file using any configuration supported by Envoy Gateway 1.5.6. Such changes are not validated by the Tigera Operator, and they require a high level of comfort with using Envoy Gateway.
+For greater control over your ingress gateway deployment, you can create a custom Envoy configuration file using any configuration supported by Envoy Gateway 1.8.0. Such changes are not validated by the Tigera Operator, and they require a high level of comfort with using Envoy Gateway.
 
 ### Customize the Envoy configuration for your ingress gateway[​](#customize-the-envoy-configuration-for-your-ingress-gateway)
 
@@ -17902,11 +17902,11 @@ We'll use `kind` to create this environment, but you can use any other supported
 3. Install Calico Open Source by adding custom resource definitions, the Tigera Operator, and the custom resources.
 
    ```text
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
 
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
 4. Monitor the deployment by running the following command:
@@ -32134,10 +32134,10 @@ kubectl apply -f istio-with-dikastes.yaml
 Configure Istio's Envoy proxies to use Dikastes as an external authorization service.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-app-layer-policy-envoy-v3.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-app-layer-policy-envoy-v3.yaml
 ```
 
-[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-app-layer-policy-envoy-v3.yaml)
+[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-app-layer-policy-envoy-v3.yaml)
 
 This manifest creates:
 
@@ -32401,22 +32401,22 @@ If you need to use the legacy ConfigMap patching method for Istio 1.15 or 1.10:
 ### For Istio v1.15.x:[​](#for-istio-v115x)
 
 ```bash
-curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-1.15.yaml -o istio-inject-configmap.yaml
+curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-1.15.yaml -o istio-inject-configmap.yaml
 
 kubectl patch configmap -n istio-system istio-sidecar-injector --patch "$(cat istio-inject-configmap.yaml)"
 ```
 
-[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-1.15.yaml)
+[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-1.15.yaml)
 
 ### For Istio v1.10.x:[​](#for-istio-v110x)
 
 ```bash
-curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-1.10.yaml -o istio-inject-configmap.yaml
+curl https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-1.10.yaml -o istio-inject-configmap.yaml
 
 kubectl patch configmap -n istio-system istio-sidecar-injector --patch "$(cat istio-inject-configmap.yaml)"
 ```
 
-[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/alp/istio-inject-configmap-1.10.yaml)
+[View sample manifest](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/alp/istio-inject-configmap-1.10.yaml)
 
 **Drawbacks of ConfigMap patching**:
 
@@ -34898,19 +34898,19 @@ You can run `calicoctl` on any host with network access to the Calico datastore
    - AMD64:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-amd64 -o calicoctl
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-amd64 -o calicoctl
      ```
 
    - ARM64:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-arm64 -o calicoctl
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-arm64 -o calicoctl
      ```
 
    - PPC64le:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-ppc64le -o calicoctl
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-ppc64le -o calicoctl
      ```
 
 3. Set the file to be executable.
@@ -34932,13 +34932,13 @@ You can run `calicoctl` on any host with network access to the Calico datastore
    - ARM64 (Apple Silicon):
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-darwin-arm64 -o calicoctl
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-arm64 -o calicoctl
      ```
 
    - AMD64 (Intel):
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-darwin-amd64 -o calicoctl
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-amd64 -o calicoctl
      ```
 
 3. Set the file to be executable.
@@ -34958,7 +34958,7 @@ You can run `calicoctl` on any host with network access to the Calico datastore
    > **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`.
 
 ```text
-Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe"
+Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-windows-amd64.exe" -OutFile "calicoctl.exe"
 ```
 
 <!-- /tabs -->
@@ -34978,19 +34978,19 @@ Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/downloa
    - AMD64:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-amd64 -o kubectl-calico
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-amd64 -o kubectl-calico
      ```
 
    - ARM64:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-arm64 -o kubectl-calico
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-arm64 -o kubectl-calico
      ```
 
    - PPC64le:
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-linux-ppc64le -o kubectl-calico
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-ppc64le -o kubectl-calico
      ```
 
 3. Set the file to be executable.
@@ -35012,13 +35012,13 @@ Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/downloa
    - ARM64 (Apple Silicon):
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-darwin-arm64 -o kubectl-calico
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-arm64 -o kubectl-calico
      ```
 
    - AMD64 (Intel):
 
      ```text
-     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-darwin-amd64 -o kubectl-calico
+     curl -L https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-darwin-amd64 -o kubectl-calico
      ```
 
 3. Set the file to be executable.
@@ -35038,7 +35038,7 @@ Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/downloa
    > **SUCCESS:** Consider running PowerShell as administrator and navigating to a location that's in your `PATH`. For example, `C:\Windows`.
 
 ```text
-Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/download/v3.32.0/calicoctl-windows-amd64.exe" -OutFile kubectl-calico.exe
+Invoke-WebRequest -Uri "https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-windows-amd64.exe" -OutFile kubectl-calico.exe
 ```
 
 <!-- /tabs -->
@@ -35058,7 +35058,7 @@ You can now run any `calicoctl` subcommands through `kubectl calico`.
 To install `calicoctl` as a container on a single host, log into the target host and issue the following command.
 
 ```bash
-docker pull calico/ctl:v3.32.0
+docker pull calico/ctl:v3.32.1
 ```
 
 **Next step**:
@@ -35530,9 +35530,9 @@ Before applying `tigera-operator.yaml`, modify the operator deployment to use th
 Use commands like the following to get the image digest (adjust the image in the commands if you are using a different operator image):
 
 ```bash
-docker pull quay.io/tigera/operator:v1.42.0
+docker pull quay.io/tigera/operator:v1.42.3
 
-docker inspect quay.io/tigera/operator:v1.42.0 -f '{{range .RepoDigests}}{{printf "%s\n" .}}{{end}}'
+docker inspect quay.io/tigera/operator:v1.42.3 -f '{{range .RepoDigests}}{{printf "%s\n" .}}{{end}}'
 ```
 
 If multiple digests are returned, select the one matching the registry you are using.
@@ -35554,7 +35554,7 @@ kind: ImageSet
 
 metadata:
 
- name: calico-v3.32.0
+ name: calico-v3.32.1
 
 spec:
 
@@ -35605,10 +35605,10 @@ You can create an ImageSet manifest manually or by script.
 
 1. Copy the above example into a file called `imageset.yaml` and edit that file in the steps below.
 
-2. Set the name for your ImageSet to `calico-<version>` (Example: `calico-v3.32.0`). The version can be obtained by running:
+2. Set the name for your ImageSet to `calico-<version>` (Example: `calico-v3.32.1`). The version can be obtained by running:
 
    ```text
-   docker run quay.io/tigera/operator:v1.42.0 --version
+   docker run quay.io/tigera/operator:v1.42.3 --version
    ```
 
 3. Add the correct digest for each image. If you are using a private registry, ensure you pull the image from the private registry and use the digest associated with the private registry.
@@ -35616,7 +35616,7 @@ You can create an ImageSet manifest manually or by script.
    1. If using the default images, get a list of them by running:
 
       ```text
-      docker run quay.io/tigera/operator:v1.42.0 --print-images=list
+      docker run quay.io/tigera/operator:v1.42.3 --print-images=list
       ```
 
       > **SECONDARY:** If you are not using the default image registries or paths, you must create your own list of images (and the above command will not apply).
@@ -35644,7 +35644,7 @@ Copy the following script into a file, make it executable, and run the script. T
 
 images=(calico/apiserver calico/cni calico/kube-controllers calico/node calico/typha calico/pod2daemon-flexvol calico/node-windows tigera/key-cert-provisioner tigera/operator)
 
-OPERATOR_IMAGE=quay.io/tigera/operator:v1.42.0
+OPERATOR_IMAGE=quay.io/tigera/operator:v1.42.3
 
 echo "Pulling $OPERATOR_IMAGE"
 
@@ -35724,7 +35724,7 @@ Apply the created `imageset.yaml` to your cluster.
    You should see output similar to:
 
    ```yaml
-   imageSet: calico-v3.32.0
+   imageSet: calico-v3.32.1
    ```
 
 ## Other tasks[​](#other-tasks)
@@ -35787,97 +35787,97 @@ To install images from your registry, you must first pull the images from Tigera
 1. Use the following commands to pull the required <!-- -->Calico<!-- --> images.
 
 2. ```bash
-   docker pull quay.io/tigera/operator:v1.42.0
+   docker pull quay.io/tigera/operator:v1.42.3
 
-   docker pull quay.io/calico/node:v3.32.0
+   docker pull quay.io/calico/node:v3.32.1
 
-   docker pull quay.io/calico/cni:v3.32.0
+   docker pull quay.io/calico/cni:v3.32.1
 
-   docker pull quay.io/calico/apiserver:v3.32.0
+   docker pull quay.io/calico/apiserver:v3.32.1
 
-   docker pull quay.io/calico/kube-controllers:v3.32.0
+   docker pull quay.io/calico/kube-controllers:v3.32.1
 
