diff --git a/ansible/roles/docker_node/defaults/main.yml b/ansible/roles/docker_node/defaults/main.yml
index 3c2c2a43..ee9257e7 100644
--- a/ansible/roles/docker_node/defaults/main.yml
+++ b/ansible/roles/docker_node/defaults/main.yml
@@ -5,7 +5,7 @@ docker_defaults:
   apt_repo:
     key: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
     package_name: docker-ce
-    package_ver: 5:27.5.1-1~ubuntu.24.04~noble
+    package_ver: 5:28.1.1-1~ubuntu.24.04~noble
     repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
     url: https://download.docker.com/linux/ubuntu/gpg
   certs:
diff --git a/ansible/roles/kubernetes/defaults/main.yml b/ansible/roles/kubernetes/defaults/main.yml
index b809e477..1c74b8d5 100644
--- a/ansible/roles/kubernetes/defaults/main.yml
+++ b/ansible/roles/kubernetes/defaults/main.yml
@@ -13,9 +13,9 @@ k8s_defaults:
   admin_config: /etc/kubernetes/admin.conf
   config_fetch_always: false
   apt_repo:
-    # TODO parameterize hardcoded 1.31 value
-    repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.31/deb/ /
-    url: https://pkgs.k8s.io/core:/stable:/v1.31/deb/Release.key
+    # TODO parameterize hardcoded 1.32 value
+    repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.32/deb/ /
+    url: https://pkgs.k8s.io/core:/stable:/v1.32/deb/Release.key
   cplane_hostip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}"
   cplane_vip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}"
   # TODO: might be able to retire cri-dockerd
@@ -32,9 +32,9 @@ k8s_defaults:
     name: kubelet
     state: restarted
   service_network: 10.96.0.0/12
-  version: 1.31.7
+  version: 1.32.4
   coredns_version: v1.11.3
-  cni_version: 1.5.1
+  cni_version: 1.6.0
 k8s_override: {}
 k8s: "{{ k8s_defaults | combine(k8s_override) }}"
 
diff --git a/k8s/helm/gitea/values.yaml b/k8s/helm/gitea/values.yaml
index 97e2da72..d07b0745 100644
--- a/k8s/helm/gitea/values.yaml
+++ b/k8s/helm/gitea/values.yaml
@@ -90,7 +90,6 @@ nameOverride: ""
 fullnameOverride: ""
 
 serviceAccount: {}
-service:
 service:
   clusterIP: None
   ports:
diff --git a/k8s/helm/restic/values.yaml b/k8s/helm/restic/values.yaml
index bd8e4a95..8393974a 100644
--- a/k8s/helm/restic/values.yaml
+++ b/k8s/helm/restic/values.yaml
@@ -25,9 +25,11 @@ deployment:
   resources:
     limits:
       memory: 2048Mi
+      ephemeral-storage: 50Mi
     requests:
       cpu: 200m
       memory: 512Mi
+      ephemeral-storage: 10Mi
 volumeMounts:
 - mountPath: /var/spool/cron/crontabs/root
   name: config
diff --git a/k8s/install/monitor.yaml b/k8s/install/monitor.yaml
index 16f1f487..2d936f68 100644
--- a/k8s/install/monitor.yaml
+++ b/k8s/install/monitor.yaml
@@ -70,5 +70,5 @@ spec:
           service:
             name: $SERVICE_NAME
             port:
-              number: $PORT_NAGIOSQL
+              number: 80
         pathType: Prefix