diff --git a/Dockerfile b/Dockerfile
index d6d49b63d9..fa6b77ea52 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -118,9 +118,9 @@ RUN rm -vf /charts/*.sh /charts/*.md /charts/chart_versions.yaml
 # must be placed in bin/ of the file image and subdirectories of bin/ will be flattened during installation.
 # This means bin/foo/bar will become bin/bar when rke2 installs this to the host
 FROM rancher/hardened-kubernetes:v1.31.0-rke2r1-build20240815 AS kubernetes
-FROM rancher/hardened-containerd:v1.7.20-k3s1-build20240812 AS containerd
+FROM rancher/hardened-containerd:v1.7.21-k3s2-build20240906 AS containerd
 FROM rancher/hardened-crictl:v1.30.1-build20240812 AS crictl
-FROM rancher/hardened-runc:v1.1.13-build20240821 AS runc
+FROM rancher/hardened-runc:v1.1.14-build20240903 AS runc
 
 FROM scratch AS runtime-collect
 COPY --from=runc \
diff --git a/Dockerfile.windows b/Dockerfile.windows
index e55524b721..4d68e641cd 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -38,7 +38,7 @@ RUN curl -sL https://raw.githubusercontent.com/golangci/golangci-lint/master/ins
 WORKDIR /source
 # End Dapper stuff
 
-FROM rancher/hardened-containerd:v1.7.20-k3s1-build20240812-amd64-windows AS containerd
+FROM rancher/hardened-containerd:v1.7.21-k3s2-build20240906-amd64-windows AS containerd
 FROM build as windows-runtime-collect
 ARG KUBERNETES_VERSION=dev
 
diff --git a/scripts/version.sh b/scripts/version.sh
index b646505ee3..a9c126a6e8 100755
--- a/scripts/version.sh
+++ b/scripts/version.sh
@@ -36,7 +36,7 @@ KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.31.0}
 KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.31.0-rke2r1-build20240815}
 ETCD_VERSION=${ETCD_VERSION:-v3.5.13-k3s1}
 PAUSE_VERSION=${PAUSE_VERSION:-3.6}
-CCM_VERSION=${CCM_VERSION:-v1.29.3-build20240515}
+CCM_VERSION=${CCM_VERSION:-v1.31.0-build20240906}
 
 if [ -d .git ]; then
     if [ -z "$GIT_TAG" ]; then