diff --git a/config/enterprise_versions.yml b/config/enterprise_versions.yml
index 38a4d3ffdc..3f3401707d 100644
--- a/config/enterprise_versions.yml
+++ b/config/enterprise_versions.yml
@@ -1,132 +1,132 @@
 # Components defined here are required to be kept in sync with hack/gen-versions/enterprise.go.tpl
-title: v3.13.2
+title: v3.13.3
 components:
   libcalico-go:
-    version: v3.13.2
+    version: v3.13.3
   cnx-manager:
     image: tigera/cnx-manager
-    version: v3.13.2
+    version: v3.13.3
   voltron:
     image: tigera/voltron
-    version: v3.13.2
+    version: v3.13.3
   cnx-apiserver:
     image: tigera/cnx-apiserver
-    version: v3.13.2
+    version: v3.13.3
   cnx-queryserver:
     image: tigera/cnx-queryserver
-    version: v3.13.2
+    version: v3.13.3
   cnx-kube-controllers:
     image: tigera/kube-controllers
-    version: v3.13.2
+    version: v3.13.3
   typha:
     image: tigera/typha
-    version: v3.13.2
+    version: v3.13.3
   cnx-node:
     image: tigera/cnx-node
-    version: v3.13.2
+    version: v3.13.3
   fluentd:
     image: tigera/fluentd
-    version: v3.13.2
+    version: v3.13.3
   fluentd-windows:
     image: tigera/fluentd-windows
-    version: v3.13.2
+    version: v3.13.3
   es-proxy:
     image: tigera/es-proxy
-    version: v3.13.2
+    version: v3.13.3
   es-gateway:
     image: tigera/es-gateway
-    version: v3.13.2
+    version: v3.13.3
   dex:
     image: tigera/dex
-    version: v3.13.2
+    version: v3.13.3
   eck-kibana:
     version: 7.16.2
   kibana:
     image: tigera/kibana
-    version: v3.13.2
+    version: v3.13.3
   eck-elasticsearch:
     version: 7.16.2
   elasticsearch:
     image: tigera/elasticsearch
-    version: v3.13.2
+    version: v3.13.3
   elastic-tsee-installer:
     image: tigera/intrusion-detection-job-installer
-    version: v3.13.2
+    version: v3.13.3
   es-curator:
     image: tigera/es-curator
-    version: v3.13.2
+    version: v3.13.3
   intrusion-detection-controller:
     image: tigera/intrusion-detection-controller
-    version: v3.13.2
+    version: v3.13.3
   anomaly_detection_jobs:
     image: tigera/anomaly_detection_jobs
-    version: v3.13.2
+    version: v3.13.3
   compliance-controller:
     image: tigera/compliance-controller
-    version: v3.13.2
+    version: v3.13.3
   compliance-reporter:
     image: tigera/compliance-reporter
-    version: v3.13.2
+    version: v3.13.3
   compliance-snapshotter:
     image: tigera/compliance-snapshotter
-    version: v3.13.2
+    version: v3.13.3
   compliance-server:
     image: tigera/compliance-server
-    version: v3.13.2
+    version: v3.13.3
   compliance-benchmarker:
     image: tigera/compliance-benchmarker
-    version: v3.13.2
+    version: v3.13.3
   guardian:
     image: tigera/guardian
-    version: v3.13.2
+    version: v3.13.3
   tigera-cni:
     image: tigera/cni
-    version: v3.13.2
+    version: v3.13.3
   cloud-controllers:
     image: tigera/cloud-controllers
-    version: v3.13.2
+    version: v3.13.3
   elasticsearch-metrics:
     image: tigera/elasticsearch-metrics
-    version: v3.13.2
+    version: v3.13.3
   packetcapture-api:
     image: tigera/packetcapture-api
-    version: v3.13.2
+    version: v3.13.3
   # coreos-prometheus holds the version of prometheus built for tigera/prometheus,
   # which prometheus operator uses to validate.
   coreos-prometheus:
     version: v2.32.0
   prometheus:
     image: tigera/prometheus
-    version: v3.13.2
+    version: v3.13.3
   # coreos-prometheus holds the version of alertmanager built for tigera/alertmanager,
   # which prometheus operator uses to validate.
   coreos-alertmanager:
     version: v0.23.0
   alertmanager:
     image: tigera/alertmanager
-    version: v3.13.2
+    version: v3.13.3
   tigera-prometheus-service:
     image: tigera/prometheus-service
-    version: v3.13.2
+    version: v3.13.3
   deep-packet-inspection:
     image: tigera/deep-packet-inspection
-    version: v3.13.2
+    version: v3.13.3
   windows:
     image: tigera/calico-windows-upgrade
-    version: v3.13.2
+    version: v3.13.3
   # The components below are third-party images that have been retagged under
   # quay.io/tigera so all enterprise images come from the same repository and org.
   elasticsearch-operator:
     image: tigera/eck-operator
-    version: v3.13.2
+    version: v3.13.3
   eck-elasticsearch-operator:
     version: 1.8.0
   l7-collector:
     image: tigera/l7-collector
-    version: v3.13.2
+    version: v3.13.3
   envoy:
     image: tigera/envoy
-    version: v3.13.2
+    version: v3.13.3
   dikastes:
     image: tigera/dikastes
-    version: v3.13.2
+    version: v3.13.3
diff --git a/pkg/components/enterprise.go b/pkg/components/enterprise.go
index 494d7ad374..99f8a53f29 100644
--- a/pkg/components/enterprise.go
+++ b/pkg/components/enterprise.go
@@ -18,40 +18,40 @@
 package components
 
 var (
-	EnterpriseRelease string = "v3.13.2"
+	EnterpriseRelease string = "v3.13.3"
 
 	ComponentAPIServer = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cnx-apiserver",
 	}
 
 	ComponentComplianceBenchmarker = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/compliance-benchmarker",
 	}
 
 	ComponentComplianceController = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/compliance-controller",
 	}
 
 	ComponentComplianceReporter = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/compliance-reporter",
 	}
 
 	ComponentComplianceServer = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/compliance-server",
 	}
 
 	ComponentComplianceSnapshotter = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/compliance-snapshotter",
 	}
 
 	ComponentDeepPacketInspection = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/deep-packet-inspection",
 	}
 
@@ -66,12 +66,12 @@ var (
 	}
 
 	ComponentElasticTseeInstaller = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/intrusion-detection-job-installer",
 	}
 
 	ComponentElasticsearch = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/elasticsearch",
 	}
 
@@ -81,87 +81,87 @@ var (
 	}
 
 	ComponentElasticsearchOperator = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/eck-operator",
 	}
 
 	ComponentEsCurator = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/es-curator",
 	}
 
 	ComponentEsProxy = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/es-proxy",
 	}
 
 	ComponentESGateway = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/es-gateway",
 	}
 
 	ComponentFluentd = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/fluentd",
 	}
 
 	ComponentFluentdWindows = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/fluentd-windows",
 	}
 
 	ComponentGuardian = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/guardian",
 	}
 
 	ComponentIntrusionDetectionController = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/intrusion-detection-controller",
 	}
 
 	ComponentAnomalyDetectionJobs = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/anomaly_detection_jobs",
 	}
 
 	ComponentKibana = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/kibana",
 	}
 
 	ComponentManager = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cnx-manager",
 	}
 
 	ComponentDex = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/dex",
 	}
 
 	ComponentManagerProxy = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/voltron",
 	}
 
 	ComponentPacketCapture = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/packetcapture-api",
 	}
 
 	ComponentL7Collector = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/l7-collector",
 	}
 
 	ComponentEnvoyProxy = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/envoy",
 	}
 
 	ComponentDikastes = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/dikastes",
 	}
 
@@ -171,12 +171,12 @@ var (
 	}
 
 	ComponentPrometheus = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/prometheus",
 	}
 
 	ComponentTigeraPrometheusService = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/prometheus-service",
 	}
 
@@ -186,47 +186,47 @@ var (
 	}
 
 	ComponentPrometheusAlertmanager = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/alertmanager",
 	}
 
 	ComponentQueryServer = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cnx-queryserver",
 	}
 
 	ComponentTigeraKubeControllers = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/kube-controllers",
 	}
 
 	ComponentTigeraNode = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cnx-node",
 	}
 
 	ComponentTigeraTypha = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/typha",
 	}
 
 	ComponentTigeraCNI = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cni",
 	}
 
 	ComponentCloudControllers = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/cloud-controllers",
 	}
 
 	ComponentElasticsearchMetrics = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/elasticsearch-metrics",
 	}
 
 	ComponentTigeraWindows = component{
-		Version: "v3.13.2",
+		Version: "v3.13.3",
 		Image:   "tigera/calico-windows-upgrade",
 	}
 	EnterpriseComponents = []component{
diff --git a/pkg/crds/enterprise/crd.projectcalico.org_managedclusters.yaml b/pkg/crds/enterprise/crd.projectcalico.org_managedclusters.yaml
index e8ec4db28f..232f2ee3d6 100644
--- a/pkg/crds/enterprise/crd.projectcalico.org_managedclusters.yaml
+++ b/pkg/crds/enterprise/crd.projectcalico.org_managedclusters.yaml
@@ -39,6 +39,10 @@ spec:
                   component into the actual application cluster corresponding to this
                   Managed Cluster
                 type: string
+              operatorNamespace:
+                description: The namespace of the managed cluster's operator. This
+                  value is used in the generation of the InstallationManifest.
+                type: string
             type: object
           status:
             properties: