diff --git a/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/kustomization.yaml b/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
index 73c140205c..2bd43f2d94 100644
--- a/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
+++ b/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
@@ -6,7 +6,7 @@ namespace: kube-system
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io/
-    version: 1.18.7
+    version: 1.19.4
     releaseName: cilium
     includeCRDs: true
     namespace: kube-system
diff --git a/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/manifest.yaml b/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/manifest.yaml
index a9f976c460..d641e8dd8e 100644
--- a/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/manifest.yaml
+++ b/kubernetes/berries/apps/kube-system/cilium/app/bootstrap/manifest.yaml
@@ -857,7 +857,7 @@ spec:
               value: 172.16.30.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/operator-generic:v1.18.7@sha256:244306c5e7c6b73dc7193424f46ed8a0530767b03f03baac80dd717a3a3f0ad7
+          image: quay.io/cilium/operator-generic:v1.19.4@sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71
           imagePullPolicy: IfNotPresent
           livenessProbe:
             httpGet:
@@ -942,7 +942,7 @@ spec:
             - serve
           command:
             - hubble-relay
-          image: quay.io/cilium/hubble-relay:v1.18.7@sha256:9bb9b2b1a4f4bef12a77738756cfbf970daa701e536e42f0a9c64a621bc7c9d5
+          image: quay.io/cilium/hubble-relay:v1.19.4@sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431
           imagePullPolicy: IfNotPresent
           livenessProbe:
             tcpSocket:
@@ -1128,7 +1128,7 @@ spec:
               value: 172.16.30.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -1250,7 +1250,7 @@ spec:
               value: 172.16.30.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: config
           terminationMessagePolicy: FallbackToLogsOnError
@@ -1263,7 +1263,7 @@ spec:
             - /bin/bash
             - -c
             - --
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: mount-bpf-fs
           securityContext:
@@ -1292,7 +1292,7 @@ spec:
               value: 172.16.30.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: clean-cilium-state
           resources:
@@ -1321,7 +1321,7 @@ spec:
               name: cilium-run
         - command:
             - /install-plugin.sh
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: install-cni-binaries
           resources:
diff --git a/kubernetes/berries/apps/kube-system/cilium/app/helmrelease.yaml b/kubernetes/berries/apps/kube-system/cilium/app/helmrelease.yaml
index b5ab8ffb43..659425d2aa 100644
--- a/kubernetes/berries/apps/kube-system/cilium/app/helmrelease.yaml
+++ b/kubernetes/berries/apps/kube-system/cilium/app/helmrelease.yaml
@@ -9,7 +9,7 @@ spec:
     spec:
       # renovate: registryUrl=https://helm.cilium.io
       chart: cilium
-      version: 1.18.7
+      version: 1.19.4
       interval: 30m
       sourceRef:
         kind: HelmRepository
diff --git a/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/kustomization.yaml b/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
index 73c140205c..2bd43f2d94 100644
--- a/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
+++ b/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/kustomization.yaml
@@ -6,7 +6,7 @@ namespace: kube-system
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io/
-    version: 1.18.7
+    version: 1.19.4
     releaseName: cilium
     includeCRDs: true
     namespace: kube-system
diff --git a/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/manifest.yaml b/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/manifest.yaml
index 1d48a6e80f..98cff20a38 100644
--- a/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/manifest.yaml
+++ b/kubernetes/subterra/apps/kube-system/cilium/app/bootstrap/manifest.yaml
@@ -857,7 +857,7 @@ spec:
               value: 192.168.48.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/operator-generic:v1.18.7@sha256:244306c5e7c6b73dc7193424f46ed8a0530767b03f03baac80dd717a3a3f0ad7
+          image: quay.io/cilium/operator-generic:v1.19.4@sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71
           imagePullPolicy: IfNotPresent
           livenessProbe:
             httpGet:
@@ -942,7 +942,7 @@ spec:
             - serve
           command:
             - hubble-relay
-          image: quay.io/cilium/hubble-relay:v1.18.7@sha256:9bb9b2b1a4f4bef12a77738756cfbf970daa701e536e42f0a9c64a621bc7c9d5
+          image: quay.io/cilium/hubble-relay:v1.19.4@sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431
           imagePullPolicy: IfNotPresent
           livenessProbe:
             tcpSocket:
@@ -1128,7 +1128,7 @@ spec:
               value: 192.168.48.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -1250,7 +1250,7 @@ spec:
               value: 192.168.48.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: config
           terminationMessagePolicy: FallbackToLogsOnError
@@ -1263,7 +1263,7 @@ spec:
             - /bin/bash
             - -c
             - --
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: mount-bpf-fs
           securityContext:
@@ -1292,7 +1292,7 @@ spec:
               value: 192.168.48.100
             - name: KUBERNETES_SERVICE_PORT
               value: '6443'
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: clean-cilium-state
           resources:
@@ -1321,7 +1321,7 @@ spec:
               name: cilium-run
         - command:
             - /install-plugin.sh
-          image: quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c
+          image: quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c
           imagePullPolicy: IfNotPresent
           name: install-cni-binaries
           resources:
diff --git a/kubernetes/subterra/apps/kube-system/cilium/app/helmrelease.yaml b/kubernetes/subterra/apps/kube-system/cilium/app/helmrelease.yaml
index 5146b3f099..6a201f9ae6 100644
--- a/kubernetes/subterra/apps/kube-system/cilium/app/helmrelease.yaml
+++ b/kubernetes/subterra/apps/kube-system/cilium/app/helmrelease.yaml
@@ -9,7 +9,7 @@ spec:
     spec:
       # renovate: registryUrl=https://helm.cilium.io
       chart: cilium
-      version: 1.18.7
+      version: 1.19.4
       interval: 30m
       sourceRef:
         kind: HelmRepository