diff --git a/nixos/tests/k3s/containerd-config.nix b/nixos/tests/k3s/containerd-config.nix
index db4b3320411f..ffc449b03aba 100644
--- a/nixos/tests/k3s/containerd-config.nix
+++ b/nixos/tests/k3s/containerd-config.nix
@@ -1,6 +1,11 @@
 # A test that containerdConfigTemplate settings get written to containerd/config.toml
 import ../make-test-python.nix (
-  { lib, k3s, ... }:
+  {
+    pkgs,
+    lib,
+    k3s,
+    ...
+  }:
   let
     nodeName = "test";
   in
@@ -9,6 +14,7 @@ import ../make-test-python.nix (
     nodes.machine =
       { ... }:
       {
+        environment.systemPackages = [ pkgs.jq ];
         # k3s uses enough resources the default vm fails.
         virtualisation.memorySize = 1536;
         virtualisation.diskSize = 4096;
@@ -38,7 +44,7 @@ import ../make-test-python.nix (
       start_all()
       machine.wait_for_unit("k3s")
       # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl wait --for='jsonpath={.status.conditions[?(@.type=="Ready")].status}=True' nodes/${nodeName}""")
+      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
       # test whether the config template file contains the magic comment
       out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl")
       assert "MAGIC COMMENT" in out, "the containerd config template does not contain the magic comment"
diff --git a/nixos/tests/k3s/kubelet-config.nix b/nixos/tests/k3s/kubelet-config.nix
index e2c8e0434d62..031c9f823a63 100644
--- a/nixos/tests/k3s/kubelet-config.nix
+++ b/nixos/tests/k3s/kubelet-config.nix
@@ -53,7 +53,7 @@ import ../make-test-python.nix (
       start_all()
       machine.wait_for_unit("k3s")
       # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl wait --for='jsonpath={.status.conditions[?(@.type=="Ready")].status}=True' nodes/${nodeName}""")
+      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
       # test whether the kubelet registered an inhibitor lock
       machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
       # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_28/images-versions.json
index 76bcc7ee7e0a..f5e27995f056 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_28/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.11%2Bk3s2/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "199nxfxwr52cddk2ljchhxaigyi0al3lzyc0jy2am4aljlm0jivy"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0dhzkn5y3ng7blyxj4bwrhbq5qvl3hq1hzg0h9633h8swv0xbsss"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.11%2Bk3s2/k3s-airgap-images-arm.tar.zst",
-    "sha256": "02riiiwwr0h3zhlxxmjn5p8ws354rr2gk44x3kz9d7sxqn17sz4w"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1225nqsfg7p6iq7a7qibzf3d0r7iwn53hnd9w6l189dxqna97015"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.11%2Bk3s2/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "0bs9wj33appb9xpsb2v1xz4xck4qq6g74flnc0mxf9warwr4988r"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "1lic564naj9323dkkq0z0y10n3j3yfmhixargqqs60syanfvj2p7"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.11%2Bk3s2/k3s-images.txt",
-    "sha256": "0245zra2h8756kq2v8nwl6gji749xlvy1y1bkab8vz5b0vpqhfxy"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.28.12%2Bk3s1/k3s-images.txt",
+    "sha256": "1my3lfs5rfazcnnpsc9dj84dfnxx88xydrl86z6yw5n5p84x4nif"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
index 2312cc22cbe9..a6149c0d6e51 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@@ -1,12 +1,12 @@
 {
-  k3sVersion = "1.28.11+k3s2";
-  k3sCommit = "d076d9a78cb835279a04f12c816ff4404884862e";
-  k3sRepoSha256 = "1k1k3qmxc7n2h2i0g52ad4gnpq0qrvxnl7p2y0g9dss1ancgqwsd";
-  k3sVendorHash = "sha256-tzcMcsTmY8lG+9EyYkzYJm1YU/8tGpxpH7oZ4Jl/yNU=";
+  k3sVersion = "1.28.12+k3s1";
+  k3sCommit = "4717e2a58e04f0ba3d9f43d574a7eff01dea9146";
+  k3sRepoSha256 = "02wywlqqna0dj9cam6q3ykb3p5mi96f6lclrg5yhjky7jdvkffds";
+  k3sVendorHash = "sha256-RyUlaGQnfrCm4cB5FRs9IAeF+zn4LzAXmIViU3o30Z4=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.12.2";
-  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
+  k3sRootVersion = "0.14.0";
+  k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
   containerdVersion = "1.7.17-k3s1.28";