diff --git a/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-bootstrap_content b/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-bootstrap_content
index 8fa0cb9890..0c601d8c3c 100644
--- a/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-bootstrap_content
+++ b/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-bootstrap_content
@@ -54,7 +54,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.16
     manifest: networking.projectcalico.org/k8s-1.16.yaml
-    manifestHash: fe30f09850e8d3744b3b4257a6199d9df7382c89b608391b40b027ba641e6c09
+    manifestHash: 83ec8afb5d42578a273b65645ac39565f3ac362a83eedbb7253862aa4063e4ec
     name: networking.projectcalico.org
     selector:
       role.kubernetes.io/networking: "1"
diff --git a/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.16_content b/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.16_content
index 7e6544547a..4f7c439868 100644
--- a/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.16_content
+++ b/tests/integration/update_cluster/minimal-ipv6-calico/data/aws_s3_bucket_object_minimal-ipv6.example.com-addons-networking.projectcalico.org-k8s-1.16_content
@@ -4246,7 +4246,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.21.1
+        image: docker.io/calico/node:v3.21.2
         lifecycle:
           preStop:
             exec:
@@ -4318,7 +4318,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.21.1
+        image: docker.io/calico/cni:v3.21.2
         name: upgrade-ipam
         securityContext:
           privileged: true
@@ -4352,7 +4352,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.21.1
+        image: docker.io/calico/cni:v3.21.2
         name: install-cni
         securityContext:
           privileged: true
@@ -4361,7 +4361,7 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
-      - image: docker.io/calico/pod2daemon-flexvol:v3.21.1
+      - image: docker.io/calico/pod2daemon-flexvol:v3.21.2
         name: flexvol-driver
         securityContext:
           privileged: true
@@ -4469,7 +4469,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.21.1
+        image: docker.io/calico/kube-controllers:v3.21.2
         livenessProbe:
           exec:
             command:
diff --git a/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-bootstrap_content b/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-bootstrap_content
index 2de383ee8d..fb1602e0c9 100644
--- a/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-bootstrap_content
+++ b/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-bootstrap_content
@@ -54,7 +54,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.16
     manifest: networking.projectcalico.org/k8s-1.16.yaml
-    manifestHash: 69a558c349000e8f818014f5da0b029b62ba5eddab471670320b962eefbfc19c
+    manifestHash: 708c14f382000e6abb73b8d0a3b8fffd65bd7f211b5ec898246316f4231dc2fd
     name: networking.projectcalico.org
     selector:
       role.kubernetes.io/networking: "1"
diff --git a/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.16_content b/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.16_content
index 7614fce987..4c84f625b4 100644
--- a/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.16_content
+++ b/tests/integration/update_cluster/privatecalico/data/aws_s3_bucket_object_privatecalico.example.com-addons-networking.projectcalico.org-k8s-1.16_content
@@ -4241,7 +4241,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.21.1
+        image: docker.io/calico/node:v3.21.2
         lifecycle:
           preStop:
             exec:
@@ -4315,7 +4315,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.21.1
+        image: docker.io/calico/cni:v3.21.2
         name: upgrade-ipam
         securityContext:
           privileged: true
@@ -4349,7 +4349,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.21.1
+        image: docker.io/calico/cni:v3.21.2
         name: install-cni
         securityContext:
           privileged: true
@@ -4358,7 +4358,7 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
-      - image: docker.io/calico/pod2daemon-flexvol:v3.21.1
+      - image: docker.io/calico/pod2daemon-flexvol:v3.21.2
         name: flexvol-driver
         securityContext:
           privileged: true
@@ -4466,7 +4466,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.21.1
+        image: docker.io/calico/kube-controllers:v3.21.2
         livenessProbe:
           exec:
             command:
diff --git a/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-bootstrap_content b/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-bootstrap_content
index 2ba91acc47..96e1a8fba9 100644
--- a/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-bootstrap_content
+++ b/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-bootstrap_content
@@ -54,7 +54,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.22
     manifest: networking.projectcalico.org.canal/k8s-1.22.yaml
-    manifestHash: 374571e60b4eb738a37569a126afb6d7f3478da5344e0e0c26cc08a93a29b6e6
+    manifestHash: bf0edcea126e143dd7f247f440586b7cf060af802c671600ea0811a4055d70fd
     name: networking.projectcalico.org.canal
     selector:
       role.kubernetes.io/networking: "1"
diff --git a/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content b/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content
index bfcac0e071..dd63b70c0d 100644
--- a/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content
+++ b/tests/integration/update_cluster/privatecanal/data/aws_s3_bucket_object_privatecanal.example.com-addons-networking.projectcalico.org.canal-k8s-1.22_content
@@ -4237,7 +4237,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/node:v3.21.1
+        image: docker.io/calico/node:v3.21.2
         lifecycle:
           preStop:
             exec:
@@ -4350,7 +4350,7 @@ spec:
         - configMapRef:
             name: kubernetes-services-endpoint
             optional: true
-        image: docker.io/calico/cni:v3.21.1
+        image: docker.io/calico/cni:v3.21.2
         name: install-cni
         securityContext:
           privileged: true
@@ -4359,7 +4359,7 @@ spec:
           name: cni-bin-dir
         - mountPath: /host/etc/cni/net.d
           name: cni-net-dir
-      - image: docker.io/calico/pod2daemon-flexvol:v3.21.1
+      - image: docker.io/calico/pod2daemon-flexvol:v3.21.2
         name: flexvol-driver
         securityContext:
           privileged: true
@@ -4467,7 +4467,7 @@ spec:
           value: node
         - name: DATASTORE_TYPE
           value: kubernetes
-        image: docker.io/calico/kube-controllers:v3.21.1
+        image: docker.io/calico/kube-controllers:v3.21.2
         livenessProbe:
           exec:
             command: