diff --git a/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml b/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
index 827858a411..69def5d160 100644
--- a/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
+++ b/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
@@ -59,6 +59,8 @@ spec:
     ipv4NativeRoutingCIDR: 10.0.0.0/16 # default net, see hosted control plane controller
     {{- end }}
 
+    policyDenyResponse: icmp
+
     rollOutCiliumPods: true
     encryption:
       enabled: false
diff --git a/charts/t8s-cluster/values.yaml b/charts/t8s-cluster/values.yaml
index e9274cf7f0..f0b60c4cb6 100644
--- a/charts/t8s-cluster/values.yaml
+++ b/charts/t8s-cluster/values.yaml
@@ -2,9 +2,9 @@ global:
   # it's important that the `url` is the first key and `charts` is right below, otherwise renovate won't detect it
   helmRepositories:
     cilium:
-      url: https://helm.cilium.io
+      url: oci://quay.io/cilium/charts
       charts:
-        cilium: 1.18.6
+        cilium: 1.19.0
       condition: '{{ eq (include "t8s-cluster.cni" .) "cilium" }}'
     nvidia:
       url: https://helm.ngc.nvidia.com/nvidia