diff --git a/kubernetes/apps/base/system-upgrade/tuppr/upgrades/kubernetesupgrade.yaml b/kubernetes/apps/base/system-upgrade/tuppr/upgrades/kubernetesupgrade.yaml
index 39af03ec9f..6d86771ef4 100644
--- a/kubernetes/apps/base/system-upgrade/tuppr/upgrades/kubernetesupgrade.yaml
+++ b/kubernetes/apps/base/system-upgrade/tuppr/upgrades/kubernetesupgrade.yaml
@@ -7,7 +7,7 @@ metadata:
 spec:
   kubernetes:
     # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
-    version: v1.36.5
+    version: v1.36.6
   healthChecks:
     - apiVersion: volsync.backube/v1alpha1
       kind: ReplicationSource
diff --git a/talos/machineconfig.yaml.j2 b/talos/machineconfig.yaml.j2
index 65913ed0e0..08bf7ead60 100644
--- a/talos/machineconfig.yaml.j2
+++ b/talos/machineconfig.yaml.j2
@@ -59,7 +59,7 @@ machine:
     grubUseUKICmdline: true
   kubelet:
     # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
-    image: ghcr.io/siderolabs/kubelet:v1.36.5
+    image: ghcr.io/siderolabs/kubelet:v1.36.6
     defaultRuntimeSeccompProfileEnabled: true
     disableManifestsDirectory: true
     extraMounts:
@@ -165,7 +165,7 @@ cluster:
     key: ref+op://Home-Lab/talos/CLUSTER_SERVICEACCOUNT_KEY
   apiServer:
     # renovate: datasource=docker depName=registry.k8s.io/kube-apiserver
-    image: registry.k8s.io/kube-apiserver:v1.36.5
+    image: registry.k8s.io/kube-apiserver:v1.36.6
     extraArgs:
       default-watch-cache-size: "1500"
       enable-aggregator-routing: "true"
@@ -203,16 +203,16 @@ cluster:
         - level: Metadata
   controllerManager:
     # renovate: datasource=docker depName=registry.k8s.io/kube-controller-manager
-    image: registry.k8s.io/kube-controller-manager:v1.36.5
+    image: registry.k8s.io/kube-controller-manager:v1.36.6
     extraArgs:
       bind-address: 0.0.0.0
   proxy:
     disabled: true
     # renovate: datasource=docker depName=registry.k8s.io/kube-proxy
-    image: registry.k8s.io/kube-proxy:v1.36.5
+    image: registry.k8s.io/kube-proxy:v1.36.6
   scheduler:
     # renovate: datasource=docker depName=registry.k8s.io/kube-scheduler
-    image: registry.k8s.io/kube-scheduler:v1.36.5
+    image: registry.k8s.io/kube-scheduler:v1.36.6
     extraArgs:
       bind-address: 0.0.0.0
   etcd: