diff --git a/debian/docker-make.ubuntu.yaml b/debian/docker-make.ubuntu.yaml
index 605c6502..b6b1b51e 100644
--- a/debian/docker-make.ubuntu.yaml
+++ b/debian/docker-make.ubuntu.yaml
@@ -13,7 +13,7 @@ default-build-args:
   - DOCKER_APT_CHANNEL=jammy
   - CRI_VERSION=v1.28.0
   # see https://kernel.ubuntu.com/mainline for available versions
-  - UBUNTU_MAINLINE_KERNEL_VERSION=v6.6.1
+  - UBUNTU_MAINLINE_KERNEL_VERSION=v6.6.4
   - ICE_VERSION=1.12.7
   - ICE_PKG_VERSION=1.3.35.0
 
diff --git a/firewall/Dockerfile b/firewall/Dockerfile
index 761ee4da..5575eb6e 100644
--- a/firewall/Dockerfile
+++ b/firewall/Dockerfile
@@ -1,7 +1,7 @@
 ARG BASE_OS_NAME
 ARG BASE_OS_VERSION
 ARG DROPTAILER_VERSION=v0.2.12
-ARG FIREWALL_CONTROLLER_VERSION=v2.0.7
+ARG FIREWALL_CONTROLLER_VERSION=v2.2.0
 ARG TAILSCALE_VERSION=v1.50.1
 
 FROM ghcr.io/metal-stack/droptailer-client:${DROPTAILER_VERSION} AS droptailer-artifacts
@@ -42,9 +42,10 @@ RUN /suricata-and-chrony-installation.sh
 # also remove the most recent version of frr and install the distribution version
 # this should bring back frr-8.1 on ubuntu and frr-7.5.1 on debian
 # TODO can be reverted once https://github.com/FRRouting/frr/issues/12391 is fixed upstream
+# This issue is fixed with 8.5.3 but we still face redundacy issues.
 # must be done after suricata installation because we need to remove the
 # apt sources entries, otherwise we will get back v8.5.x of frr.
-COPY --from=ghcr.io/metal-stack/frr:9.0.1-ubuntu-22.04 /artifacts/*.deb /tmp/
+COPY --from=ghcr.io/metal-stack/frr:9.1-ubuntu-22.04 /artifacts/*.deb /tmp/
 
 RUN set -ex \
  && rm -f /etc/apt/sources.list.d/* \