diff --git a/tigera-operator/custom-resources.yaml b/tigera-operator/custom-resources.yaml
index f91b6d0..188a467 100644
--- a/tigera-operator/custom-resources.yaml
+++ b/tigera-operator/custom-resources.yaml
@@ -58,6 +58,21 @@ spec:
   vxlanMode: Never
   natOutgoing: false
 ---
+apiVersion: projectcalico.org/v3
+kind: FelixConfiguration
+metadata:
+  name: default
+spec:
+  # No IP pool uses VXLAN (see vxlanMode: Never above), but calico-node startup
+  # only ever enables this flag and never clears it. Left enabled, Felix retries
+  # the nonexistent vxlan.calico device on every resync, spamming route_mgr
+  # errors and forking `nft` on all nodes.
+  vxlanEnabled: false
+  # Stored as "ACCEPT" by an older Calico, which today's validator rejects
+  # (Drop/Accept/Return, case-sensitive) — that made every write to this object
+  # fail, so the casing has to be corrected here. Same semantics.
+  defaultEndpointToHostAction: Accept
+---
 # This section configures the Calico API server.
 # For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.APIServer
 apiVersion: operator.tigera.io/v1
diff --git a/tigera-operator/kustomization.yaml b/tigera-operator/kustomization.yaml
index 6e9b298..fdc15a6 100644
--- a/tigera-operator/kustomization.yaml
+++ b/tigera-operator/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-- https://raw.githubusercontent.com/projectcalico/calico/v3.31.3/manifests/tigera-operator.yaml
+- https://raw.githubusercontent.com/projectcalico/calico/v3.31.7/manifests/tigera-operator.yaml
 - ./custom-resources.yaml
 - ssh://git@git.k-space.ee/secretspace/kube/tigera-operator