diff --git a/coreos-pxe-install.jsonnet b/coreos-pxe-install.jsonnet
index 4aa5020..a324395 100644
--- a/coreos-pxe-install.jsonnet
+++ b/coreos-pxe-install.jsonnet
@@ -7,7 +7,7 @@ local utils = import "utils.libsonnet";
 //   kubectl label nodes -l flatcar-linux-update.v1.flatcar-linux.net/id flatcar-linux-update.v1.flatcar-linux.net/reboot-needed=true
 
 // renovate: depName=kubernetes/kubernetes datasource=github-releases versioning=semver
-local kubelet_tag = "v1.24.15";
+local kubelet_tag = "v1.24.17";
 
 local default_env = {
   // NB: dockerd can't route to a cluster LB VIP? (fixme)
diff --git a/kube-system.jsonnet b/kube-system.jsonnet
index 9f9b8ef..f26d543 100644
--- a/kube-system.jsonnet
+++ b/kube-system.jsonnet
@@ -16,9 +16,9 @@ local certman = import "cert-manager.jsonnet";
 // 3. kubelets (see coreos-pxe-install.jsonnet:coreos_kubelet_tag)
 
 // renovate: depName=registry.k8s.io/kube-proxy
-local version = "v1.25.11";
+local version = "v1.25.14";
 // renovate: depName=registry.k8s.io/kube-apiserver
-local apiserverVersion = "v1.25.11";
+local apiserverVersion = "v1.25.14";
 
 local externalHostname = "kube.lan";
 local apiServer = "https://%s:6443" % [externalHostname];