-   docker pull quay.io/calico/envoy-gateway:v3.32.0
+   docker pull quay.io/calico/envoy-gateway:v3.32.1
 
-   docker pull quay.io/calico/envoy-proxy:v3.32.0
+   docker pull quay.io/calico/envoy-proxy:v3.32.1
 
-   docker pull quay.io/calico/envoy-ratelimit:v3.32.0
+   docker pull quay.io/calico/envoy-ratelimit:v3.32.1
 
-   docker pull quay.io/calico/dikastes:v3.32.0
+   docker pull quay.io/calico/dikastes:v3.32.1
 
-   docker pull quay.io/calico/pod2daemon-flexvol:v3.32.0
+   docker pull quay.io/calico/pod2daemon-flexvol:v3.32.1
 
-   docker pull quay.io/calico/key-cert-provisioner:v3.32.0
+   docker pull quay.io/calico/key-cert-provisioner:v3.32.1
 
-   docker pull quay.io/calico/goldmane:v3.32.0
+   docker pull quay.io/calico/goldmane:v3.32.1
 
-   docker pull quay.io/calico/whisker:v3.32.0
+   docker pull quay.io/calico/whisker:v3.32.1
 
-   docker pull quay.io/calico/whisker-backend:v3.32.0
+   docker pull quay.io/calico/whisker-backend:v3.32.1
    ```
 
    Retag the images with the name of your registry `$REGISTRY`.
 
 3. ```bash
-   docker tag quay.io/tigera/operator:v1.42.0 $REGISTRY/tigera/operator:v1.42.0
+   docker tag quay.io/tigera/operator:v1.42.3 $REGISTRY/tigera/operator:v1.42.3
 
-   docker tag quay.io/calico/node:v3.32.0 $REGISTRY/calico/node:v3.32.0
+   docker tag quay.io/calico/node:v3.32.1 $REGISTRY/calico/node:v3.32.1
 
-   docker tag quay.io/calico/cni:v3.32.0 $REGISTRY/calico/cni:v3.32.0
+   docker tag quay.io/calico/cni:v3.32.1 $REGISTRY/calico/cni:v3.32.1
 
-   docker tag quay.io/calico/apiserver:v3.32.0 $REGISTRY/calico/apiserver:v3.32.0
+   docker tag quay.io/calico/apiserver:v3.32.1 $REGISTRY/calico/apiserver:v3.32.1
 
-   docker tag quay.io/calico/kube-controllers:v3.32.0 $REGISTRY/calico/kube-controllers:v3.32.0
+   docker tag quay.io/calico/kube-controllers:v3.32.1 $REGISTRY/calico/kube-controllers:v3.32.1
 
-   docker tag quay.io/calico/envoy-gateway:v3.32.0 $REGISTRY/calico/envoy-gateway:v3.32.0
+   docker tag quay.io/calico/envoy-gateway:v3.32.1 $REGISTRY/calico/envoy-gateway:v3.32.1
 
-   docker tag quay.io/calico/envoy-proxy:v3.32.0 $REGISTRY/calico/envoy-proxy:v3.32.0
+   docker tag quay.io/calico/envoy-proxy:v3.32.1 $REGISTRY/calico/envoy-proxy:v3.32.1
 
-   docker tag quay.io/calico/envoy-ratelimit:v3.32.0 $REGISTRY/calico/envoy-ratelimit:v3.32.0
+   docker tag quay.io/calico/envoy-ratelimit:v3.32.1 $REGISTRY/calico/envoy-ratelimit:v3.32.1
 
-   docker tag quay.io/calico/dikastes:v3.32.0 $REGISTRY/calico/dikastes:v3.32.0
+   docker tag quay.io/calico/dikastes:v3.32.1 $REGISTRY/calico/dikastes:v3.32.1
 
-   docker tag quay.io/calico/pod2daemon-flexvol:v3.32.0 $REGISTRY/calico/pod2daemon-flexvol:v3.32.0
+   docker tag quay.io/calico/pod2daemon-flexvol:v3.32.1 $REGISTRY/calico/pod2daemon-flexvol:v3.32.1
 
-   docker tag quay.io/calico/key-cert-provisioner:v3.32.0 $REGISTRY/calico/key-cert-provisioner:v3.32.0
+   docker tag quay.io/calico/key-cert-provisioner:v3.32.1 $REGISTRY/calico/key-cert-provisioner:v3.32.1
 
-   docker tag quay.io/calico/goldmane:v3.32.0 $REGISTRY/calico/goldmane:v3.32.0
+   docker tag quay.io/calico/goldmane:v3.32.1 $REGISTRY/calico/goldmane:v3.32.1
 
-   docker tag quay.io/calico/whisker:v3.32.0 $REGISTRY/calico/whisker:v3.32.0
+   docker tag quay.io/calico/whisker:v3.32.1 $REGISTRY/calico/whisker:v3.32.1
 
-   docker tag quay.io/calico/whisker-backend:v3.32.0 $REGISTRY/calico/whisker-backend:v3.32.0
+   docker tag quay.io/calico/whisker-backend:v3.32.1 $REGISTRY/calico/whisker-backend:v3.32.1
    ```
 
    Push the images to your registry.
 
 4. ```bash
-   docker push $REGISTRY/tigera/operator:v1.42.0
+   docker push $REGISTRY/tigera/operator:v1.42.3
 
-   docker push $REGISTRY/calico/node:v3.32.0
+   docker push $REGISTRY/calico/node:v3.32.1
 
-   docker push $REGISTRY/calico/cni:v3.32.0
+   docker push $REGISTRY/calico/cni:v3.32.1
 
-   docker push $REGISTRY/calico/apiserver:v3.32.0
+   docker push $REGISTRY/calico/apiserver:v3.32.1
 
-   docker push $REGISTRY/calico/kube-controllers:v3.32.0
+   docker push $REGISTRY/calico/kube-controllers:v3.32.1
 
-   docker push $REGISTRY/calico/envoy-gateway:v3.32.0
+   docker push $REGISTRY/calico/envoy-gateway:v3.32.1
 
-   docker push $REGISTRY/calico/envoy-proxy:v3.32.0
+   docker push $REGISTRY/calico/envoy-proxy:v3.32.1
 
-   docker push $REGISTRY/calico/envoy-ratelimit:v3.32.0
+   docker push $REGISTRY/calico/envoy-ratelimit:v3.32.1
 
-   docker push $REGISTRY/calico/dikastes:v3.32.0
+   docker push $REGISTRY/calico/dikastes:v3.32.1
 
-   docker push $REGISTRY/calico/pod2daemon-flexvol:v3.32.0
+   docker push $REGISTRY/calico/pod2daemon-flexvol:v3.32.1
 
-   docker push $REGISTRY/calico/key-cert-provisioner:v3.32.0
+   docker push $REGISTRY/calico/key-cert-provisioner:v3.32.1
 
-   docker push $REGISTRY/calico/goldmane:v3.32.0
+   docker push $REGISTRY/calico/goldmane:v3.32.1
 
-   docker push $REGISTRY/calico/whisker:v3.32.0
+   docker push $REGISTRY/calico/whisker:v3.32.1
 
-   docker push $REGISTRY/calico/whisker-backend:v3.32.0
+   docker push $REGISTRY/calico/whisker-backend:v3.32.1
    ```
 
    Use `crane cp` to copy the Windows images to your private registry.
@@ -35885,9 +35885,9 @@ To install images from your registry, you must first pull the images from Tigera
    For hybrid Linux + Windows clusters, use `crane cp` on the following Windows images to copy them to your private registry.
 
    ```bash
-   crane cp quay.io/calico/node-windows:v3.32.0 $REGISTRY/calico/node-windows:v3.32.0
+   crane cp quay.io/calico/node-windows:v3.32.1 $REGISTRY/calico/node-windows:v3.32.1
 
-   crane cp quay.io/calico/cni-windows:v3.32.0 $REGISTRY/calico/cni-windows:v3.32.0
+   crane cp quay.io/calico/cni-windows:v3.32.1 $REGISTRY/calico/cni-windows:v3.32.1
    ```
 
 ### Run the operator using images from your registry[​](#run-the-operator-using-images-from-your-registry)
@@ -35997,13 +35997,13 @@ The locked window is typically short (seconds to a few minutes depending on clus
    Apply the v3 CRD manifests from the Calico release. While the aggregated API service is active, Kubernetes ignores these CRDs, so this is safe to do ahead of time.
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v3_projectcalico_org.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v3_projectcalico_org.yaml
    ```
 
 2. **Install the DatastoreMigration CRD.**
 
    ```bash
-   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/kube-controllers/pkg/controllers/migration/crd/migration.projectcalico.org_datastoremigrations.yaml
+   kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/kube-controllers/pkg/controllers/migration/crd/migration.projectcalico.org_datastoremigrations.yaml
    ```
 
 3. **Create the DatastoreMigration CR.**
@@ -36244,9 +36244,9 @@ For existing clusters using the `calico.yaml` manifest to install Calico, upon i
 1. Install the Tigera Operator and custom resource definitions.
 
    ```bash
-   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v1_crd_projectcalico_org.yaml
+   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml
 
-   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
    > **SECONDARY:** Due to the large size of the CRD bundle, `kubectl apply` might exceed request limits. Instead, use `kubectl create` or `kubectl replace`.
@@ -36395,7 +36395,7 @@ Select the method below based on your installation method.
 1. Create the following manifest, which will install the API server as a deployment in the `calico-apiserver` namespace.
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/apiserver.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/apiserver.yaml
    ```
 
    You will notice that the API server remains in a `ContainerCreating` state, as it is waiting for credentials to be provided for authenticating the main Kubernetes API server.
@@ -36491,7 +36491,7 @@ To uninstall the API server, use the following instructions depending on your in
 **Tab: Manifest install**
 
 ```bash
- kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/apiserver.yaml
+ kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/apiserver.yaml
 ```
 
 <!-- /tabs -->
@@ -36570,7 +36570,7 @@ Select the method below based on your preferred installation method.
 3. Install the v3 CRD chart instead of the default v1 CRD chart:
 
    ```bash
-   helm template calico-crds projectcalico/projectcalico.org.v3 --version v3.32.0 | kubectl apply --server-side -f -
+   helm template calico-crds projectcalico/projectcalico.org.v3 --version v3.32.1 | kubectl apply --server-side -f -
    ```
 
    > **SECONDARY:** This replaces the `crd.projectcalico.org.v1` chart used in the default installation. Do not install both CRD charts.
@@ -36578,13 +36578,13 @@ Select the method below based on your preferred installation method.
 4. Install the Tigera Operator:
 
    ```bash
-   helm install calico projectcalico/tigera-operator --version v3.32.0 --namespace tigera-operator
+   helm install calico projectcalico/tigera-operator --version v3.32.1 --namespace tigera-operator
    ```
 
    If you have a `values.yaml` with custom configuration:
 
    ```bash
-   helm install calico projectcalico/tigera-operator --version v3.32.0 -f values.yaml --namespace tigera-operator
+   helm install calico projectcalico/tigera-operator --version v3.32.1 -f values.yaml --namespace tigera-operator
    ```
 
 **Tab: Manifest install**
@@ -36592,7 +36592,7 @@ Select the method below based on your preferred installation method.
 1. Install the v3 CRDs:
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/v3_projectcalico_org.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v3_projectcalico_org.yaml
    ```
 
    > **SECONDARY:** This replaces the `v1_crd_projectcalico_org.yaml` manifest used in the default installation. Do not install both CRD manifests.
@@ -36600,13 +36600,13 @@ Select the method below based on your preferred installation method.
 2. Install the Tigera Operator:
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/tigera-operator.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml
    ```
 
 3. Install Calico by creating the necessary custom resources:
 
    ```bash
-   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/custom-resources.yaml
+   kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml
    ```
 
 <!-- /tabs -->
@@ -37771,7 +37771,7 @@ EOF
 Here you will create a configmap with Felix and Typha dashboards.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/grafana-dashboards.yaml
+kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/grafana-dashboards.yaml
 ```
 
 #### **3. Creating Grafana pod**[​](#3-creating-grafana-pod)
@@ -38856,7 +38856,7 @@ If you're encountering issues with the VPP data plane, feel free to reach out to
 - With curl
 
   ```bash
-  curl https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.31.0/test/scripts/vppdev.sh | tee /usr/bin/calivppctl
+  curl https://raw.githubusercontent.com/projectcalico/vpp-dataplane/v3.32.0/test/scripts/vppdev.sh | tee /usr/bin/calivppctl
 
   chmod +x /usr/bin/calivppctl
   ```
@@ -45968,7 +45968,7 @@ Increasing conntrack limit
 
 Running the following command:
 
-docker run --net=host --privileged --name=calico-node -d --restart=always -e ETCD_SCHEME=http -e HOSTNAME=calico -e ETCD_AUTHORITY=127.0.0.1:2379 -e AS= -e NO_DEFAULT_POOLS= -e ETCD_ENDPOINTS= -e IP= -e IP6= -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins calico/node:v3.32.0
+docker run --net=host --privileged --name=calico-node -d --restart=always -e ETCD_SCHEME=http -e HOSTNAME=calico -e ETCD_AUTHORITY=127.0.0.1:2379 -e AS= -e NO_DEFAULT_POOLS= -e ETCD_ENDPOINTS= -e IP= -e IP6= -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins calico/node:v3.32.1
 
 Waiting for etcd connection...
 
@@ -51547,7 +51547,7 @@ Setting these will depend on the method used to deploy Kubernetes so refer to yo
 
 ## Updating a hosted Calico manifest[​](#updating-a-hosted-calico-manifest)
 
-To deploy Calico with the CA and Calico-specific certificate/key pair, use [this manifest template](https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico-etcd.yaml) with the modifications described below. The same information could be added to or updated in other manifests but the linked one is the most straight forward example.
+To deploy Calico with the CA and Calico-specific certificate/key pair, use [this manifest template](https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-etcd.yaml) with the modifications described below. The same information could be added to or updated in other manifests but the linked one is the most straight forward example.
 
 The pieces that would need updating are:
 
@@ -60087,7 +60087,7 @@ This is a rather advanced/experimental setup and we'll take the example of the A
    value: 'create interface avf 0000:ab:cd.1 num-rx-queues 1'
   ```
 
-In the specific case of the AVF driver, the PCI id must belong to a VF that can be created with the `avf.sh` [script](https://github.com/projectcalico/vpp-dataplane/blob/v3.31.0/test/scripts/utils/avf.sh). Different drivers will have different requirements.
+In the specific case of the AVF driver, the PCI id must belong to a VF that can be created with the `avf.sh` [script](https://github.com/projectcalico/vpp-dataplane/blob/v3.32.0/test/scripts/utils/avf.sh). Different drivers will have different requirements.
 
 ### VPP data plane implementation details
 
@@ -60099,7 +60099,7 @@ The VPP data plane integration is split in two components, `vpp-manager` which h
 
 ### vpp-manager[​](#vpp-manager)
 
-VPP Manager is a very lightweight process responsible for the bootstrap of VPP, including uplink interface addressing and routing configuration. It also restores the Linux configuration on shutdown. The code can be found in this directory: [https://github.com/projectcalico/vpp-dataplane/tree/v3.31.0/vpp-manager](https://github.com/projectcalico/vpp-dataplane/tree/v3.31.0/vpp-manager).
+VPP Manager is a very lightweight process responsible for the bootstrap of VPP, including uplink interface addressing and routing configuration. It also restores the Linux configuration on shutdown. The code can be found in this directory: [https://github.com/projectcalico/vpp-dataplane/tree/v3.32.0/vpp-manager](https://github.com/projectcalico/vpp-dataplane/tree/v3.32.0/vpp-manager).
 
 On startup, `vpp-manager` starts by determining the desired configuration for the VPP uplink by checking it's configuration in Linux, including addresses and routes. It then renders an appropriate configuration file for VPP, and starts the VPP process.
 
@@ -60113,7 +60113,7 @@ When VPP stops, either in reaction to a received signal or in case of a crash, `
 
 ### calico-vpp-agent[​](#calico-vpp-agent)
 
-The Calico VPP agent is the process responsible for all the Calico-specific configuration in VPP. Its code lives in this directory: [https://github.com/projectcalico/vpp-dataplane/tree/v3.31.0/calico-vpp-agent](https://github.com/projectcalico/vpp-dataplane/tree/v3.31.0/calico-vpp-agent).
+The Calico VPP agent is the process responsible for all the Calico-specific configuration in VPP. Its code lives in this directory: [https://github.com/projectcalico/vpp-dataplane/tree/v3.32.0/calico-vpp-agent](https://github.com/projectcalico/vpp-dataplane/tree/v3.32.0/calico-vpp-agent).
 
 This agent is split in four main components, which interact with the k8s and Calico APIs to configure VPP. These components are the routing manager, the CNI server, the services manager and the policies manager.
 
@@ -60292,6 +60292,41 @@ If a pod on `Node A` wants to talk to the api-server on `Node A`, let's say the
 
 This page lists the specific component versions that go into each release of Calico.
 
+## Component versions for <!-- -->Calico<!-- --> <!-- -->3.32.1[​](#component-versions-v3.32.1)
+
+[Release archive](https://github.com/projectcalico/calico/releases/download/v3.32.1/release-v3.32.1.tgz) <!-- -->with Kubernetes manifests.
+
+This release comprises the following components, and can be installed using
+
+<!-- -->
+
+`quay.io/tigera/operator:v1.42.3`
+
+| Component                           | Version |
+| ----------------------------------- | ------- |
+| calico/typha                        | v3.32.1 |
+| calico/ctl                          | v3.32.1 |
+| calico/node                         | v3.32.1 |
+| calico/node-windows                 | v3.32.1 |
+| calico/cni                          | v3.32.1 |
+| calico/cni-windows                  | v3.32.1 |
+| calico/apiserver                    | v3.32.1 |
+| calico/kube-controllers             | v3.32.1 |
+| calico/envoy-gateway                | v3.32.1 |
+| calico/envoy-proxy                  | v3.32.1 |
+| calico/envoy-ratelimit              | v3.32.1 |
+| calico/flannel-migration-controller | v3.32.1 |
+| flannel                             | v0.24.4 |
+| calico/dikastes                     | v3.32.1 |
+| flexvol                             | v3.32.1 |
+| calico/csi                          | v3.32.1 |
+| calico/node-driver-registrar        | v3.32.1 |
+| calico/pod2daemon-flexvol           | v3.32.1 |
+| calico/key-cert-provisioner         | v3.32.1 |
+| calico/goldmane                     | v3.32.1 |
+| calico/whisker                      | v3.32.1 |
+| calico/whisker-backend              | v3.32.1 |
+
 ## Component versions for <!-- -->Calico<!-- --> <!-- -->3.32.0[​](#component-versions-v3.32.0)
 
 [Release archive](https://github.com/projectcalico/calico/releases/download/v3.32.0/release-v3.32.0.tgz) <!-- -->with Kubernetes manifests.
@@ -60919,6 +60954,43 @@ Calico Open Source release 3.32.0 is now generally available.
 
 To update a previous version of Calico, see [our upgrade guides](https://docs.tigera.io/calico/latest/operations/upgrading/).
 
+### Calico Open Source 3.32.1 bug fix release[​](#calico-open-source-3321-bug-fix-release)
+
+24 Jun 2026
+
+#### Bug fixes[​](#bug-fixes-1)
+
+- HELM: Fixes the tigera-operator chart install instructions, which omitted the step to install Calico CRDs from the separate crd.projectcalico.org.v1 chart. [calico 13043](https://github.com/projectcalico/calico/pull/13043) (@caseydavenport)
+- Fix manifest-based installs missing kubevirt.io RBAC rules on the calico-cni-plugin and calico-kube-controllers ClusterRoles, which caused KubeVirt VM networking and IPAM garbage collection failures. [calico 12996](https://github.com/projectcalico/calico/pull/12996) (@song-jiang)
+- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12958](https://github.com/projectcalico/calico/pull/12958) (@fasaxc)
+- \[v3.32] fix(felix): exclude LB-only IPPools from BPF in-pool route flag [calico 12953](https://github.com/projectcalico/calico/pull/12953) (@defo89)
+- Fixes a NotFound error when using server-side apply (including Helm 4) to create Calico network policies that don't already exist. [calico 12906](https://github.com/projectcalico/calico/pull/12906) (@caseydavenport)
+- Fixes a bug in the eBPF dataplane in which deleting and restoring the local Node resource and restarting Felix could leave the node unable to handle network traffic. [calico 12874](https://github.com/projectcalico/calico/pull/12874) (@tomastigera)
+- Fix SNAT being skipped for traffic destined to LoadBalancer-only IPPools by excluding them from the all-ipam-pools ipset. [calico 12858](https://github.com/projectcalico/calico/pull/12858) (@defo89)
+- ebpf - Fix kube-proxy losing the NodePort externalTrafficPolicy=Local route-fixup trigger after a syncer swap, which could cause stale NAT entries on remote backends. [calico 12743](https://github.com/projectcalico/calico/pull/12743) (@tomastigera)
+- Fixes nft binary segfaults in calico/node and the Istio CNI install image when newer nftables is in use elsewhere on the host. [calico 12712](https://github.com/projectcalico/calico/pull/12712) (@caseydavenport)
+- Fixed a regression introduced in v3.30 where `RouteSyncDisabled` flag was not being honored by `LinkAddressManager`. [calico 12707](https://github.com/projectcalico/calico/pull/12707) (@mazdakn)
+- Fix server-side apply (FluxCD, ArgoCD, `kubectl apply --server-side`) failures on BGPConfiguration resources that set serviceLoadBalancerIPs, serviceExternalIPs, serviceClusterIPs, communities, or prefixAdvertisements. [calico 12705](https://github.com/projectcalico/calico/pull/12705) (@caseydavenport)
+- ebpf - Fix transient NodePort connection failures when Felix restarts on a node receiving external NodePort traffic. [calico 12694](https://github.com/projectcalico/calico/pull/12694) (@tomastigera)
+- Fixes a Felix panic that could occur when an IP set selector matched both a NetworkSet CIDR and workload IPs contained within it, with nftables as the active dataplane. [calico 12671](https://github.com/projectcalico/calico/pull/12671) (@caseydavenport)
+- Fix that certain internal API key types were non-comparable, requiring workarounds in various places. [calico 11958](https://github.com/projectcalico/calico/pull/11958) (@fasaxc)
+- Fix panic in calico/node on s390x architecture. [calico 11312](https://github.com/projectcalico/calico/pull/11312) (@vivkong)
+
+#### Other changes[​](#other-changes-1)
+
+- Bump bundled third-party images (Envoy Gateway to v1.8.0, Envoy proxy, Envoy ratelimit, node-driver-registrar, Istio to 1.29.4) and their golang.org/x and spdystream dependencies to remediate CVE-2026-33814 and CVE-2026-35469. [calico 13030](https://github.com/projectcalico/calico/pull/13030) (@lucastigera)
+- Prevent deletion of built-in tiers in CRD mode. [calico 12982](https://github.com/projectcalico/calico/pull/12982) (@caseydavenport)
+- calico/node now refreshes the CNI plugin's kubeconfig immediately when the pod's projected ServiceAccount token is rotated, closing a 6-12h window where an externally-invalidated token could cause CNI ADD to fail with "Unauthorized" until the calico-node pod was restarted. [calico 12940](https://github.com/projectcalico/calico/pull/12940) (@skoryk-oleksandr)
+- HELM: Detect the served MutatingAdmissionPolicy API version and render MutatingAdmissionPolicy/MutatingAdmissionPolicyBinding accordingly (v1 on Kubernetes 1.36+, v1alpha1 when only the alpha API is served), defaulting to v1beta1. [calico 12877](https://github.com/projectcalico/calico/pull/12877) (@caseydavenport)
+- Support CGO Enabled builds for ppc64le [calico 12768](https://github.com/projectcalico/calico/pull/12768) (@kishen-v)
+- kube-controllers, goldmane: use default secure pprof server (localhost only). Use `kubectl port-forward` for remote access. [calico 12633](https://github.com/projectcalico/calico/pull/12633) (@Behnam-Shobiri)
+- Felix: reduce memory used for handling Typha reconnection. Avoid converting all datastore keys to string, store the already-used key structs instead. [calico 11947](https://github.com/projectcalico/calico/pull/11947) (@fasaxc)
+- Deprecating HostMetadataUpdate, HostMetadataRemove, HostMetadataV6Update, and HostMetadataV6Remove internal protobuf messages in favor of HostMedataV4V6Update and HostMetadaV4V6 messages. [calico 11284](https://github.com/projectcalico/calico/pull/11284) (@mazdakn)
+
+#### Updating[​](#updating-1)
+
+To update a previous version of Calico, see [our upgrade guides](https://docs.tigera.io/calico/latest/operations/upgrading/).
+
 ---
 
 ## Support and feedback