diff --git a/Makefile b/Makefile
index 6b7facb843..301c5accef 100644
--- a/Makefile
+++ b/Makefile
@@ -64,13 +64,13 @@ GITSHA := $(shell cd ${KOPS_ROOT}; git describe --always)
 # We lock the versions of our controllers also
 # We need to keep in sync with:
 #   upup/models/cloudup/resources/addons/dns-controller/
-DNS_CONTROLLER_TAG=1.21.2
+DNS_CONTROLLER_TAG=1.21.4
 DNS_CONTROLLER_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_DNS_CONTROLLER_TAG | awk '{print $$2}')
 #   upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/
-KOPS_CONTROLLER_TAG=1.21.2
+KOPS_CONTROLLER_TAG=1.21.4
 KOPS_CONTROLLER_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_KOPS_CONTROLLER_TAG | awk '{print $$2}')
 #   pkg/model/components/kubeapiserver/model.go
-KUBE_APISERVER_HEALTHCHECK_TAG=1.21.2
+KUBE_APISERVER_HEALTHCHECK_TAG=1.21.4
 KUBE_APISERVER_HEALTHCHECK_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_KUBE_APISERVER_HEALTHCHECK_TAG | awk '{print $$2}')
 
 
diff --git a/pkg/model/components/kubeapiserver/model.go b/pkg/model/components/kubeapiserver/model.go
index c8e112f215..fa92dc098f 100644
--- a/pkg/model/components/kubeapiserver/model.go
+++ b/pkg/model/components/kubeapiserver/model.go
@@ -95,7 +95,7 @@ kind: Pod
 spec:
   containers:
   - name: healthcheck
-    image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.2
+    image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.4
     livenessProbe:
       httpGet:
         # The sidecar serves a healthcheck on the same port,
diff --git a/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml b/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
index f92741195d..c576cbe65f 100644
--- a/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
+++ b/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
@@ -12,7 +12,7 @@ Contents: |
       - --client-key=/secrets/client.key
       command:
       - /kube-apiserver-healthcheck
-      image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.2
+      image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.4
       livenessProbe:
         httpGet:
           host: 127.0.0.1
diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
index 958d03dd50..4b41aae707 100644
--- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
+++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
@@ -6,7 +6,7 @@ metadata:
   labels:
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.2
+    version: v1.21.4
 spec:
   replicas: 1
   strategy:
@@ -19,7 +19,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.2
+        version: v1.21.4
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
@@ -33,7 +33,7 @@ spec:
       serviceAccount: dns-controller
       containers:
       - name: dns-controller
-        image: k8s.gcr.io/kops/dns-controller:1.21.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.4
         command:
 {{ range $arg := DnsControllerArgv }}
         - "{{ $arg }}"
diff --git a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
index 3ad20ce20d..7e80f0f76a 100644
--- a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
+++ b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
@@ -19,7 +19,7 @@ metadata:
   labels:
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.2
+    version: v1.21.4
 spec:
   selector:
     matchLabels:
@@ -31,7 +31,7 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.2
+        version: v1.21.4
 {{ if UseKopsControllerForNodeBootstrap }}
       annotations:
         dns.alpha.kubernetes.io/internal: kops-controller.internal.{{ ClusterName }}
@@ -49,7 +49,7 @@ spec:
       serviceAccount: kops-controller
       containers:
       - name: kops-controller
-        image: k8s.gcr.io/kops/kops-controller:1.21.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.4
         volumeMounts:
 {{ if .UseHostCertificates }}
         - mountPath: /etc/ssl/certs
diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
index f11e5d992c..03960692a6 100644
--- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
+++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
@@ -211,7 +211,7 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
 
 	{
 		key := "kops-controller.addons.k8s.io"
-		version := "1.21.2"
+		version := "1.21.4"
 
 		{
 			location := key + "/k8s-1.16.yaml"
@@ -386,7 +386,7 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
 	if externalDNS == nil || !externalDNS.Disable {
 		{
 			key := "dns-controller.addons.k8s.io"
-			version := "1.21.2"
+			version := "1.21.4"
 
 			{
 				location := key + "/k8s-1.12.yaml"
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
index 038584e536..56e42bfaf4 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
index 4ea1564b1e..d25ec37905 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
index f7d5859201..3cf2525bca 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
index 31258ac563..b1896b65f9 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 4b7dc59bf1..b59150e31e 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.2
+    version: v1.21.4
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -38,7 +38,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/dns-controller:1.21.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.4
         name: dns-controller
         resources:
           requests:
@@ -63,7 +63,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -77,7 +77,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -111,7 +111,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
index 9d8c2ba3a0..0c24dabfbc 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.2
+    version: v1.21.4
   name: kops-controller
   namespace: kube-system
 spec:
@@ -37,7 +37,7 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -47,7 +47,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/kops-controller:1.21.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.4
         name: kops-controller
         resources:
           requests:
@@ -89,7 +89,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -103,7 +103,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -126,7 +126,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -147,7 +147,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -194,7 +194,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
index b26fe253da..0e833ffeaf 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
index 8ae41d2529..f0f3974495 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
@@ -19,7 +19,7 @@ spec:
     name: anonymous-access.addons.k8s.io
     selector:
       k8s-addon: anonymous-access.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 3ffe9ac576f9eec72e2bdfbd2ea17d56d9b17b90
     name: core.addons.k8s.io
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.18/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.18/manifest.yaml
index e80f0cd61a..035e716504 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.18/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.18/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: k8s-1.11
     manifest: metrics-server.addons.k8s.io/k8s-1.11.yaml
     manifestHash: a760a68f4d76cfddb5a2cd9afa9afdb0b301d187
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.19/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.19/manifest.yaml
index 5f0997d0c8..2ddec9df2f 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.19/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/insecure-1.19/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: k8s-1.11
     manifest: metrics-server.addons.k8s.io/k8s-1.11.yaml
     manifestHash: a760a68f4d76cfddb5a2cd9afa9afdb0b301d187
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.18/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.18/manifest.yaml
index 38df94080d..22703baeda 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.18/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.18/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: k8s-1.11
     manifest: metrics-server.addons.k8s.io/k8s-1.11.yaml
     manifestHash: d4a188bdcd03921d7852fa12f4dbb7d996b7edb5
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.19/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.19/manifest.yaml
index b6b8f89f5a..915e901fab 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.19/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/metrics-server/secure-1.19/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: k8s-1.11
     manifest: metrics-server.addons.k8s.io/k8s-1.11.yaml
     manifestHash: 3795901da096a90916f4258aec1dc656f16d2b8f
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 8dbe41034e..d0f3000bfd 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.2
+    version: v1.21.4
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -42,7 +42,7 @@ spec:
           value: arn:aws-test:iam::123456789012:role/dns-controller.kube-system.sa.minimal.example.com
         - name: AWS_WEB_IDENTITY_TOKEN_FILE
           value: /var/run/secrets/amazonaws.com/token
-        image: k8s.gcr.io/kops/dns-controller:1.21.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.4
         name: dns-controller
         resources:
           requests:
@@ -82,7 +82,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -96,7 +96,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -130,7 +130,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/kops-controller.addons.k8s.io-k8s-1.16.yaml
index 9d8c2ba3a0..0c24dabfbc 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.2
+    version: v1.21.4
   name: kops-controller
   namespace: kube-system
 spec:
@@ -37,7 +37,7 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -47,7 +47,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/kops-controller:1.21.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.4
         name: kops-controller
         resources:
           requests:
@@ -89,7 +89,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -103,7 +103,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -126,7 +126,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -147,7 +147,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -194,7 +194,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/manifest.yaml
index 3ad463bcfc..05ee848b8a 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/service-account-iam/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 95aa26ddfb13d8ce1a1742be39a2e5cadd940cb9
+    manifestHash: 4882f7eb53d6e6bd4fefeb429ec710d4f8437c66
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 7d135811769a29ed0e59110f7d69ae27b302e119
+    manifestHash: 15ce192161325b0be1986be142b33a4f4019817f
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 4b7dc59bf1..b59150e31e 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.2
+    version: v1.21.4
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -38,7 +38,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/dns-controller:1.21.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.4
         name: dns-controller
         resources:
           requests:
@@ -63,7 +63,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -77,7 +77,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -111,7 +111,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
index b8825f26f7..ec37f8a37d 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.2
+    version: v1.21.4
   name: kops-controller
   namespace: kube-system
 spec:
@@ -39,7 +39,7 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.2
+        version: v1.21.4
     spec:
       containers:
       - command:
@@ -49,7 +49,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/kops-controller:1.21.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.4
         name: kops-controller
         resources:
           requests:
@@ -91,7 +91,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -105,7 +105,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -128,7 +128,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -149,7 +149,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -196,7 +196,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.2
+    addon.kops.k8s.io/version: 1.21.4
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
index 1c761d8b64..2822614eb1 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
index 65cc7c0370..b1ad8e8b81 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 04032914ea656ed2f2882bc27dc42396ff44e0f2
+    manifestHash: cacb4bd2303985e203deef8e311a1f2528fd0742
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 65fbb01b0e54f9aeb3d68801df6a9866066019e4
+    manifestHash: f011be3908d29b3291ade5ca5e52f1d7d7ef928c
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.2
+    version: 1.21.4
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/urls_test.go b/upup/pkg/fi/cloudup/urls_test.go
index d63d54ed29..0f5c31cbdf 100644
--- a/upup/pkg/fi/cloudup/urls_test.go
+++ b/upup/pkg/fi/cloudup/urls_test.go
@@ -36,29 +36,29 @@ func Test_BuildMirroredAsset(t *testing.T) {
 		{
 			url: "https://artifacts.k8s.io/binaries/kops/%s/images/protokube-linux-amd64",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.2/images/protokube-linux-amd64",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.2/images-protokube-linux-amd64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.4/images/protokube-linux-amd64",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.4/images-protokube-linux-amd64",
 			},
 		},
 		{
 			url: "https://artifacts.k8s.io/binaries/kops/%s/images/protokube-linux-arm64",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.2/images/protokube-linux-arm64",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.2/images-protokube-linux-arm64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.4/images/protokube-linux-arm64",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.4/images-protokube-linux-arm64",
 			},
 		},
 		{
 			url: "https://artifacts.k8s.io/binaries/kops/%s/linux/amd64/nodeup",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.2/linux/amd64/nodeup",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.2/nodeup-linux-amd64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.4/linux/amd64/nodeup",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.4/nodeup-linux-amd64",
 			},
 		},
 		{
 			url: "https://artifacts.k8s.io/binaries/kops/%s/linux/arm64/nodeup",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.2/linux/arm64/nodeup",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.2/nodeup-linux-arm64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.4/linux/arm64/nodeup",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.4/nodeup-linux-arm64",
 			},
 		},
 	}
diff --git a/version.go b/version.go
index 161c52b500..e44ba0597c 100644
--- a/version.go
+++ b/version.go
@@ -21,8 +21,8 @@ var Version = KOPS_RELEASE_VERSION
 
 // These constants are parsed by build tooling - be careful about changing the formats
 const (
-	KOPS_RELEASE_VERSION = "1.21.2"
-	KOPS_CI_VERSION      = "1.21.3"
+	KOPS_RELEASE_VERSION = "1.21.4"
+	KOPS_CI_VERSION      = "1.21.5"
 )
 
 // GitVersion should be replaced by the makefile