diff --git a/kubernetes/apps/system-upgrade/tuppr/ks.yaml b/kubernetes/apps/system-upgrade/tuppr/ks.yaml
index 2a256f789..e95a1cb84 100644
--- a/kubernetes/apps/system-upgrade/tuppr/ks.yaml
+++ b/kubernetes/apps/system-upgrade/tuppr/ks.yaml
@@ -28,7 +28,7 @@ spec:
   postBuild:
     substitute:
       # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
-      KUBERNETES_VERSION: v1.35.4
+      KUBERNETES_VERSION: v1.36.0
       # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
       TALOS_VERSION: v1.12.6
   prune: true
diff --git a/talos/nodes/k8s-1.yaml.j2 b/talos/nodes/k8s-1.yaml.j2
index 3629ab155..beff287d3 100644
--- a/talos/nodes/k8s-1.yaml.j2
+++ b/talos/nodes/k8s-1.yaml.j2
@@ -61,7 +61,7 @@ machine:
     extraConfig:
       maxPods: 250
       serializeImagePulls: false
-    image: ghcr.io/siderolabs/kubelet:v1.35.4
+    image: ghcr.io/siderolabs/kubelet:v1.36.0
     nodeIP:
       validSubnets:
         - 192.168.20.0/24
@@ -136,9 +136,9 @@ cluster:
       enable-aggregator-routing: true
       feature-gates: MutatingAdmissionPolicy=true
       runtime-config: admissionregistration.k8s.io/v1beta1=true
-    image: registry.k8s.io/kube-apiserver:v1.35.4
+    image: registry.k8s.io/kube-apiserver:v1.36.0
   controllerManager:
-    image: registry.k8s.io/kube-controller-manager:v1.35.4
+    image: registry.k8s.io/kube-controller-manager:v1.36.0
     extraArgs:
       bind-address: 0.0.0.0
   coreDNS:
@@ -153,7 +153,7 @@ cluster:
       listen-metrics-urls: http://0.0.0.0:2381
   proxy:
     disabled: true
-    image: registry.k8s.io/kube-proxy:v1.35.4
+    image: registry.k8s.io/kube-proxy:v1.36.0
   scheduler:
     config:
       apiVersion: kubescheduler.config.k8s.io/v1
@@ -174,7 +174,7 @@ cluster:
                     whenUnsatisfiable: ScheduleAnyway
     extraArgs:
       bind-address: 0.0.0.0
-    image: registry.k8s.io/kube-scheduler:v1.35.4
+    image: registry.k8s.io/kube-scheduler:v1.36.0
   secretboxEncryptionSecret: op://Kubernetes/talos/CLUSTER_SECRETBOXENCRYPTIONSECRET
   serviceAccount:
     key: op://Kubernetes/talos/CLUSTER_SERVICEACCOUNT_KEY