diff --git a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
index b89a28e8..eef96cbc 100644
--- a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
+++ b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
@@ -71,7 +71,7 @@ spec:
         # socket's parent, and refuses to start if the socket file is left
         # over from an unclean shutdown (bind: address already in use).
         - name: clean-socket
-          image: alpine:3.21
+          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
           command: ["sh", "-c", "rm -f /run/cni/dhcp.sock"]
           volumeMounts:
             - name: run-cni
@@ -83,7 +83,7 @@ spec:
           # Any image with a shell works: the binary executed here is the
           # host's, bind-mounted from /opt/cni/bin. Pinned to the same
           # alpine tag the sibling installer uses.
-          image: alpine:3.21
+          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
           command:
             - /opt/cni/bin/dhcp
             - daemon
diff --git a/kubernetes/infrastructure/multus/multus-daemonset.yaml b/kubernetes/infrastructure/multus/multus-daemonset.yaml
index 527d2530..cffb217b 100644
--- a/kubernetes/infrastructure/multus/multus-daemonset.yaml
+++ b/kubernetes/infrastructure/multus/multus-daemonset.yaml
@@ -1,5 +1,5 @@
-# Vendored from k8snetworkplumbingwg/multus-cni v4.2.4 thick daemonset:
-#   https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.2.4/deployments/multus-daemonset-thick.yml
+# Vendored from k8snetworkplumbingwg/multus-cni v4.3.1 thick daemonset:
+#   https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.3.1/deployments/multus-daemonset-thick.yml
 #
 # Why vendored, not Helm: there is no published Helm repository for this
 # project — the upstream k8snetworkplumbingwg/helm-charts repo only ships
@@ -7,10 +7,11 @@
 # https://k8snetworkplumbingwg.github.io/helm-charts/ 404s.
 #
 # Why thick (not thin): the only version-pinned image tag published for
-# v4.2.4 is `v4.2.4-thick` — there is no `v4.2.4-thin` or unsuffixed
+# v4.2.4 was `v4.2.4-thick` — there was no `v4.2.4-thin` or unsuffixed
 # `v4.2.4` tag (verified against ghcr.io/k8snetworkplumbingwg/multus-cni
-# package versions). The thin variant only ships under moving tags
-# (snapshot, latest), which we don't want for reproducibility.
+# package versions). The thin variant only shipped under moving tags
+# (snapshot, latest), which we don't want for reproducibility. v4.3.1 also
+# publishes an unsuffixed tag; we keep `-thick` so image and manifest match.
 #
 # Talos compatibility: the daemon chroots into /hostroot to exec CNI
 # plugin binaries from /opt/cni/bin on the host. Talos's rootfs is
@@ -30,6 +31,7 @@ spec:
     kind: NetworkAttachmentDefinition
     shortNames:
       - net-attach-def
+      - nad
   versions:
     - name: v1
       served: true
@@ -82,6 +84,15 @@ rules:
       - list
       - update
       - watch
+  - apiGroups:
+      - "resource.k8s.io"
+    resources:
+      - resourceclaims
+      - resourceclaims/status
+      - resourceslices
+    verbs:
+      - get
+      - list
   - apiGroups:
       - ""
       - events.k8s.io
@@ -206,7 +217,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.4-thick
+          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.3.1-thick@sha256:a357a79359b80ddd5f4699117946cacf3b54f5baecf7944535594863e875fc25
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             # Bumped from upstream's 100m/50Mi: on a clean rebuild the edge
@@ -268,7 +279,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.4-thick
+          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.3.1-thick@sha256:a357a79359b80ddd5f4699117946cacf3b54f5baecf7944535594863e875fc25
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"
@@ -286,7 +297,7 @@ spec:
             - name: cnibin
               mountPath: /host/opt/cni/bin
               mountPropagation: Bidirectional
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: 30
       volumes:
         - name: cni
           hostPath: