diff --git a/config/enterprise_versions.yml b/config/enterprise_versions.yml
index 58ac6cf22b..4699c30e53 100644
--- a/config/enterprise_versions.yml
+++ b/config/enterprise_versions.yml
@@ -1,153 +1,153 @@
 # Components defined here are required to be kept in sync with hack/gen-versions/enterprise.go.tpl
-title: v3.19.2
+title: v3.19.3
 components:
   libcalico-go:
-    version: v3.19.2
+    version: v3.19.3
   cnx-manager:
     image: tigera/cnx-manager
-    version: v3.19.2
+    version: v3.19.3
   voltron:
     image: tigera/voltron
-    version: v3.19.2
+    version: v3.19.3
   cnx-apiserver:
     image: tigera/cnx-apiserver
-    version: v3.19.2
+    version: v3.19.3
   cnx-queryserver:
     image: tigera/cnx-queryserver
-    version: v3.19.2
+    version: v3.19.3
   cnx-kube-controllers:
     image: tigera/kube-controllers
-    version: v3.19.2
+    version: v3.19.3
   typha:
     image: tigera/typha
-    version: v3.19.2
+    version: v3.19.3
   cnx-node:
     image: tigera/cnx-node
-    version: v3.19.2
+    version: v3.19.3
   cnx-node-windows:
     image: tigera/cnx-node-windows
-    version: v3.19.2
+    version: v3.19.3
   fluentd:
     image: tigera/fluentd
-    version: v3.19.2
+    version: v3.19.3
   fluentd-windows:
     image: tigera/fluentd-windows
-    version: v3.19.2
+    version: v3.19.3
   es-proxy:
     image: tigera/es-proxy
-    version: v3.19.2
+    version: v3.19.3
   linseed:
     image: tigera/linseed
-    version: v3.19.2
+    version: v3.19.3
   es-gateway:
     image: tigera/es-gateway
-    version: v3.19.2
+    version: v3.19.3
   dex:
     image: tigera/dex
-    version: v3.19.2
+    version: v3.19.3
   eck-kibana:
     version: 7.17.24
   kibana:
     image: tigera/kibana
-    version: v3.19.2
+    version: v3.19.3
   eck-elasticsearch:
     version: 7.17.24
   elasticsearch:
     image: tigera/elasticsearch
-    version: v3.19.2
+    version: v3.19.3
   elastic-tsee-installer:
     image: tigera/intrusion-detection-job-installer
-    version: v3.19.2
+    version: v3.19.3
   es-curator:
     image: tigera/es-curator
-    version: v3.19.2
+    version: v3.19.3
   intrusion-detection-controller:
     image: tigera/intrusion-detection-controller
-    version: v3.19.2
+    version: v3.19.3
   security-event-webhooks-processor:
     image: tigera/webhooks-processor
-    version: v3.19.2
+    version: v3.19.3
   compliance-controller:
     image: tigera/compliance-controller
-    version: v3.19.2
+    version: v3.19.3
   compliance-reporter:
     image: tigera/compliance-reporter
-    version: v3.19.2
+    version: v3.19.3
   compliance-snapshotter:
     image: tigera/compliance-snapshotter
-    version: v3.19.2
+    version: v3.19.3
   compliance-server:
     image: tigera/compliance-server
-    version: v3.19.2
+    version: v3.19.3
   compliance-benchmarker:
     image: tigera/compliance-benchmarker
-    version: v3.19.2
+    version: v3.19.3
   guardian:
     image: tigera/guardian
-    version: v3.19.2
+    version: v3.19.3
   tigera-cni:
     image: tigera/cni
-    version: v3.19.2
+    version: v3.19.3
   tigera-cni-windows:
     image: tigera/cni-windows
-    version: v3.19.2
+    version: v3.19.3
   elasticsearch-metrics:
     image: tigera/elasticsearch-metrics
-    version: v3.19.2
+    version: v3.19.3
   packetcapture:
     image: tigera/packetcapture
-    version: v3.19.2
+    version: v3.19.3
   policy-recommendation:
     image: tigera/policy-recommendation
-    version: v3.19.2
+    version: v3.19.3
   # coreos-prometheus holds the version of prometheus built for tigera/prometheus,
   # which prometheus operator uses to validate.
   coreos-prometheus:
     version: v2.48.1
   prometheus:
     image: tigera/prometheus
-    version: v3.19.2
+    version: v3.19.3
   # coreos-prometheus holds the version of alertmanager built for tigera/alertmanager,
   # which prometheus operator uses to validate.
   coreos-alertmanager:
     version: v0.25.0
   alertmanager:
     image: tigera/alertmanager
-    version: v3.19.2
+    version: v3.19.3
   tigera-prometheus-service:
     image: tigera/prometheus-service
-    version: v3.19.2
+    version: v3.19.3
   deep-packet-inspection:
     image: tigera/deep-packet-inspection
-    version: v3.19.2
+    version: v3.19.3
   flexvol:
     image: tigera/pod2daemon-flexvol
-    version: v3.19.2
+    version: v3.19.3
   csi:
     image: tigera/csi
-    version: v3.19.2
+    version: v3.19.3
   csi-node-driver-registrar:
     image: tigera/node-driver-registrar
-    version: v3.19.2
+    version: v3.19.3
   # The components below are third-party images that have been retagged under
   # quay.io/tigera so all enterprise images come from the same repository and org.
   elasticsearch-operator:
     image: tigera/eck-operator
-    version: v3.19.2
+    version: v3.19.3
   eck-elasticsearch-operator:
     version: 2.6.1
   l7-collector:
     image: tigera/l7-collector
-    version: v3.19.2
+    version: v3.19.3
   envoy:
     image: tigera/envoy
-    version: v3.19.2
+    version: v3.19.3
   dikastes:
     image: tigera/dikastes
-    version: v3.19.2
+    version: v3.19.3
   egress-gateway:
     image: tigera/egress-gateway
-    version: v3.19.2
+    version: v3.19.3
   key-cert-provisioner:
     image: tigera/key-cert-provisioner
-    version: v3.19.2
+    version: v3.19.3
diff --git a/pkg/components/enterprise.go b/pkg/components/enterprise.go
index a082098a00..4fa6d56d53 100644
--- a/pkg/components/enterprise.go
+++ b/pkg/components/enterprise.go
@@ -18,52 +18,52 @@
 package components
 
 var (
-	EnterpriseRelease string = "v3.19.2"
+	EnterpriseRelease string = "v3.19.3"
 
 	ComponentAPIServer = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cnx-apiserver",
 		Registry: "",
 	}
 
 	ComponentComplianceBenchmarker = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/compliance-benchmarker",
 		Registry: "",
 	}
 
 	ComponentComplianceController = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/compliance-controller",
 		Registry: "",
 	}
 
 	ComponentComplianceReporter = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/compliance-reporter",
 		Registry: "",
 	}
 
 	ComponentComplianceServer = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/compliance-server",
 		Registry: "",
 	}
 
 	ComponentComplianceSnapshotter = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/compliance-snapshotter",
 		Registry: "",
 	}
 
 	ComponentTigeraCSRInitContainer = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/key-cert-provisioner",
 		Registry: "",
 	}
 
 	ComponentDeepPacketInspection = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/deep-packet-inspection",
 		Registry: "",
 	}
@@ -79,19 +79,19 @@ var (
 	}
 
 	ComponentElasticTseeInstaller = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/intrusion-detection-job-installer",
 		Registry: "",
 	}
 
 	ComponentElasticsearch = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/elasticsearch",
 		Registry: "",
 	}
 
 	ComponentElasticsearchFIPS = component{
-		Version:  "v3.19.2-fips",
+		Version:  "v3.19.3-fips",
 		Image:    "tigera/elasticsearch",
 		Registry: "",
 	}
@@ -102,115 +102,115 @@ var (
 	}
 
 	ComponentElasticsearchOperator = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/eck-operator",
 		Registry: "",
 	}
 
 	ComponentEsProxy = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/es-proxy",
 		Registry: "",
 	}
 
 	ComponentESGateway = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/es-gateway",
 		Registry: "",
 	}
 
 	ComponentLinseed = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/linseed",
 		Registry: "",
 	}
 
 	ComponentFluentd = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/fluentd",
 		Registry: "",
 	}
 
