diff --git a/api/v1alpha1/hardware_types.go b/api/v1alpha1/hardware_types.go
index 83c24a19e..d0c721ac9 100644
--- a/api/v1alpha1/hardware_types.go
+++ b/api/v1alpha1/hardware_types.go
@@ -31,6 +31,8 @@ type HardwareList struct {
 // +kubebuilder:resource:path=hardware,scope=Namespaced,categories=tinkerbell,singular=hardware,shortName=hw
 // +kubebuilder:storageversion
 // +kubebuilder:printcolumn:JSONPath=".status.state",name=State,type=string
+// +kubebuilder:metadata:labels=clusterctl.cluster.x-k8s.io=
+// +kubebuilder:metadata:labels=clusterctl.cluster.x-k8s.io/move=
 
 // Hardware is the Schema for the Hardware API.
 type Hardware struct {
diff --git a/cmd/tink-agent/Dockerfile b/cmd/tink-agent/Dockerfile
index a1c43e8eb..6c24d804c 100644
--- a/cmd/tink-agent/Dockerfile
+++ b/cmd/tink-agent/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.20.3
 ARG TARGETOS
 ARG TARGETARCH
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/tink-agent-${TARGETOS}-${TARGETARCH} /usr/bin/tink-agent
 
diff --git a/cmd/tink-controller-v1alpha2/Dockerfile b/cmd/tink-controller-v1alpha2/Dockerfile
index 7b7f0a742..6bb12cdf4 100644
--- a/cmd/tink-controller-v1alpha2/Dockerfile
+++ b/cmd/tink-controller-v1alpha2/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.20.3
 ARG TARGETOS
 ARG TARGETARCH
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/tink-controller-v1alpha2-${TARGETOS}-${TARGETARCH} /usr/bin/tink-controller
 
diff --git a/cmd/tink-controller/Dockerfile b/cmd/tink-controller/Dockerfile
index 8b725a6bb..27c98311f 100644
--- a/cmd/tink-controller/Dockerfile
+++ b/cmd/tink-controller/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.20.3
 ARG TARGETOS
 ARG TARGETARCH
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/tink-controller-${TARGETOS}-${TARGETARCH} /usr/bin/tink-controller
 
diff --git a/cmd/tink-server/Dockerfile b/cmd/tink-server/Dockerfile
index 2a48a552f..468a0efde 100644
--- a/cmd/tink-server/Dockerfile
+++ b/cmd/tink-server/Dockerfile
@@ -5,7 +5,7 @@ ARG TARGETARCH
 
 EXPOSE 42113 42114
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/tink-server-${TARGETOS}-${TARGETARCH} /usr/bin/tink-server
 
diff --git a/cmd/tink-worker/Dockerfile b/cmd/tink-worker/Dockerfile
index c1ae155ee..9d2366798 100644
--- a/cmd/tink-worker/Dockerfile
+++ b/cmd/tink-worker/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.20.3
 ARG TARGETOS
 ARG TARGETARCH
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/tink-worker-${TARGETOS}-${TARGETARCH} /usr/bin/tink-worker
 
diff --git a/cmd/virtual-worker/Dockerfile b/cmd/virtual-worker/Dockerfile
index ca914357c..e7cf39034 100644
--- a/cmd/virtual-worker/Dockerfile
+++ b/cmd/virtual-worker/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.20.3
 ARG TARGETOS
 ARG TARGETARCH
 
-RUN apk add --no-cache --update --upgrade ca-certificates=20240705-r0
+RUN apk add --no-cache --update --upgrade ca-certificates=20241121-r0
 
 COPY bin/virtual-worker-${TARGETOS}-${TARGETARCH} /usr/bin/virtual-worker
 
diff --git a/config/crd/bases/tinkerbell.org_hardware.yaml b/config/crd/bases/tinkerbell.org_hardware.yaml
index a32dcfbf0..348f3bb38 100644
--- a/config/crd/bases/tinkerbell.org_hardware.yaml
+++ b/config/crd/bases/tinkerbell.org_hardware.yaml
@@ -3,6 +3,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.16.3
+  labels:
+    clusterctl.cluster.x-k8s.io: ""
+    clusterctl.cluster.x-k8s.io/move: ""
   name: hardware.tinkerbell.org
 spec:
   group: tinkerbell.org