diff --git a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
index b89a28e8..50533762 100644
--- a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
+++ b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml
@@ -37,7 +37,7 @@
 # or rolling updates will collide again on a single reservation.
 #
 # The dhcp binary ships from the sibling cni-plugins-installer DaemonSet
-# (containernetworking/plugins v1.5.1, whole tarball extracted). Keep the
+# (containernetworking/plugins v1.9.1, whole tarball extracted). Keep the
 # version pins in step.
 apiVersion: apps/v1
 kind: DaemonSet
diff --git a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
index 508c0260..c0cce4eb 100644
--- a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
+++ b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
@@ -10,7 +10,7 @@
 # rather than an extra initContainer in the vendored multus manifest so
 # upstream multus updates can be re-vendored cleanly.
 #
-# Pinned to containernetworking/plugins v1.5.1 — bump together with the
+# Pinned to containernetworking/plugins v1.9.1 — bump together with the
 # multus version when refreshing upstream pins.
 apiVersion: apps/v1
 kind: DaemonSet
@@ -74,7 +74,7 @@ spec:
           # No imagePullSecret: the ghcr namespace is private and its credential
           # is in machine.registries too, because a Secret would have to come
           # from OpenBao, which needs Ceph, which needs these binaries.
-          image: gitea.renner.uno/konairius/cni-plugins:2026-09-04
+          image: gitea.renner.uno/konairius/cni-plugins:2026-10-05
           command:
             - sh
             - -c