 	ComponentFluentdWindows = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/fluentd-windows",
 		Registry: "",
 	}
 
 	ComponentGuardian = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/guardian",
 		Registry: "",
 	}
 
 	ComponentIntrusionDetectionController = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/intrusion-detection-controller",
 		Registry: "",
 	}
 
 	ComponentSecurityEventWebhooksProcessor = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/webhooks-processor",
 		Registry: "",
 	}
 
 	ComponentKibana = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/kibana",
 		Registry: "",
 	}
 
 	ComponentManager = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cnx-manager",
 		Registry: "",
 	}
 
 	ComponentDex = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/dex",
 		Registry: "",
 	}
 
 	ComponentManagerProxy = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/voltron",
 		Registry: "",
 	}
 
 	ComponentPacketCapture = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/packetcapture",
 		Registry: "",
 	}
 
 	ComponentPolicyRecommendation = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/policy-recommendation",
 		Registry: "",
 	}
 
 	ComponentEgressGateway = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/egress-gateway",
 		Registry: "",
 	}
 
 	ComponentL7Collector = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/l7-collector",
 		Registry: "",
 	}
 
 	ComponentEnvoyProxy = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/envoy",
 		Registry: "",
 	}
 
 	ComponentDikastes = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/dikastes",
 		Registry: "",
 	}
@@ -221,13 +221,13 @@ var (
 	}
 
 	ComponentPrometheus = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/prometheus",
 		Registry: "",
 	}
 
 	ComponentTigeraPrometheusService = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/prometheus-service",
 		Registry: "",
 	}
@@ -238,79 +238,79 @@ var (
 	}
 
 	ComponentPrometheusAlertmanager = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/alertmanager",
 		Registry: "",
 	}
 
 	ComponentQueryServer = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cnx-queryserver",
 		Registry: "",
 	}
 
 	ComponentTigeraKubeControllers = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/kube-controllers",
 		Registry: "",
 	}
 
 	ComponentTigeraNode = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cnx-node",
 		Registry: "",
 	}
 
 	ComponentTigeraNodeWindows = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cnx-node-windows",
 		Registry: "",
 	}
 
 	ComponentTigeraTypha = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/typha",
 		Registry: "",
 	}
 
 	ComponentTigeraCNI = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cni",
 		Registry: "",
 	}
 
 	ComponentTigeraCNIFIPS = component{
-		Version:  "v3.19.2-fips",
+		Version:  "v3.19.3-fips",
 		Image:    "tigera/cni",
 		Registry: "",
 	}
 
 	ComponentTigeraCNIWindows = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/cni-windows",
 		Registry: "",
 	}
 
 	ComponentElasticsearchMetrics = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/elasticsearch-metrics",
 		Registry: "",
 	}
 
 	ComponentTigeraFlexVolume = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/pod2daemon-flexvol",
 		Registry: "",
 	}
 
 	ComponentTigeraCSI = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/csi",
 		Registry: "",
 	}
 
 	ComponentTigeraCSINodeDriverRegistrar = component{
-		Version:  "v3.19.2",
+		Version:  "v3.19.3",
 		Image:    "tigera/node-driver-registrar",
 		Registry: "",
 	}
diff --git a/pkg/crds/enterprise/crd.projectcalico.org_felixconfigurations.yaml b/pkg/crds/enterprise/crd.projectcalico.org_felixconfigurations.yaml
index f7317d19e3..c7b708181d 100644
--- a/pkg/crds/enterprise/crd.projectcalico.org_felixconfigurations.yaml
+++ b/pkg/crds/enterprise/crd.projectcalico.org_felixconfigurations.yaml
@@ -860,6 +860,15 @@ spec:
                   disabled by setting the interval to 0.
                 pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$
                 type: string
+              ipForwarding:
+                description: 'IPForwarding controls whether Felix sets the host sysctls
+                  to enable IP forwarding.  IP forwarding is required when using Calico
+                  for workload networking.  This should only be disabled on hosts
+                  where Calico is used for host protection.  [Default: Enabled]'
+                enum:
+                - Enabled
+                - Disabled
+                type: string
               ipipEnabled:
                 description: 'IPIPEnabled overrides whether Felix should configure
                   an IPIP interface on the host. Optional as Felix determines this