diff --git a/infra/ansible/roles/cilium/defaults/main.yml b/infra/ansible/roles/cilium/defaults/main.yml
index 6f107ed..1ddc8f3 100644
--- a/infra/ansible/roles/cilium/defaults/main.yml
+++ b/infra/ansible/roles/cilium/defaults/main.yml
@@ -5,14 +5,14 @@
 # (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
 
 # Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
-cilium_version: "1.19.7"
+cilium_version: "1.20.1"
 cilium_chart_repo_name: "cilium"
 cilium_chart_repo_url: "https://helm.cilium.io/"
 cilium_namespace: "kube-system"
 
 # Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
 # Cilium 1.16 targets Gateway API v1.2.x.
-gateway_api_version: "v1.4.1"
+gateway_api_version: "v1.6.1"
 gateway_api_crd_urls:
   - "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
   # TLSRoute (experimental) is required by Cilium's Gateway API support.
diff --git a/platform/cilium/helmrelease.yaml b/platform/cilium/helmrelease.yaml
index 96b1e27..b408c86 100644
--- a/platform/cilium/helmrelease.yaml
+++ b/platform/cilium/helmrelease.yaml
@@ -27,7 +27,7 @@ spec:
       chart: cilium
       # [parity] Pinned to the exact version the Ansible bootstrap installs
       # (cilium_version in roles/cilium/defaults/main.yml). Renovate bumps both together.
-      version: "1.19.7"
+      version: "1.20.1"
       sourceRef:
         kind: HelmRepository
         name: cilium
diff --git a/platform/longhorn/helmrelease.yaml b/platform/longhorn/helmrelease.yaml
index 81fc0c7..090abc2 100644
--- a/platform/longhorn/helmrelease.yaml
+++ b/platform/longhorn/helmrelease.yaml
@@ -14,7 +14,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: ">=1.11.0 <1.12.0"   # W4 upgrade 1.10->1.11 (resolves 1.11.3; needs k8s>=1.34). Renovate maintains
+      version: ">=1.12.0 <1.13.0"   # W5 upgrade 1.11->1.12 (resolves 1.12.1; supports k8s 1.36). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: longhorn