diff --git a/bin/update.sh b/bin/update.sh
index 5d1db70..603caf3 100755
--- a/bin/update.sh
+++ b/bin/update.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-CALICO_VERSION="3.28.0"
+CALICO_VERSION="3.28.1"
 #BASEURL=https://docs.projectcalico.org/manifests
 #BASEURL=https://docs.projectcalico.org/archive/v3.18/manifests
 BASEURL="https://raw.githubusercontent.com/projectcalico/calico/v${CALICO_VERSION}/manifests"
diff --git a/templates/calico-kube-controllers-Deployment.yaml b/templates/calico-kube-controllers-Deployment.yaml
index 7299448..c2cc9e6 100644
--- a/templates/calico-kube-controllers-Deployment.yaml
+++ b/templates/calico-kube-controllers-Deployment.yaml
@@ -36,7 +36,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers
-          image: docker.io/calico/kube-controllers:v3.28.0
+          image: docker.io/calico/kube-controllers:v3.28.1
           imagePullPolicy: IfNotPresent
           env:
             # Choose which controllers to run.
diff --git a/templates/calico-node-DaemonSet.yaml b/templates/calico-node-DaemonSet.yaml
index 1085976..484ae88 100644
--- a/templates/calico-node-DaemonSet.yaml
+++ b/templates/calico-node-DaemonSet.yaml
@@ -44,7 +44,7 @@ spec:
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
         - name: upgrade-ipam
-          image: docker.io/calico/cni:v3.28.0
+          image: docker.io/calico/cni:v3.28.1
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
           envFrom:
@@ -72,7 +72,7 @@ spec:
         # This container installs the CNI binaries
         # and CNI network config file on each node.
         - name: install-cni
-          image: docker.io/calico/cni:v3.28.0
+          image: docker.io/calico/cni:v3.28.1
           imagePullPolicy: IfNotPresent
           command: ["/opt/cni/bin/install"]
           envFrom:
@@ -115,7 +115,7 @@ spec:
         # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
         # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
         - name: "mount-bpffs"
-          image: docker.io/calico/node:v3.28.0
+          image: docker.io/calico/node:v3.28.1
           imagePullPolicy: IfNotPresent
           command: ["calico-node", "-init", "-best-effort"]
           volumeMounts:
@@ -141,7 +141,7 @@ spec:
         # container programs network policy and routes on each
         # host.
         - name: calico-node
-          image: docker.io/calico/node:v3.28.0
+          image: docker.io/calico/node:v3.28.1
           imagePullPolicy: IfNotPresent
           envFrom:
           - configMapRef:
@@ -284,9 +284,11 @@ spec:
         - name: var-run-calico
           hostPath:
             path: /var/run/calico
+            type: DirectoryOrCreate
         - name: var-lib-calico
           hostPath:
             path: /var/lib/calico
+            type: DirectoryOrCreate
         - name: xtables-lock
           hostPath:
             path: /run/xtables.lock
@@ -307,6 +309,7 @@ spec:
         - name: cni-bin-dir
           hostPath:
             path: /opt/cni/bin
+            type: DirectoryOrCreate
         - name: cni-net-dir
           hostPath:
             path: /etc/cni/net.d
diff --git a/templates/calicoctl-Pod.yaml b/templates/calicoctl-Pod.yaml
index 3c4329c..ce8ae09 100644
--- a/templates/calicoctl-Pod.yaml
+++ b/templates/calicoctl-Pod.yaml
@@ -11,7 +11,7 @@ spec:
   serviceAccountName: calicoctl
   containers:
   - name: calicoctl
-    image: calico/ctl:v3.28.0
+    image: calico/ctl:v3.28.1
     command:
       - calicoctl
     args:
diff --git a/templates/calicoctl-ServiceAccount.yaml b/templates/calicoctl-ServiceAccount.yaml
index 667ff63..5d86c20 100644
--- a/templates/calicoctl-ServiceAccount.yaml
+++ b/templates/calicoctl-ServiceAccount.yaml
@@ -1,7 +1,7 @@
 # Calico Version master
 # https://projectcalico.docs.tigera.io/releases#master
 # This manifest includes the following component versions:
-#   calico/ctl:v3.28.0
+#   calico/ctl:v3.28.1
 
 apiVersion: v1
 kind: ServiceAccount