diff --git a/images/dnsmasq/Makefile b/images/dnsmasq/Makefile
index 349dd68f1..88fb72176 100644
--- a/images/dnsmasq/Makefile
+++ b/images/dnsmasq/Makefile
@@ -15,7 +15,7 @@
 VERSION ?= $(shell git describe --tags --always --dirty)
 REGISTRY ?= gcr.io/k8s-staging-dns
 ARCH ?= amd64
-DNSMASQ_VERSION ?= dnsmasq-2.86
+DNSMASQ_VERSION ?= dnsmasq-2.87
 CONTAINER_PREFIX ?= k8s-dns
 
 ALL_ARCH := amd64 arm arm64 ppc64le s390x
@@ -53,13 +53,13 @@ DNSMASQ_URL := http://www.thekelleys.org.uk/dnsmasq/$(DNSMASQ_VERSION).tar.xz
 # $ gpg --recv 15CDDA6AE19135A2
 # ...
 # $ gpg --verify dnsmasq-2.86.tar.xz.asc dnsmasq-2.86.tar.xz
-# gpg: Signature made Wed 08 Sep 2021 09:50:46 PM UTC
+# gpg: Signature made Sun 25 Sep 2022 09:37:28 PM UTC
 # gpg:                using RSA key D6EACBD6EE46B834248D111215CDDA6AE19135A2
 # gpg: Good signature from "Simon Kelley <simon@thekelleys.org.uk>" [unknown]
 # gpg:                 aka "Simon Kelley <srk@debian.org>" [unknown]
 # ...
-# $ sha256sum dnsmasq-2.78.tar.xz
-DNSMASQ_SHA256 := 28d52cfc9e2004ac4f85274f52b32e1647b4dbc9761b82e7de1e41c49907eb08
+# $ sha256sum dnsmasq-2.87.tar.xz
+DNSMASQ_SHA256 := 0228c0364a7f2356fd7e7f1549937cbf3099a78d3b2eb1ba5bb0c31e2b89de7a
 DNSMASQ_ARCHIVE := $(OUTPUT_DIR)/dnsmasq.tar.xz
 
 MULTIARCH_CONTAINER := multiarch/qemu-user-static:register
diff --git a/rules.mk b/rules.mk
index cdea85b76..f47e8b7d6 100644
--- a/rules.mk
+++ b/rules.mk
@@ -32,7 +32,7 @@ ALL_ARCH := amd64 arm arm64 ppc64le s390x
 # Multiarch image
 # Uploaded: Jun 6, 2022, 7:19:10 PM
 BASEIMAGE ?= gcr.io/distroless/static-debian11@sha256:d6fa9db9548b5772860fecddb11d84f9ebd7e0321c0cb3c02870402680cc315f
-IPTIMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.1.1
+IPTIMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.1.2
 
 # These rules MUST be expanded at reference time (hence '=') as BINARY
 # is dynamically scoped.