diff --git a/Makefile b/Makefile
index 1770c1dced9..35afab60ef6 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ IMAGE := $(REGISTRY)/$(PROJECT)
 SRCDIRS := ./cmd ./internal ./apis
 LOCAL_BOOTSTRAP_CONFIG = localenvoyconfig.yaml
 SECURE_LOCAL_BOOTSTRAP_CONFIG = securelocalenvoyconfig.yaml
-ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.25.7
+ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.25.9
 GATEWAY_API_VERSION ?= $(shell grep "sigs.k8s.io/gateway-api" go.mod | awk '{print $$2}')
 
 # Used to supply a local Envoy docker container an IP to connect to that is running
diff --git a/cmd/contour/gatewayprovisioner.go b/cmd/contour/gatewayprovisioner.go
index 259db3d0b6d..e2841045e7c 100644
--- a/cmd/contour/gatewayprovisioner.go
+++ b/cmd/contour/gatewayprovisioner.go
@@ -34,7 +34,7 @@ func registerGatewayProvisioner(app *kingpin.Application) (*kingpin.CmdClause, *
 
 	provisionerConfig := &gatewayProvisionerConfig{
 		contourImage:          "ghcr.io/projectcontour/contour:v1.24.4",
-		envoyImage:            "docker.io/envoyproxy/envoy:v1.25.7",
+		envoyImage:            "docker.io/envoyproxy/envoy:v1.25.9",
 		metricsBindAddress:    ":8080",
 		leaderElection:        false,
 		leaderElectionID:      "0d879e31.projectcontour.io",
diff --git a/examples/contour/03-envoy.yaml b/examples/contour/03-envoy.yaml
index 7784cc265af..5cc63023272 100644
--- a/examples/contour/03-envoy.yaml
+++ b/examples/contour/03-envoy.yaml
@@ -50,7 +50,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.25.7
+        image: docker.io/envoyproxy/envoy:v1.25.9
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/deployment/03-envoy-deployment.yaml b/examples/deployment/03-envoy-deployment.yaml
index c72ff68001c..54612c8a31c 100644
--- a/examples/deployment/03-envoy-deployment.yaml
+++ b/examples/deployment/03-envoy-deployment.yaml
@@ -63,7 +63,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.25.7
+          image: docker.io/envoyproxy/envoy:v1.25.9
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-deployment.yaml b/examples/render/contour-deployment.yaml
index 51f58e99605..1fd4c4d5ca1 100644
--- a/examples/render/contour-deployment.yaml
+++ b/examples/render/contour-deployment.yaml
@@ -7417,7 +7417,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.25.7
+          image: docker.io/envoyproxy/envoy:v1.25.9
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
index 332044a908a..578aa1c0061 100644
--- a/examples/render/contour-gateway.yaml
+++ b/examples/render/contour-gateway.yaml
@@ -7410,7 +7410,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.25.7
+        image: docker.io/envoyproxy/envoy:v1.25.9
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
index 78f754cbf34..e799278c087 100644
--- a/examples/render/contour.yaml
+++ b/examples/render/contour.yaml
@@ -7404,7 +7404,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.25.7
+        image: docker.io/envoyproxy/envoy:v1.25.9
         imagePullPolicy: IfNotPresent
         name: envoy
         env: