diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index a858cddef49b..c5db0a1fbfcb 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -8837,7 +8837,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-33-0
+  name: contour-certgen-v1-33-1
   namespace: contour-external
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -8849,7 +8849,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -9091,7 +9091,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -9175,7 +9175,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -9203,7 +9203,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:distroless-v1.35.2
+          image: docker.io/envoyproxy/envoy:distroless-v1.35.8
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -9268,7 +9268,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -9567,7 +9567,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-33-0
+  name: contour-certgen-v1-33-1
   namespace: contour-internal
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -9579,7 +9579,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -9729,7 +9729,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -9813,7 +9813,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -9841,7 +9841,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:distroless-v1.35.2
+          image: docker.io/envoyproxy/envoy:distroless-v1.35.8
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -9906,7 +9906,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.0
+          image: ghcr.io/projectcontour/contour:v1.33.1
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index cd9b7d36ed53..c5d2a2df8b33 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20251218-f6cb9661"
+    app.kubernetes.io/version: "20251226-0a279dbc"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20251218-f6cb9661"
+    app.kubernetes.io/version: "20251226-0a279dbc"
 data:
   _example: |
     ################################
@@ -111,7 +111,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20251218-f6cb9661"
+    app.kubernetes.io/version: "20251226-0a279dbc"
 spec:
   replicas: 1
   selector:
@@ -123,14 +123,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20251218-f6cb9661"
+        app.kubernetes.io/version: "20251226-0a279dbc"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:a8e07f14e3ea1446b9a4763a7087bd996bb927fecab4eec770da5bc4bfa73e54
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:5c46a0b4423843781936e2ebca77c42aa4ecb0a2ddfcf929d6005c4ce46e26ef
           resources:
             requests:
               cpu: 40m
@@ -174,7 +174,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20251218-f6cb9661"
+    app.kubernetes.io/version: "20251226-0a279dbc"
 spec:
   delegations:
     - secretName: routing-serving-certs