diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index da738c5b2..010b29dca 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -78,10 +78,10 @@ jobs:
       - name: print git status after build
         run: |
           git status
-      - name: Validate 1.25 + containerd E2E
+      - name: Validate 1.26 + containerd E2E
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.25"
+          ORCHESTRATOR_RELEASE: "1.26"
           CLUSTER_DEFINITION: "examples/e2e-tests/kubernetes/release/default/definition.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
@@ -100,10 +100,10 @@ jobs:
           AZURE_CORE_ONLY_SHOW_ERRORS: true
           DISTRO: "aks-ubuntu-20.04"
         run: make test-kubernetes
-      - name: Validate 1.26 + containerd E2E
+      - name: Validate 1.27 + containerd E2E
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.26"
+          ORCHESTRATOR_RELEASE: "1.27"
           CLUSTER_DEFINITION: "examples/e2e-tests/kubernetes/release/default/definition.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
diff --git a/.github/workflows/test-cluster-config.yaml b/.github/workflows/test-cluster-config.yaml
index 7f3a5e18b..293abae7b 100644
--- a/.github/workflows/test-cluster-config.yaml
+++ b/.github/workflows/test-cluster-config.yaml
@@ -14,9 +14,9 @@ on:
         required: false
         default: ''
       kubernetes_release:
-        description: 'Which Kubernetes release to test (major.minor only, e.g., "1.25")'
+        description: 'Which Kubernetes release to test (major.minor only, e.g., "1.26")'
         required: false
-        default: '1.25'
+        default: '1.26'
       container_runtime:
         description: 'Which CRI to use (e.g., "containerd" or "docker")'
         required: false
diff --git a/.github/workflows/test-upgrade.yaml b/.github/workflows/test-upgrade.yaml
index f55ac4424..f5b41adfd 100644
--- a/.github/workflows/test-upgrade.yaml
+++ b/.github/workflows/test-upgrade.yaml
@@ -56,10 +56,10 @@ jobs:
           sudo chmod +x /usr/local/bin/k
       - name: Build aks-engine-azurestack binary
         run: make build-binary
-      - name: Validate 1.25 scenario, deploy and test suite after deploy
+      - name: Validate 1.26 scenario, deploy and test suite after deploy
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.25"
+          ORCHESTRATOR_RELEASE: "1.26"
           CLUSTER_DEFINITION: "examples/e2e-tests/kubernetes/release/default/definition-no-vnet.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
@@ -85,7 +85,7 @@ jobs:
           LINUX_NODE_IMAGE_NAME: ${{vars.LINUX_NODE_IMAGE_NAME}}
           LINUX_NODE_IMAGE_VERSION: ${{inputs.LINUX_NODE_IMAGE_VERSION}}
         run: make test-kubernetes
-      - name: Validate 1.25 scenario, upgrade
+      - name: Validate 1.26 scenario, upgrade
         run : |
           RESOURCE_GROUP=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2); \
           REGION=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2 | cut -d- -f2); \
@@ -100,17 +100,17 @@ jobs:
           --vm-timeout 20 \
           --client-id ${{ secrets.TEST_AZURE_SP_ID }} \
           --client-secret ${{ secrets.TEST_AZURE_SP_PW }}
-      - name: Validate 1.25 scenario, remove known hosts
+      - name: Validate 1.26 scenario, remove known hosts
         run : |
           RESOURCE_GROUP=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2); \
           REGION=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2 | cut -d- -f2); \
           CURRENT_VERSION=$(jq -r .properties.orchestratorProfile.orchestratorVersion _output/${RESOURCE_GROUP}/apimodel.json); \
           TARGET_VERSION=$(bin/aks-engine-azurestack get-versions | grep -E "^${CURRENT_VERSION}" | xargs | cut -d" " -f2); \
           ssh-keygen -f ~/.ssh/known_hosts -R ${RESOURCE_GROUP}.${REGION}.cloudapp.azure.com
-      - name: Validate 1.25 scenario, test suite after upgrade
+      - name: Validate 1.26 scenario, test suite after upgrade
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.25"
+          ORCHESTRATOR_RELEASE: "1.26"
           CLUSTER_DEFINITION: "examples/e2e-tests/kubernetes/release/default/definition-no-vnet.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
@@ -128,10 +128,10 @@ jobs:
         run : |
           export NAME=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2);\
           make test-kubernetes
-      - name: Validate 1.26 scenario, deploy and test suite after deploy
+      - name: Validate 1.27 scenario, deploy and test suite after deploy
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.26"
+          ORCHESTRATOR_RELEASE: "1.27"
           CLUSTER_DEFINITION: "examples/e2e-tests/kubernetes/release/default/definition-no-vnet.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
diff --git a/.github/workflows/test-vhd-no-egress.yaml b/.github/workflows/test-vhd-no-egress.yaml
index 855a53437..3ef594a5c 100644
--- a/.github/workflows/test-vhd-no-egress.yaml
+++ b/.github/workflows/test-vhd-no-egress.yaml
@@ -56,10 +56,10 @@ jobs:
           sudo chmod +x /usr/local/bin/k
       - name: Build aks-engine-azurestack binary
         run: make build-binary
-      - name: Validate 1.25 no-egress scenario, deploy and test suite after deploy
+      - name: Validate 1.26 no-egress scenario, deploy and test suite after deploy
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.25"
+          ORCHESTRATOR_RELEASE: "1.26"
           CLUSTER_DEFINITION: "examples/no_outbound.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
@@ -86,7 +86,7 @@ jobs:
           LINUX_NODE_IMAGE_NAME: ${{vars.LINUX_NODE_IMAGE_NAME}}
           LINUX_NODE_IMAGE_VERSION: ${{inputs.LINUX_NODE_IMAGE_VERSION}}
         run: make test-kubernetes
-      - name: Validate 1.25 no-egress scenario, upgrade
+      - name: Validate 1.26 no-egress scenario, upgrade
         run : |
           RESOURCE_GROUP=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2); \
           REGION=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2 | cut -d- -f2); \
@@ -101,17 +101,17 @@ jobs:
           --vm-timeout 20 \
           --client-id ${{ secrets.TEST_AZURE_SP_ID }} \
           --client-secret ${{ secrets.TEST_AZURE_SP_PW }}
-      - name: Validate 1.25 no-egress scenario, remove known hosts
+      - name: Validate 1.26 no-egress scenario, remove known hosts
         run : |
           RESOURCE_GROUP=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2); \
           REGION=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2 | cut -d- -f2); \
           CURRENT_VERSION=$(jq -r .properties.orchestratorProfile.orchestratorVersion _output/${RESOURCE_GROUP}/apimodel.json); \
           TARGET_VERSION=$(bin/aks-engine-azurestack get-versions | grep -E "^${CURRENT_VERSION}" | xargs | cut -d" " -f2); \
           ssh-keygen -f ~/.ssh/known_hosts -R ${RESOURCE_GROUP}.${REGION}.cloudapp.azure.com
-      - name: Validate 1.25 no-egress scenario, test suite after upgrade
+      - name: Validate 1.26 no-egress scenario, test suite after upgrade
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.25"
+          ORCHESTRATOR_RELEASE: "1.26"
           CLUSTER_DEFINITION: "examples/no_outbound.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
@@ -130,10 +130,10 @@ jobs:
         run : |
           export NAME=$(ls -dt1 _output/* | head -n 1 | cut -d/ -f2);\
           make test-kubernetes
-      - name: Validate 1.26 no-egress scenario, deploy and test suite after deploy
+      - name: Validate 1.27 no-egress scenario, deploy and test suite after deploy
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          ORCHESTRATOR_RELEASE: "1.26"
+          ORCHESTRATOR_RELEASE: "1.27"
           CLUSTER_DEFINITION: "examples/no_outbound.json"
           SUBSCRIPTION_ID: ${{ secrets.TEST_AZURE_SUB_ID }}
           CLIENT_ID: ${{ secrets.TEST_AZURE_SP_ID }}
diff --git a/.pipelines/pr-e2e.yaml b/.pipelines/pr-e2e.yaml
index 009559ba1..fd45faa1e 100644
--- a/.pipelines/pr-e2e.yaml
+++ b/.pipelines/pr-e2e.yaml
@@ -58,8 +58,8 @@ jobs:
 
