diff --git a/calico-3.31.yaml b/calico-3.31.yaml
index 1f9f70a729f..48076684fdc 100644
--- a/calico-3.31.yaml
+++ b/calico-3.31.yaml
@@ -1,7 +1,7 @@
 package:
   name: calico-3.31
-  version: "3.31.2"
-  epoch: 4 # GHSA-jv3w-x3r3-g6rm
+  version: "3.31.3"
+  epoch: 0
   description: "Cloud native networking and network security"
   copyright:
     - license: Apache-2.0
@@ -65,7 +65,7 @@ pipeline:
     with:
       repository: https://github.com/projectcalico/calico
       tag: v${{package.version}}
-      expected-commit: dd5575465ed825f86a3bc10f17bb5f7dc106d0f0
+      expected-commit: 2e3c880bcabff580ddd7a08340878ede207f37be
       recurse-submodules: true
 
   - uses: go/bump
@@ -77,8 +77,8 @@ pipeline:
   - uses: go/bump
     with:
       deps: |-
-        golang.org/x/crypto@v0.45.0
         github.com/containernetworking/plugins@v1.9.0
+        k8s.io/kubernetes@v1.33.6
 
   # Because we are using tigera-operator during image test we are reliant on tigera-operator setting
   # up all the required rbac rules that are needed for calico-apiserver to run. Currently it does not and