Repository: linkerd/linkerd2
Pull request #5795 (2021-02-22 17:15:33)

Upgrade proxy-init to v1.3.9 (#5759)
This change back-ports 826d5799 onto the release/stable-2.9 branch.

- Unifies the Go version across Docker and CI to be 1.14.15;
- Updates the GitHub Actions base image from ubuntu-18.04 to ubuntu-20.04; and
- Updates the runtime base image from debian:buster-20201117-slim to debian:buster-20210208-slim.

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->



Patch:
diff --git a/Dockerfile-debug b/Dockerfile-debug
index 7efe0075e..805efd605 100644
--- a/Dockerfile-debug
+++ b/Dockerfile-debug
@@ -1,4 +1,4 @@
-FROM debian:buster-20200514-slim
+FROM debian:buster-20210208-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     dnsutils \
diff --git a/Dockerfile-proxy b/Dockerfile-proxy
index 871bacdf1..1f2a3281e 100644
--- a/Dockerfile-proxy
+++ b/Dockerfile-proxy
@@ -1,8 +1,8 @@
-ARG RUNTIME_IMAGE=debian:buster-20200514-slim
+ARG RUNTIME_IMAGE=debian:buster-20210208-slim
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.14.2-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.14.15-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index 9804c58e7..dd0cb0fe3 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -101,7 +101,7 @@ global:
     image:
       name: ghcr.io/linkerd/proxy-init
       pullPolicy: *image_pull_policy
-      version: v1.3.6
+      version: v1.3.9
     resources:
       cpu:
         limit: 100m
diff --git a/cli/Dockerfile-bin b/cli/Dockerfile-bin
index 44aae6081..d18c950f0 100644
--- a/cli/Dockerfile-bin
+++ b/cli/Dockerfile-bin
@@ -2,7 +2,7 @@ ARG BUILDPLATFORM=linux/amd64
 ARG BUILD_STAGE=single-arch
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.14.2-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.14.15-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/cni-plugin/Dockerfile b/cni-plugin/Dockerfile
index f7922bb85..19e18e62c 100644
--- a/cni-plugin/Dockerfile
+++ b/cni-plugin/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.14.2-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.14.15-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
@@ -18,7 +18,7 @@ COPY cni-plugin cni-plugin
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /go/bin/linkerd-cni -v -mod=readonly ./cni-plugin/
 
-FROM debian:buster-20200514-slim
+FROM debian:buster-20210208-slim
 WORKDIR /linkerd
 RUN apt-get update && apt-get install -y --no-install-recommends \
     iptables \
diff --git a/controller/Dockerfile b/controller/Dockerfile
index afada3985..b86a496c2 100644
--- a/controller/Dockerfile
+++ b/controller/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.14.2-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.14.15-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index f5c48d277..ed10852b0 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -58,7 +58,7 @@
         "--outbound-ports-to-ignore",
         "25,443,587,3306,11211,5432"
       ],
-      "image": "ghcr.io/linkerd/proxy-init:v1.3.6",
+      "image": "ghcr.io/linkerd/proxy-init:v1.3.9",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index 0ecda2e48..e4f61bcee 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -58,7 +58,7 @@
         "--outbound-ports-to-ignore",
         "25,443,587,3306,11211,5432"
       ],
-      "image": "ghcr.io/linkerd/proxy-init:v1.3.6",
+      "image": "ghcr.io/linkerd/proxy-init:v1.3.9",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
diff --git a/go.mod b/go.mod
index b0bc0d62a..0932a5e0e 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/imdario/mergo v0.3.7
 	github.com/julienschmidt/httprouter v1.2.0
 	github.com/linkerd/linkerd2-proxy-api v0.1.15
-	github.com/linkerd/linkerd2-proxy-init v1.3.6
+	github.com/linkerd/linkerd2-proxy-init v1.3.9
 	github.com/mattn/go-isatty v0.0.12
 	github.com/mattn/go-runewidth v0.0.2
 	github.com/mitchellh/copystructure v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 17e96f60e..ae0ac2245 100644
--- a/go.sum
+++ b/go.sum
@@ -356,6 +356,8 @@ github.com/linkerd/linkerd2-proxy-api v0.1.15 h1:hy/36GwG+BnKxxh3BAnC5cfUsH/ZAxu
 github.com/linkerd/linkerd2-proxy-api v0.1.15/go.mod h1:yFz+DCCEomC3vpsChFzfCuOuSJtzx7jMNNHBIlbFil0=
 github.com/linkerd/linkerd2-proxy-init v1.3.6 h1:qRJJJFc2hn/fWGeO4pyyZZvtkhLrE68THg+MRUyCphE=
 github.com/linkerd/linkerd2-proxy-init v1.3.6/go.mod h1:M6iaaLLi06ofuIV6x74SDknSFi7VS/MFqa5m+CwHgLY=
+github.com/linkerd/linkerd2-proxy-init v1.3.9 h1:T2H4P6N3V7mRRr3twp0JDzvq1XSvv9S/orxWbwj7kFM=
+github.com/linkerd/linkerd2-proxy-init v1.3.9/go.mod h1:M6iaaLLi06ofuIV6x74SDknSFi7VS/MFqa5m+CwHgLY=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 463269952..1d419c2b3 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -16,7 +16,7 @@ var Version = undefinedVersion
 // https://github.com/linkerd/linkerd2-proxy-init
 // This has to be kept in sync with the constraint version for
 // github.com/linkerd/linkerd2-proxy-init in /go.mod
-var ProxyInitVersion = "v1.3.6"
+var ProxyInitVersion = "v1.3.9"
 
