diff --git a/doc/configuration.md b/doc/configuration.md
index 47ccc0b8..a99d8a48 100644
--- a/doc/configuration.md
+++ b/doc/configuration.md
@@ -52,7 +52,7 @@ Parameters controlling the cluster creation:
 | `pod_cidr`                       | `POD_CIDR`                                      | SCS        | `192.168.0.0/16`                                         | IPv4 address range (CIDR notation) for pods                                                                                                                                                                |
 | `service_cidr`                   | `SERVICE_CIDR`                                  | SCS        | `10.96.0.0/12`                                           | IPv4 address range (CIDR notation) for services                                                                                                                                                            |
 | `use_cilium`                     | `USE_CILIUM`                                    | SCS        | `true`                                                   | Use cilium as CNI instead of calico, it can be set to vX.Y.Z and `true` results in `v1.15.1`, also see `cilium_binaries`                                                                                   |
-| `calico_version`                 | `CALICO_VERSION`                                | SCS        | `v3.27.3` <!-- renovate: datasource=github-releases depName=projectcalico/calico -->                                                | Version of the Calico CNI provider (ignored if `use_cilium` is set)                                                                                                                                        |
+| `calico_version`                 | `CALICO_VERSION`                                | SCS        | `v3.28.0` <!-- renovate: datasource=github-releases depName=projectcalico/calico -->                                                | Version of the Calico CNI provider (ignored if `use_cilium` is set)                                                                                                                                        |
 | `kubernetes_version`             | `KUBERNETES_VERSION`                            | capo       | `v1.28.x`                                                | Kubernetes version deployed into workload cluster (`.x` means latest patch release)                                                                                                                        |
 | ``                               | `OPENSTACK_IMAGE_NAME`                          | capo       | `ubuntu-capi-image-${KUBERNETES_VERION}`                 | Image name for k8s controller and worker nodes. Ubuntu 22.04 image is used for k8s versions >= 1.27.3, 1.26.6, 1.25.11, Ubuntu 20.04 otherwise.                                                            |
 | `kube_image_raw`                 | `OPENSTACK_IMAGE_RAW`                           | SCS        | `true`                                                   | Register images in raw format (instead of qcow2), good for ceph COW                                                                                                                                        |
diff --git a/terraform/environments/environment-default.tfvars b/terraform/environments/environment-default.tfvars
index f538ae3e..929c97c9 100644
--- a/terraform/environments/environment-default.tfvars
+++ b/terraform/environments/environment-default.tfvars
@@ -17,7 +17,7 @@ mgmt_ip_range        = {"start": "<start of the IP range>", "end": "<end of the
 # Settings for testcluster
 kubernetes_version   = "<v1.XX.XX>"		  # defaults to "v1.28.x"
 kube_image_raw       = "<boolean>"      # defaults to "true"
-calico_version       = "<v3.xx.y>"	# defaults to `v3.27.3` <!-- renovate: datasource=github-releases depName=projectcalico/calico -->
+calico_version       = "<v3.xx.y>"	# defaults to `v3.28.0` <!-- renovate: datasource=github-releases depName=projectcalico/calico -->
 controller_flavor    = "<flavor>"       # defaults to SCS-2V-4-20s (use etcd tweaks if you only have SCS-2V-4-20 in multi-controller setups)
 worker_flavor        = "<flavor>"       # defaults to SCS-2V-4-20s  (larger helps)
 controller_count     = <number>         # defaults to 1 (0 skips testcluster creation)
diff --git a/terraform/variables.tf b/terraform/variables.tf
index c250d61a..07a30e0b 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -61,7 +61,7 @@ variable "ssh_username" {
 variable "calico_version" {
   description = "desired version of calico"
   type        = string
-  default     = "v3.27.3" # renovate: datasource=github-releases depName=projectcalico/calico
+  default     = "v3.28.0" # renovate: datasource=github-releases depName=projectcalico/calico
 }
 
 variable "clusterapi_version" {