diff --git a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx
index c46ac58e78..26fcd94c14 100644
--- a/calico_versioned_docs/version-3.31/reference/installation/_api.mdx
+++ b/calico_versioned_docs/version-3.31/reference/installation/_api.mdx
@@ -322,10 +322,29 @@ _Appears in:_
 | --- | --- |
 | `type` _[CNIPluginType](#cniplugintype)_ | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.<br />Default: Calico |
 | `ipam` _[IPAMSpec](#ipamspec)_ | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. |
+| `specVersion` _[CNISpecVersion](#cnispecversion)_ | (Optional) SpecVersion configures the CNI specification version declared in the CNI configuration ("cniVersion") that the operator generates. Auto (the default) lets the operator choose an appropriate version, which may increase across operator upgrades. Pin an explicit version if a chained CNI plugin or container runtime in your environment requires one. Only relevant when using the Calico CNI plugin.<br />Default: Auto |
 | `binDir` _string_ | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". * For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". * Otherwise, this field defaults to "/opt/cni/bin". |
 | `confDir` _string_ | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. * For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". * For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". * Otherwise, this field defaults to "/etc/cni/net.d". |
 
 
+### CNISpecVersion
+
+_Underlying type:_ _string_
+
+CNISpecVersion is the version of the CNI specification declared in the
+CNI configuration generated by the operator.
+
+_Appears in:_
+- [CNISpec](#cnispec)
+
+| Value | Description |
+| --- | --- |
+| `Auto` | CNISpecVersionAuto lets the operator choose the CNI spec version. The chosen version may be raised in future operator versions as older container runtimes fall out of support.  |
+| `0.3.1` |  |
+| `0.4.0` |  |
+| `1.0.0` |  |
+
+
 ### CRDManagement
 
 _Underlying type:_ _string_
diff --git a/calico_versioned_docs/version-3.31/release-notes/index.mdx b/calico_versioned_docs/version-3.31/release-notes/index.mdx
index 4909fc2a34..3255a06180 100644
--- a/calico_versioned_docs/version-3.31/release-notes/index.mdx
+++ b/calico_versioned_docs/version-3.31/release-notes/index.mdx
@@ -413,4 +413,36 @@ If you use Calico Ingress Gateway, this release bumps the bundled Envoy Gateway
 
 If the Tigera Operator manages your Gateway API CRDs (the default), set `crdManagement: Reconcile` on the `GatewayAPI` resource so the operator upgrades the CRDs during the upgrade. If a `safe-upgrades.gateway.networking.k8s.io` ValidatingAdmissionPolicy blocks the upgrade with `Installing experimental CRDs on top of standard channel CRDs is prohibited`, delete that policy and its binding, then let the operator reconcile. The operator recreates the policy afterward.
 
