diff --git a/kubernetes/RUNBOOK-cold-rebuild.md b/kubernetes/RUNBOOK-cold-rebuild.md
index ac0acdf7..1eaa8f7e 100644
--- a/kubernetes/RUNBOOK-cold-rebuild.md
+++ b/kubernetes/RUNBOOK-cold-rebuild.md
@@ -87,7 +87,7 @@ all three nodes identically from there, since `apply-config --insecure` does
 not care whether the target is a VM or bare metal.
 
 ```
-https://factory.talos.dev/image/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9/v1.12.11/metal-amd64.iso
+https://factory.talos.dev/image/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9/v1.13.9/metal-amd64.iso
 ```
 
 That schematic is deliberately not the one `.woodpecker/deploy-infrastructure.yml`
diff --git a/kubernetes/talos/patches/cluster.yaml b/kubernetes/talos/patches/cluster.yaml
index 90ff8cb9..a302a40b 100644
--- a/kubernetes/talos/patches/cluster.yaml
+++ b/kubernetes/talos/patches/cluster.yaml
@@ -42,8 +42,17 @@ machine:
   # Only read at install and upgrade time. Changing it here does nothing to a
   # running node until that node is upgraded. Bump the tag with the Talos
   # version — it must match the running version, or the upgrade is a downgrade.
+  #
+  # Upgrades follow the documented path: migration is only tested between
+  # adjacent minor releases, so go to the latest patch of each intermediate
+  # minor rather than skipping. 1.12.11 -> 1.13.9 satisfies that — one minor
+  # step from the last 1.12 patch, no intermediate needed.
+  #
+  # Kubernetes is a separate decision and is not forced by this. Talos 1.13
+  # supports Kubernetes 1.36, 1.35, 1.34, 1.33, 1.32 and 1.31, so the cluster
+  # stays on 1.35.2 until `talosctl upgrade-k8s` moves it deliberately.
   install:
-    image: factory.talos.dev/metal-installer/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9:v1.12.11
+    image: factory.talos.dev/metal-installer/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9:v1.13.9
   features:
     rbac: true
     stableHostname: true