diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index 771848f5bb..93ae78a440 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   docker:
     name: Docker
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
diff --git a/.github/workflows/nerdctl.yaml b/.github/workflows/nerdctl.yaml
index 4f22debb0d..1a1b549c55 100644
--- a/.github/workflows/nerdctl.yaml
+++ b/.github/workflows/nerdctl.yaml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   nerdctl:
     name: Nerdctl
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
diff --git a/.go-version b/.go-version
index d8c40e539c..e4a973f913 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.23.6
+1.24.2
diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 0f02c57627..dddfb02a26 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -122,7 +122,7 @@ RUN eval "$(gimme "${GO_VERSION}")" \
 # stage for building containerd
 FROM go-build AS build-containerd
 ARG TARGETARCH GO_VERSION
-ARG CONTAINERD_VERSION="v2.0.3"
+ARG CONTAINERD_VERSION="v2.0.5"
 ARG CONTAINERD_CLONE_URL="https://github.com/containerd/containerd"
 # we don't build with optional snapshotters, we never select any of these
 # they're not ideal inside kind anyhow, and we save some disk space
@@ -140,7 +140,7 @@ RUN git clone --filter=tree:0 "${CONTAINERD_CLONE_URL}" /containerd \
 # stage for building runc
 FROM go-build AS build-runc
 ARG TARGETARCH GO_VERSION
-ARG RUNC_VERSION="v1.2.5"
+ARG RUNC_VERSION="v1.2.6"
 ARG RUNC_CLONE_URL="https://github.com/opencontainers/runc"
 RUN git clone --filter=tree:0 "${RUNC_CLONE_URL}" /runc \
     && cd /runc \
diff --git a/pkg/apis/config/defaults/image.go b/pkg/apis/config/defaults/image.go
index 7be06bdd95..5fb488e04c 100644
--- a/pkg/apis/config/defaults/image.go
+++ b/pkg/apis/config/defaults/image.go
@@ -18,4 +18,4 @@ limitations under the License.
 package defaults
 
 // Image is the default for the Config.Image field, aka the default node image.
-const Image = "kindest/node:v1.32.3@sha256:b36e76b4ad37b88539ce5e07425f77b29f73a8eaaebf3f1a8bc9c764401d118c"
+const Image = "kindest/node:v1.33.0@sha256:91e9ed777db80279c22d1d1068c091b899b2078506e4a0f797fbf6e397c0b0b2"
diff --git a/pkg/build/nodeimage/defaults.go b/pkg/build/nodeimage/defaults.go
index 698a00c641..9f6396e5d6 100644
--- a/pkg/build/nodeimage/defaults.go
+++ b/pkg/build/nodeimage/defaults.go
@@ -22,4 +22,4 @@ const DefaultImage = "kindest/node:latest"
 // DefaultBaseImage is the default base image used
 // TODO: come up with a reasonable solution to digest pinning
 // https://github.com/moby/moby/issues/43188
-const DefaultBaseImage = "docker.io/kindest/base:v20250312-b98dc21a"
+const DefaultBaseImage = "docker.io/kindest/base:v20250424-c9432c36"