diff --git a/calico-cloud_versioned_docs/version-20-2/release-notes/index.mdx b/calico-cloud_versioned_docs/version-20-2/release-notes/index.mdx
index c99c8e072..1366838e5 100644
--- a/calico-cloud_versioned_docs/version-20-2/release-notes/index.mdx
+++ b/calico-cloud_versioned_docs/version-20-2/release-notes/index.mdx
@@ -5,6 +5,16 @@ title: Release notes
 
 # Calico Cloud release notes
 
+## December 19, 2024 (version 20.3.1)
+
+### Bug fixes
+
+* Previously, updating Calico Cloud introduced breaking changes for some users who had defined network policy tiers with orders higher than the default value.
+  This was caused by a change to the default tier order to 1,000,000.
+  Now, during upgrades, the installation script checks to see whether the change in default tier order will cause problems.
+  If necessary, the script blocks the new installation and prompts the user to adjust their tier order.
+* Fixed an issue so that guardian picks up refreshed Service Account tokens which caused an issue on some AKS configurations due to a token expiration change.
+
 ## December 17, 2024 (web console update)
 
 ### New features and enhancements
diff --git a/calico-cloud_versioned_docs/version-20-2/variables.js b/calico-cloud_versioned_docs/version-20-2/variables.js
index e5a0011ae..0af8420f4 100644
--- a/calico-cloud_versioned_docs/version-20-2/variables.js
+++ b/calico-cloud_versioned_docs/version-20-2/variables.js
@@ -13,8 +13,8 @@ const variables = {
   rootDirWindows: 'C:\\TigeraCalico',
   nodecontainer: 'cnx-node',
   noderunning: 'calico-node',
-  cloudversion: 'v3.20.0-2.0-9',
-  clouddownloadurl: 'https://installer.calicocloud.io/manifests/v3.20.0-2.0-9',
+  cloudversion: 'v3.20.0-2.0-10',
+  clouddownloadurl: 'https://installer.calicocloud.io/manifests/v3.20.0-2.0-10',
   clouddownloadbase: 'https://installer.calicocloud.io',
   cloudoperatorimage: 'quay.io/tigera/cc-operator',
   imageassuranceversion: 'v1.22.1',
diff --git a/src/___new___/data/ccImageLists.js b/src/___new___/data/ccImageLists.js
index 410428e33..39edc4b66 100644
--- a/src/___new___/data/ccImageLists.js
+++ b/src/___new___/data/ccImageLists.js
@@ -1,6 +1,6 @@
 const ccImageLists = {
-  // curl -0 https://installer.calicocloud.io/manifests/v3.20.0-2.0-9/image-list
-  'v20.3.0 (latest)': `quay.io/tigera/cnx-apiserver:v3.20.0-2.0
+  // curl -0 https://installer.calicocloud.io/manifests/v3.20.0-2.0-10/image-list
+  'v20.3.1 (latest)': `quay.io/tigera/cnx-apiserver:v3.20.0-2.0
 quay.io/tigera/compliance-benchmarker:v3.20.0-2.0
 quay.io/tigera/compliance-controller:v3.20.0-2.0
 quay.io/tigera/compliance-reporter:v3.20.0-2.0
@@ -9,7 +9,7 @@ quay.io/tigera/key-cert-provisioner:v3.20.0-2.0
 quay.io/tigera/deep-packet-inspection:v3.20.0-2.0
 quay.io/tigera/fluentd:v3.20.0-2.0
 quay.io/tigera/fluentd-windows:v3.20.0-2.0
-quay.io/tigera/guardian:v3.20.0-2.0
+quay.io/tigera/guardian:v3.20.0-2.3
 quay.io/tigera/intrusion-detection-controller:v3.20.0-2.0
 quay.io/tigera/webhooks-processor:v3.20.0-2.0
 quay.io/tigera/packetcapture:v3.20.0-2.0
@@ -34,7 +34,7 @@ quay.io/tigera/l7-admission-controller:v3.20.0-2.0
 quay.io/tigera/pod2daemon-flexvol:v3.20.0-2.0
 quay.io/tigera/csi:v3.20.0-2.0
 quay.io/tigera/node-driver-registrar:v3.20.0-2.0
-quay.io/tigera/operator:v1.36.1
+quay.io/tigera/operator:v1.36.1.1
 quay.io/tigera/image-assurance-admission-controller:v1.22.1
 quay.io/tigera/image-assurance-operator:v1.22.1
 quay.io/tigera/image-assurance-container-runtime-adaptor:v1.22.1