 const (
 	// undefinedVersion should take the form `channel-version` to conform to
diff --git a/web/Dockerfile b/web/Dockerfile
index 04a691e9f..59947bb14 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.14.2-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.14.15-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
@@ -43,7 +43,7 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -mod=readonly -o web/web -ldflags "-s -w" ./web
 
 ## package it all up
-FROM debian:buster-20200514-slim
+FROM debian:buster-20210208-slim
 WORKDIR /linkerd
 
 COPY LICENSE .


Test patch:
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 419482314..14c8e52a5 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -13,7 +13,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-18.04
     container:
-      image: golang:1.14.2
+      image: golang:1.14.15
     steps:
     - name: Checkout code
       # actions/checkout@v2
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index 4ee7f991e..f570bee0f 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -136,7 +136,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 2e5223aad..672703ccf 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -136,7 +136,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -305,7 +305,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index 626d3cbd5..16a863578 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -136,7 +136,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 4b4a8b98b..82181a82d 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -176,7 +176,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 021b37c68..97b96fbf2 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -147,7 +147,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -327,7 +327,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -507,7 +507,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -687,7 +687,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index 9d72b5419..a5261f640 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -147,7 +147,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index f570ac9a7..3163d781d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -160,7 +160,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 7089caf89..4b99f5cf0 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -165,7 +165,7 @@ spec:
         - 4190,9998,7777,8888
         - --outbound-ports-to-ignore
         - "9999"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index 7e1737c0f..aeab228cd 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -147,7 +147,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -327,7 +327,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index d3b813a7a..6a2b3f3f5 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -152,7 +152,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index e20696f9c..ce742c83d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -147,7 +147,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 0c15b648e..5cf24d4c2 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -148,7 +148,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index d68b2f1e5..ebfc6d077 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -148,7 +148,7 @@ spec:
         - 4190,1234,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index 1db179390..4fd97127f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -149,7 +149,7 @@ spec:
         - 4190,4191,22,8100-8102
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
index fc1b0f2c7..a9ccb1fc3 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
@@ -157,7 +157,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index f310be00e..c3c7749f7 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -149,7 +149,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index bf7c4f75d..ffca381c9 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -149,7 +149,7 @@ items:
           - 4190,4191,25,443,587,3306,11211,5432
           - --outbound-ports-to-ignore
           - 25,443,587,3306,11211,5432
-          image: ghcr.io/linkerd/proxy-init:v1.3.6
+          image: ghcr.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -323,7 +323,7 @@ items:
           - 4190,4191,25,443,587,3306,11211,5432
           - --outbound-ports-to-ignore
           - 25,443,587,3306,11211,5432
-          image: ghcr.io/linkerd/proxy-init:v1.3.6
+          image: ghcr.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index 914d21b57..421a2eb58 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -149,7 +149,7 @@ items:
           - 4190,4191,25,443,587,3306,11211,5432
           - --outbound-ports-to-ignore
           - 25,443,587,3306,11211,5432
-          image: ghcr.io/linkerd/proxy-init:v1.3.6
+          image: ghcr.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -323,7 +323,7 @@ items:
           - 4190,4191,25,443,587,3306,11211,5432
           - --outbound-ports-to-ignore
           - 25,443,587,3306,11211,5432
-          image: ghcr.io/linkerd/proxy-init:v1.3.6
+          image: ghcr.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 4e4aab064..c1ebfcec5 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -132,7 +132,7 @@ spec:
     - 4190,4191,25,443,587,3306,11211,5432
     - --outbound-ports-to-ignore
     - 25,443,587,3306,11211,5432
-    image: ghcr.io/linkerd/proxy-init:v1.3.6
+    image: ghcr.io/linkerd/proxy-init:v1.3.9
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index 1a0cfb17e..84670a793 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -134,7 +134,7 @@ spec:
     - 4190,4191,22,8100-8102
     - --outbound-ports-to-ignore
     - "5432"
-    image: ghcr.io/linkerd/proxy-init:v1.3.6
+    image: ghcr.io/linkerd/proxy-init:v1.3.9
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index d86e75d32..cbafe95fa 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -143,7 +143,7 @@ spec:
     - 4190,4191,25,443,587,3306,11211,5432
     - --outbound-ports-to-ignore
     - 25,443,587,3306,11211,5432
-    image: ghcr.io/linkerd/proxy-init:v1.3.6
+    image: ghcr.io/linkerd/proxy-init:v1.3.9
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index 1d696867d..289b56e67 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -148,7 +148,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 525ae51ec..8c2c11112 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -149,7 +149,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -331,7 +331,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_tap_deployment.input.yml b/cli/cmd/testdata/inject_tap_deployment.input.yml
index 7847bb86a..a4e0c2188 100644
--- a/cli/cmd/testdata/inject_tap_deployment.input.yml
+++ b/cli/cmd/testdata/inject_tap_deployment.input.yml
@@ -203,7 +203,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index 22e5dcf72..8ea9ca4f1 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -201,7 +201,7 @@ spec:
         - 4190,4191,25,443,587,3306,11211,5432
         - --outbound-ports-to-ignore
         - 25,443,587,3306,11211,5432
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index 42a5e73ea..f0872d844 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -900,7 +900,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1227,7 +1227,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1460,7 +1460,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1711,7 +1711,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1991,7 +1991,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2203,7 +2203,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2457,7 +2457,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2698,7 +2698,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3008,7 +3008,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3443,7 +3443,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3742,7 +3742,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3963,7 +3963,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_control-plane.golden b/cli/cmd/testdata/install_control-plane.golden
index 1db92b0bd..2d213c4d4 100644
--- a/cli/cmd/testdata/install_control-plane.golden
+++ b/cli/cmd/testdata/install_control-plane.golden
@@ -13,7 +13,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"-----BEGIN CERTIFICATE-----\nMIIBwTCCAWagAwIBAgIQeDZp5lDaIygQ5UfMKZrFATAKBggqhkjOPQQDAjApMScw\nJQYDVQQDEx5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIubG9jYWwwHhcNMjAwODI4\nMDcxMjQ3WhcNMzAwODI2MDcxMjQ3WjApMScwJQYDVQQDEx5pZGVudGl0eS5saW5r\nZXJkLmNsdXN0ZXIubG9jYWwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqc70Z\nl1vgw79rjB5uSITICUA6GyfvSFfcuIis7B/XFSkkwAHU5S/s1AAP+R0TX7HBWUC4\nuaG4WWsiwJKNn7mgo3AwbjAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB\n/wIBATAdBgNVHQ4EFgQU5YtjVVPfd7I7NLHsn2C26EByGV0wKQYDVR0RBCIwIIIe\naWRlbnRpdHkubGlua2VyZC5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYC\nIQCN7lBFLDDvjx6V0+XkjpKERRsJYf5adMvnloFl48ilJgIhANtxhndcr+QJPuC8\nvgUC0d2/9FMueIVMb+46WTCOjsqr\n-----END CERTIFICATE-----\n","issuanceLifetime":"86400s","clockSkewAllowance":"20s","scheme":"linkerd.io/tls"},"autoInjectContext":null,"omitWebhookSideEffects":false,"clusterDomain":"cluster.local"}
   proxy: |
-    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxyInitImageVersion":"v1.3.6","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version","destinationGetNetworks":"10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16","logFormat":"plain","outboundConnectTimeout":"","inboundConnectTimeout":""}
+    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxyInitImageVersion":"v1.3.9","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version","destinationGetNetworks":"10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16","logFormat":"plain","outboundConnectTimeout":"","inboundConnectTimeout":""}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}
   values: |
@@ -114,7 +114,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -442,7 +442,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -675,7 +675,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -926,7 +926,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1205,7 +1205,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1416,7 +1416,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1669,7 +1669,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1909,7 +1909,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2231,7 +2231,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2627,7 +2627,7 @@ spec:
         - 4190,4191
         - --outbound-ports-to-ignore
         - "443"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 8cdb9280c..7bb0e52e5 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1230,7 +1230,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1478,7 +1478,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1744,7 +1744,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2038,7 +2038,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2264,7 +2264,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2532,7 +2532,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2788,7 +2788,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3112,7 +3112,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3561,7 +3561,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 2f1537bd4..74721add9 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: my.custom.registry/linkerd-io/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1221,7 +1221,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1454,7 +1454,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1705,7 +1705,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1984,7 +1984,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2196,7 +2196,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2450,7 +2450,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2691,7 +2691,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3001,7 +3001,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3436,7 +3436,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
+        image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index fdbef58a7..a4edcbd66 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1221,7 +1221,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1454,7 +1454,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1705,7 +1705,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1984,7 +1984,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2196,7 +2196,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2450,7 +2450,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2691,7 +2691,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3001,7 +3001,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3436,7 +3436,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 270d9e9cf..21850cf12 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1221,7 +1221,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1454,7 +1454,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1705,7 +1705,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1984,7 +1984,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2196,7 +2196,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2450,7 +2450,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2691,7 +2691,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3001,7 +3001,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3436,7 +3436,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 942a4121a..9fd9e4775 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -891,7 +891,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1218,7 +1218,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1451,7 +1451,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1702,7 +1702,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1981,7 +1981,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2193,7 +2193,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2447,7 +2447,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2688,7 +2688,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3115,7 +3115,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 884fc6b0c..b042d53bc 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -900,7 +900,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1317,7 +1317,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1584,7 +1584,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1869,7 +1869,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2165,7 +2165,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2411,7 +2411,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2699,7 +2699,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2974,7 +2974,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3295,7 +3295,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3741,7 +3741,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index adbcabefc..fa46c1013 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -900,7 +900,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1317,7 +1317,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1584,7 +1584,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1869,7 +1869,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2165,7 +2165,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2411,7 +2411,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2699,7 +2699,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2974,7 +2974,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3295,7 +3295,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3741,7 +3741,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 057a9b05f..bd8464940 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -850,7 +850,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1177,7 +1177,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1410,7 +1410,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1661,7 +1661,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1895,7 +1895,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2107,7 +2107,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2361,7 +2361,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2602,7 +2602,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2912,7 +2912,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3347,7 +3347,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 53c2ea9f9..252e23bfc 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -891,7 +891,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index c976a365d..ce22af6ab 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1278,7 +1278,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1511,7 +1511,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1762,7 +1762,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2041,7 +2041,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2253,7 +2253,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2507,7 +2507,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2748,7 +2748,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3058,7 +3058,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3546,7 +3546,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 52499ca6d..4fed0dc2c 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -894,7 +894,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1221,7 +1221,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1454,7 +1454,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1705,7 +1705,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1984,7 +1984,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2196,7 +2196,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2450,7 +2450,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2691,7 +2691,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3001,7 +3001,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3436,7 +3436,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index 1c73b3f4a..5ce08c86c 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -826,7 +826,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1153,7 +1153,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1386,7 +1386,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1637,7 +1637,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1916,7 +1916,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2128,7 +2128,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2382,7 +2382,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2623,7 +2623,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2933,7 +2933,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3368,7 +3368,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index 42a5e73ea..f0872d844 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -900,7 +900,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1227,7 +1227,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1460,7 +1460,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1711,7 +1711,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1991,7 +1991,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2203,7 +2203,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2457,7 +2457,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2698,7 +2698,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3008,7 +3008,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3443,7 +3443,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3742,7 +3742,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3963,7 +3963,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index 7b73a51f3..e76fbe980 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -900,7 +900,7 @@ data:
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
-          version: v1.3.6
+          version: v1.3.9
         resources:
           cpu:
             limit: 100m
@@ -1229,7 +1229,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1462,7 +1462,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1713,7 +1713,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1993,7 +1993,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2205,7 +2205,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2459,7 +2459,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2700,7 +2700,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3010,7 +3010,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3445,7 +3445,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3744,7 +3744,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -3965,7 +3965,7 @@ spec:
         - "4190,4191,25,443,587,3306,11211,5432"
         - --outbound-ports-to-ignore
         - "25,443,587,3306,11211,5432"
-        image: ghcr.io/linkerd/proxy-init:v1.3.6
+        image: ghcr.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 7afc38e83..917624264 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2416,7 +2416,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"fake-trust-anchors-pem","issuanceLifetime":"86400s","clockSkewAllowance":"20s"}}
   proxy: |
-    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.3.6","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
+    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.3.9","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}`,
 			},
@@ -2462,7 +2462,7 @@ data:
 					},
 					DisableExternalProfiles: true,
 					ProxyVersion:            "install-proxy-version",
-					ProxyInitImageVersion:   "v1.3.6",
+					ProxyInitImageVersion:   "v1.3.9",
 					DebugImage: &configPb.Image{
 						ImageName:  "ghcr.io/linkerd/debug",
 						PullPolicy: "IfNotPresent",
@@ -2554,7 +2554,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"fake-trust-anchors-pem","issuanceLifetime":"86400s","clockSkewAllowance":"20s"}}
   proxy: |
-    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.3.6","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
+    {"proxyImage":{"imageName":"ghcr.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"ghcr.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.3.9","debugImage":{"imageName":"ghcr.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}
   values: |