diff --git a/.zuul.d/base.yaml b/.zuul.d/base.yaml
index 92fe7912c..4bb29bd03 100644
--- a/.zuul.d/base.yaml
+++ b/.zuul.d/base.yaml
@@ -46,7 +46,7 @@
         - kuryr-tempest-plugin
       devstack_localrc:
         CONTAINER_ENGINE: crio
-        CRIO_VERSION: "1.27"
+        CRIO_VERSION: "1.28"
         ENABLE_TLS: true
         ETCD_USE_RAMDISK: true
         KURYR_ENABLED_HANDLERS: vif,endpoints,service,namespace,pod_label,policy,kuryrnetworkpolicy,kuryrnetwork,kuryrport,kuryrloadbalancer
diff --git a/.zuul.d/k8s-np-e2e.yaml b/.zuul.d/k8s-np-e2e.yaml
index dddc002cf..63fc3bfd4 100644
--- a/.zuul.d/k8s-np-e2e.yaml
+++ b/.zuul.d/k8s-np-e2e.yaml
@@ -43,7 +43,7 @@
         - tag-ports-during-bulk-creation
       devstack_localrc:
         CONTAINER_ENGINE: crio
-        CRIO_VERSION: "1.27"
+        CRIO_VERSION: "1.28"
         ETCD_USE_RAMDISK: true
         KURYR_ENABLED_HANDLERS: vif,endpoints,service,namespace,pod_label,policy,kuryrnetworkpolicy,kuryrnetwork,kuryrport,kuryrloadbalancer
         KURYR_ENFORCE_SG_RULES: false
diff --git a/.zuul.d/tempest-multinode-jobs.yaml b/.zuul.d/tempest-multinode-jobs.yaml
index 8d48272ef..14046f63c 100644
--- a/.zuul.d/tempest-multinode-jobs.yaml
+++ b/.zuul.d/tempest-multinode-jobs.yaml
@@ -54,7 +54,7 @@
                 stats_update_threads: 2
         devstack_localrc:
           CONTAINER_ENGINE: crio
-          CRIO_VERSION: "1.27"
+          CRIO_VERSION: "1.28"
           KURYR_ENABLED_HANDLERS: vif,endpoints,service,namespace,pod_label,policy,kuryrnetworkpolicy,kuryrnetwork,kuryrport,kuryrloadbalancer
           KURYR_ENFORCE_SG_RULES: false
           KURYR_EP_DRIVER_OCTAVIA_PROVIDER: ovn
diff --git a/devstack/local.conf.ovs.sample b/devstack/local.conf.ovs.sample
index 6cd07e53a..b7288c86a 100644
--- a/devstack/local.conf.ovs.sample
+++ b/devstack/local.conf.ovs.sample
@@ -85,7 +85,7 @@ enable_service o-hk
 enable_plugin devstack-plugin-container https://opendev.org/openstack/devstack-plugin-container
 # We are using CRI-O by default. The version should match K8s version:
 CONTAINER_ENGINE="crio"
-CRIO_VERSION="1.27"
+CRIO_VERSION="1.28"
 
 # Etcd
 # ====
diff --git a/devstack/local.conf.sample b/devstack/local.conf.sample
index 17dca0a3f..9e9b45f1e 100644
--- a/devstack/local.conf.sample
+++ b/devstack/local.conf.sample
@@ -80,7 +80,7 @@ enable_plugin ovn-octavia-provider https://opendev.org/openstack/ovn-octavia-pro
 enable_plugin devstack-plugin-container https://opendev.org/openstack/devstack-plugin-container
 # We are using CRI-O by default. The version should match K8s version:
 CONTAINER_ENGINE="crio"
-CRIO_VERSION="1.27"
+CRIO_VERSION="1.28"
 
 # Etcd
 # ====
diff --git a/devstack/settings b/devstack/settings
index d4df571d8..1954d54f0 100644
--- a/devstack/settings
+++ b/devstack/settings
@@ -27,7 +27,7 @@ ETCD_PORT=${ETCD_PORT:-2379}
 
 # KUBERNETES
 KURYR_KUBERNETES_DATA_DIR=${KURYR_KUBERNETES_DATA_DIR:-${DATA_DIR}/kubernetes}
-KURYR_KUBERNETES_VERSION=${KURYR_KUBERNETES_VERSION:-1.27.3}
+KURYR_KUBERNETES_VERSION=${KURYR_KUBERNETES_VERSION:-1.28.2}
 KURYR_K8S_API_PORT=${KURYR_K8S_API_PORT:-6443}
 # NOTE(dulek): [kubernetes]api_root option will use LB IP instead.
 KURYR_K8S_API_URL=${KURYR_K8S_API_URL:-"https://${SERVICE_HOST}:${KURYR_K8S_API_PORT}"}