diff --git a/hack/release.toml b/hack/release.toml
index efa297939..b4fcacb32 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -25,7 +25,7 @@ CoreDNS: 1.14.2
 Kubernetes: 1.36.0
 CNI: 1.9.1
 Flannel CNI plugin: v1.9.1-flannel1
-Flannel: 0.28.2
+Flannel: 0.28.4
 LVM2: 2_03_38
 runc: 1.4.2
 systemd: 259.5
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index 525fdfc4e..a19bad0b5 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -1183,7 +1183,7 @@ const (
 	// And sign the image using image-signer.
 	//
 	// renovate: datasource=github-releases depName=flannel-io/flannel
-	FlannelVersion = "v0.28.2"
+	FlannelVersion = "v0.28.4"
 
 	// KubeNetworkPoliciesVersion is the version of kube-network-policies when network policies are enabled for flannel.
 	//
diff --git a/website/content/v1.13/reference/cli.md b/website/content/v1.13/reference/cli.md
index 4c424fb5c..d5fa5c47f 100644
--- a/website/content/v1.13/reference/cli.md
+++ b/website/content/v1.13/reference/cli.md
@@ -2369,7 +2369,7 @@ talosctl image k8s-bundle [flags]
 ```
       --coredns-version semver                 CoreDNS semantic version (default v1.14.2)
       --etcd-version semver                    ETCD semantic version (default v3.6.9)
-      --flannel-version semver                 Flannel CNI semantic version (default v0.28.2)
+      --flannel-version semver                 Flannel CNI semantic version (default v0.28.4)
   -h, --help                                   help for k8s-bundle
       --k8s-version semver                     Kubernetes semantic version (default v1.36.0-rc.1)
       --kube-network-policies-version semver   kube-network-policies semantic version (default v1.0.0)