diff --git a/Release.toml b/Release.toml
index 79d70ad500d..cb724c30e1c 100644
--- a/Release.toml
+++ b/Release.toml
@@ -206,4 +206,8 @@ version = "1.14.0"
     "migrate_v1.14.0_kubelet-config-settings.lz4",
     "migrate_v1.14.0_kubelet-prefix-config-settings.lz4",
     "migrate_v1.14.0_k8s-services-mode.lz4",
+    "migrate_v1.14.0_aws-admin-container-v0-10-1.lz4",
+    "migrate_v1.14.0_public-admin-container-v0-10-1.lz4",
+    "migrate_v1.14.0_aws-control-container-v0-7-2.lz4",
+    "migrate_v1.14.0_public-control-container-v0-7-2.lz4",
 ]
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
index ceacfff6261..94eeba88881 100644
--- a/sources/Cargo.lock
+++ b/sources/Cargo.lock
@@ -497,6 +497,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "aws-admin-container-v0-10-1"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "aws-admin-container-v0-9-4"
 version = "0.1.0"
@@ -547,6 +554,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "aws-control-container-v0-7-2"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "aws-credential-types"
 version = "0.54.1"
@@ -3003,6 +3017,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "public-admin-container-v0-10-1"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "public-admin-container-v0-9-4"
 version = "0.1.0"
@@ -3024,6 +3045,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "public-control-container-v0-7-2"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.26.0"
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
index b16c7ff39b0..27edf91ca9a 100644
--- a/sources/Cargo.toml
+++ b/sources/Cargo.toml
@@ -48,6 +48,10 @@ members = [
     "api/migration/migrations/v1.14.0/kubelet-config-settings",
     "api/migration/migrations/v1.14.0/kubelet-prefix-config-settings",
     "api/migration/migrations/v1.14.0/k8s-services-mode",
+    "api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1",
+    "api/migration/migrations/v1.14.0/public-admin-container-v0-10-1",
+    "api/migration/migrations/v1.14.0/aws-control-container-v0-7-2",
+    "api/migration/migrations/v1.14.0/public-control-container-v0-7-2",
 
     "bottlerocket-release",
 
diff --git a/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/Cargo.toml b/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/Cargo.toml
new file mode 100644
index 00000000000..966ae125ae1
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "aws-admin-container-v0-10-1"
+version = "0.1.0"
+authors = ["Markus Boehme <markubo@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/src/main.rs b/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/src/main.rs
new file mode 100644
index 00000000000..fb888fb0239
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/aws-admin-container-v0-10-1/src/main.rs
@@ -0,0 +1,27 @@
+use migration_helpers::common_migrations::ReplaceTemplateMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_ADMIN_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.0";
+const NEW_ADMIN_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.1";
+
+/// We bumped the version of the default admin container
+fn run() -> Result<()> {
+    migrate(ReplaceTemplateMigration {
+        setting: "settings.host-containers.admin.source",
+        old_template: OLD_ADMIN_CTR_TEMPLATE,
+        new_template: NEW_ADMIN_CTR_TEMPLATE,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// /~https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/Cargo.toml b/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/Cargo.toml
new file mode 100644
index 00000000000..5536e107e67
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "aws-control-container-v0-7-2"
+version = "0.1.0"
+authors = ["Markus Boehme <markubo@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/src/main.rs b/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/src/main.rs
new file mode 100644
index 00000000000..90a1b207a6b
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/aws-control-container-v0-7-2/src/main.rs
@@ -0,0 +1,27 @@
+use migration_helpers::common_migrations::ReplaceTemplateMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_CONTROL_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.1";
+const NEW_CONTROL_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.2";
+
+/// We bumped the version of the default control container
+fn run() -> Result<()> {
+    migrate(ReplaceTemplateMigration {
+        setting: "settings.host-containers.control.source",
+        old_template: OLD_CONTROL_CTR_TEMPLATE,
+        new_template: NEW_CONTROL_CTR_TEMPLATE,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// /~https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/Cargo.toml b/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/Cargo.toml
new file mode 100644
index 00000000000..2943210181c
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "public-admin-container-v0-10-1"
+version = "0.1.0"
+authors = ["Markus Boehme <markubo@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/src/main.rs b/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/src/main.rs
new file mode 100644
index 00000000000..6b432d7f902
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/public-admin-container-v0-10-1/src/main.rs
@@ -0,0 +1,25 @@
+use migration_helpers::common_migrations::ReplaceStringMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_ADMIN_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.0";
+const NEW_ADMIN_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.1";
+
+/// We bumped the version of the default admin container
+fn run() -> Result<()> {
+    migrate(ReplaceStringMigration {
+        setting: "settings.host-containers.admin.source",
+        old_val: OLD_ADMIN_CTR_SOURCE_VAL,
+        new_val: NEW_ADMIN_CTR_SOURCE_VAL,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// /~https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/Cargo.toml b/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/Cargo.toml
new file mode 100644
index 00000000000..9c3d1dacb24
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "public-control-container-v0-7-2"
+version = "0.1.0"
+authors = ["Markus Boehme <markubo@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/src/main.rs b/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/src/main.rs
new file mode 100644
index 00000000000..e72e92f74ae
--- /dev/null
+++ b/sources/api/migration/migrations/v1.14.0/public-control-container-v0-7-2/src/main.rs
@@ -0,0 +1,25 @@
+use migration_helpers::common_migrations::ReplaceStringMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_CONTROL_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.1";
+const NEW_CONTROL_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.2";
+
+/// We bumped the version of the default control container
+fn run() -> Result<()> {
+    migrate(ReplaceStringMigration {
+        setting: "settings.host-containers.control.source",
+        old_val: OLD_CONTROL_CTR_SOURCE_VAL,
+        new_val: NEW_CONTROL_CTR_SOURCE_VAL,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// /~https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/models/shared-defaults/aws-host-containers.toml b/sources/models/shared-defaults/aws-host-containers.toml
index 0768d782fd6..f3e24a6bbe9 100644
--- a/sources/models/shared-defaults/aws-host-containers.toml
+++ b/sources/models/shared-defaults/aws-host-containers.toml
@@ -4,7 +4,7 @@ superpowered = true
 
 [metadata.settings.host-containers.admin.source]
 setting-generator = "schnauzer settings.host-containers.admin.source"
-template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.0"
+template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.1"
 
 [metadata.settings.host-containers.admin.user-data]
 setting-generator = "shibaken generate-admin-userdata"
@@ -15,4 +15,4 @@ superpowered = false
 
 [metadata.settings.host-containers.control.source]
 setting-generator = "schnauzer settings.host-containers.control.source"
-template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.1"
+template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.2"
diff --git a/sources/models/shared-defaults/public-host-containers.toml b/sources/models/shared-defaults/public-host-containers.toml
index 0a16ea689e2..acc4ad38421 100644
--- a/sources/models/shared-defaults/public-host-containers.toml
+++ b/sources/models/shared-defaults/public-host-containers.toml
@@ -6,9 +6,9 @@
 [settings.host-containers.admin]
 enabled = false
 superpowered = true
-source = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.0"
+source = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.1"
 
 [settings.host-containers.control]
 enabled = false
 superpowered = false
-source = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.1"
+source = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.2"