-If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading.
\ No newline at end of file
+If you manage the Gateway API CRDs yourself, install the Gateway API v1.5.1 CRDs before upgrading.
+
+### Calico Open Source 3.31.7 bug fix release
+
+August 20, 2026
+
+#### Bug fixes
+
+- ebpf: Fixed IPv6 session affinity entries being randomly deleted (or never expiring) due to a struct layout mismatch when Felix read the affinity timestamp, which could re-balance sticky connections to a different backend. [calico 13460](https://github.com/projectcalico/calico/pull/13460) (@tomastigera)
+- Fixes an issue in nftables mode where IP set members could be left unprogrammed after the nftables table was deleted and recreated. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
+- Fixes an issue in nftables mode where Felix could panic when reading back an IP set member it could not parse. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
+- Fixes an issue where IP sets containing overlapping CIDRs could fail to program correctly in nftables mode after a member was removed. [calico 13441](https://github.com/projectcalico/calico/pull/13441) (@caseydavenport)
+- Fixes CALICO_IPV6POOL_VXLAN being ignored in IPv6-only clusters where the IPv4 pool is disabled (CALICO_IPV4POOL_CIDR=none), which left the IPv6 pool without VXLAN encapsulation. [calico 13439](https://github.com/projectcalico/calico/pull/13439) (@caseydavenport)
+- [eBPF] Fix a window in which a new connection to a local workload could skip that workload's ingress policy, when the connection was started while the workload's route was still being programmed. [calico 13390](https://github.com/projectcalico/calico/pull/13390) (@tomastigera)
+- Fixed the bundled Envoy Gateway crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute or BackendTLSPolicy, such as OpenShift or GKE's managed Gateway API addon. [calico 13367](https://github.com/projectcalico/calico/pull/13367) (@electricjesus)
+- Fixed a bug where Calico could advertise a Service IP over BGP from a node whose local endpoint was not Ready, causing connection failures. [calico 13255](https://github.com/projectcalico/calico/pull/13255) (@MichalFupso)
+- Fixed a kernel dmesg spew ("could not enable bpf_trace_printk events") on eBPF-dataplane nodes running with kernel lockdown=confidentiality (e.g. Talos). [calico 13234](https://github.com/projectcalico/calico/pull/13234) (@tomastigera)
+- Fixed a rare start-of-day deadlock that could prevent Felix from restarting when a restart-requiring configuration change (e.g. the node IP being set) arrived while Felix was still starting up. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- Fixed a latent bug where EnsureBlock could allocate an IPv6 block from the wrong IP pool when an explicit IPv6 pool selector was provided (Windows host-local IPAM block reservation). [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- eBPF: fix state explosion in the BPF verifier (resulting in programs not loading) caused by debug logs on a certain path. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- eBPF dataplane: fix loss of connectivity to the Kubernetes API server service after the API server is unavailable for a period, when using bpfNetworkBootstrap. Felix no longer clears the API server service's NAT backend when its endpoints transiently empty, so connectivity recovers without a calico-node restart. [calico 13066](https://github.com/projectcalico/calico/pull/13066) (@lucastigera)
+- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12959](https://github.com/projectcalico/calico/pull/12959) (@fasaxc)
+
+#### Other changes
+
+- Refresh the node-driver-registrar dependency patch to remediate CVEs (grpc v1.82.1, x/net, x/text). [calico 13520](https://github.com/projectcalico/calico/pull/13520) (@skoryk-oleksandr)
+- Update bundled Envoy images (envoy-gateway v1.8.2, envoy-proxy v1.38.3) and refresh dependency patches to remediate CVEs. [calico 13502](https://github.com/projectcalico/calico/pull/13502) (@skoryk-oleksandr)
+- The default CNI configuration now declares cniVersion 1.0.0 (previously 0.3.1), enabling Calico as a multus delegate on OpenShift 4.23+. Requires containerd v1.6+ or CRI-O v1.24+. [calico 13378](https://github.com/projectcalico/calico/pull/13378) (@sridhartigera)
+- calicoctl cluster diags now collects additional cluster state (v3 API resources, Multus network-attachment-definitions, unsupported-annotation usage) and collects eBPF map dumps as machine-parseable JSON, falling back to legacy text output against older calico-node versions. [calico 13020](https://github.com/projectcalico/calico/pull/13020) (@tomastigera)
+
+#### Updating
+
+To update a previous version of Calico, see [our upgrade guides](../operations/upgrading/index.mdx).
\ No newline at end of file
diff --git a/calico_versioned_docs/version-3.31/releases.json b/calico_versioned_docs/version-3.31/releases.json
index b42ba90521..d4707b716b 100644
--- a/calico_versioned_docs/version-3.31/releases.json
+++ b/calico_versioned_docs/version-3.31/releases.json
@@ -1,4 +1,102 @@
 [
+  {
+    "title": "v3.31.7",
+    "tigera-operator": {
+      "image": "tigera/operator",
+      "registry": "quay.io",
+      "version": "v1.40.15"
+    },
+    "components": {
+      "calico/typha": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/ctl": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/node": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/node-windows": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/cni": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/cni-windows": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/apiserver": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/kube-controllers": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-gateway": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-proxy": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/envoy-ratelimit": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/flannel-migration-controller": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "flannel": {
+        "version": "v0.24.4",
+        "registry": "docker.io"
+      },
+      "calico/dikastes": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "flexvol": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/csi": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/node-driver-registrar": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/pod2daemon-flexvol": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/key-cert-provisioner": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/goldmane": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/whisker": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      },
+      "calico/whisker-backend": {
+        "version": "v3.31.7",
+        "registry": "quay.io"
+      }
+    }
+  },
   {
     "title": "v3.31.6",
     "tigera-operator": {
diff --git a/calico_versioned_docs/version-3.31/variables.js b/calico_versioned_docs/version-3.31/variables.js
index 6ef8812c10..aeceb36f9c 100644
--- a/calico_versioned_docs/version-3.31/variables.js
+++ b/calico_versioned_docs/version-3.31/variables.js
@@ -1,7 +1,7 @@
 const releases = require('./releases.json');
 
 const variables = {
-  releaseTitle: 'v3.31.6',
+  releaseTitle: 'v3.31.7',
   prodname: 'Calico',
   prodnamedash: 'calico',
   version: 'v3.31',
@@ -16,11 +16,11 @@ const variables = {
   noderunning: 'calico-node',
   rootDirWindows: 'C:\\CalicoWindows',
   ppa_repo_name: 'calico-3.31',
-  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.6',
+  manifestsUrl: 'https://raw.githubusercontent.com/projectcalico/calico/v3.31.7',
   releases,
   registry: '',
   vppbranch: 'v3.31.0',
-  envoyVersion: '1.8.0',
+  envoyVersion: '1.8.2',
   tigeraOperator: releases[0]['tigera-operator'],
   tigeraOperatorVersionShort: releases[0]['tigera-operator'].version.split('.').slice(0, 2).join('.'),
   imageNames: {