diff --git a/charts/platform-mesh-operator-components/Chart.yaml b/charts/platform-mesh-operator-components/Chart.yaml
index cc3a159f7..bf2f5903f 100644
--- a/charts/platform-mesh-operator-components/Chart.yaml
+++ b/charts/platform-mesh-operator-components/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: platform-mesh-operator-components
 description: A Helm chart for Kubernetes
 type: application
-version: 0.58.0
+version: 0.58.1
 appVersion: "0.0.0"
diff --git a/charts/platform-mesh-operator-components/README.md b/charts/platform-mesh-operator-components/README.md
index 79a9e4089..8e4f004a1 100644
--- a/charts/platform-mesh-operator-components/README.md
+++ b/charts/platform-mesh-operator-components/README.md
@@ -261,7 +261,7 @@ Produces `referencePath: [{name: compref1}, {name: compref2}]`.
 | services.infra.values.istio.passThrough.gateway.name | string | `"pass-https"` |  |
 | services.infra.values.istio.passThrough.gateway.port | string | `"{{ .Values.port }}"` |  |
 | services.infra.values.istio.passThrough.gateway.protocol | string | `"HTTPS"` |  |
-| services.infra.values.kcp.image.tag | string | `"v0.29.0"` |  |
+| services.infra.values.kcp.image.tag | string | `"v0.31.1"` |  |
 | services.infra.values.kcp.rootShard.extraArgs[0] | string | `"--feature-gates=WorkspaceAuthentication=true"` |  |
 | services.infra.values.kcp.webhook.enabled | bool | `true` |  |
 | services.infra.values.keycloak.istio.virtualservice.hosts[0] | string | `"{{ .Values.baseDomain }}"` |  |
diff --git a/charts/platform-mesh-operator-components/tests/__snapshot__/application_test.yaml.snap b/charts/platform-mesh-operator-components/tests/__snapshot__/application_test.yaml.snap
index 80f056681..fda04fc7f 100644
--- a/charts/platform-mesh-operator-components/tests/__snapshot__/application_test.yaml.snap
+++ b/charts/platform-mesh-operator-components/tests/__snapshot__/application_test.yaml.snap
@@ -136,7 +136,7 @@ it should render the application manifests:
               protocol: HTTPS
         kcp:
           image:
-            tag: v0.29.0
+            tag: v0.31.1
           rootShard:
             extraArgs:
               - --feature-gates=WorkspaceAuthentication=true
diff --git a/charts/platform-mesh-operator-components/tests/__snapshot__/helmreleases_test.yaml.snap b/charts/platform-mesh-operator-components/tests/__snapshot__/helmreleases_test.yaml.snap
index 105f5e01a..bc9e6f0ad 100644
--- a/charts/platform-mesh-operator-components/tests/__snapshot__/helmreleases_test.yaml.snap
+++ b/charts/platform-mesh-operator-components/tests/__snapshot__/helmreleases_test.yaml.snap
@@ -136,7 +136,7 @@ HelmRelease snapshots:
               protocol: HTTPS
         kcp:
           image:
-            tag: v0.29.0
+            tag: v0.31.1
           rootShard:
             extraArgs:
               - --feature-gates=WorkspaceAuthentication=true
@@ -599,7 +599,7 @@ enable remote deployment of helmreleases:
               protocol: HTTPS
         kcp:
           image:
-            tag: v0.29.0
+            tag: v0.31.1
           rootShard:
             extraArgs:
               - --feature-gates=WorkspaceAuthentication=true
diff --git a/charts/platform-mesh-operator-components/values.yaml b/charts/platform-mesh-operator-components/values.yaml
index 6b880580e..7caf5ea34 100644
--- a/charts/platform-mesh-operator-components/values.yaml
+++ b/charts/platform-mesh-operator-components/values.yaml
@@ -126,7 +126,7 @@ services:
         enabled: true
       kcp:
         image:
-          tag: v0.29.0
+          tag: v0.31.1
         rootShard:
           extraArgs:
             - --feature-gates=WorkspaceAuthentication=true
diff --git a/local-setup/kustomize/components/platform-mesh-operator-resource/platform-mesh.yaml b/local-setup/kustomize/components/platform-mesh-operator-resource/platform-mesh.yaml
index 0a23fe6fe..e8d35e753 100644
--- a/local-setup/kustomize/components/platform-mesh-operator-resource/platform-mesh.yaml
+++ b/local-setup/kustomize/components/platform-mesh-operator-resource/platform-mesh.yaml
@@ -94,7 +94,7 @@ spec:
             serviceAccount:
               enabled: true
           image:
-            tag: "v0.31.0" # bump kcp image to work around WatchList issues
+            tag: "v0.31.1" # bump kcp image to work around WatchList issues
           shards: []
           frontProxy:
             clusterIP: "10.96.0.100"