   - template: e2e-job-template.yaml
     parameters:
-      name: "k8s_1_25_containerd_e2e"
-      k8sRelease: "1.25"
+      name: "k8s_1_26_containerd_e2e"
+      k8sRelease: "1.26"
       apimodel: "examples/e2e-tests/kubernetes/release/default/definition-no-vnet.json"
       createVNET: false
       enableKMSEncryption: false
@@ -78,8 +78,8 @@ jobs:
 
   - template: e2e-job-template.yaml
     parameters:
-      name: "k8s_1_26_containerd_e2e"
-      k8sRelease: "1.26"
+      name: "k8s_1_27_containerd_e2e"
+      k8sRelease: "1.27"
       apimodel: "examples/e2e-tests/kubernetes/release/default/definition-no-vnet.json"
       createVNET: false
       enableKMSEncryption: false
@@ -98,8 +98,8 @@ jobs:
 
   - template: e2e-job-template.yaml
     parameters:
-      name: "k8s_1_26_stig_e2e"
-      k8sRelease: "1.26"
+      name: "k8s_1_27_stig_e2e"
+      k8sRelease: "1.27"
       apimodel: "examples/e2e-tests/kubernetes/release/default/definition-stig.json"
       createVNET: false
       enableKMSEncryption: false
diff --git a/cmd/generate_test.go b/cmd/generate_test.go
index 5914a95b3..d89ac6457 100644
--- a/cmd/generate_test.go
+++ b/cmd/generate_test.go
@@ -558,13 +558,13 @@ func TestExampleAPIModels(t *testing.T) {
 			setArgs:      defaultSet,
 		},
 		{
-			name:         "1.25 example",
-			apiModelPath: "../examples/kubernetes-releases/kubernetes1.25.json",
+			name:         "1.26 example",
+			apiModelPath: "../examples/kubernetes-releases/kubernetes1.26.json",
 			setArgs:      defaultSet,
 		},
 		{
-			name:         "1.26 example",
-			apiModelPath: "../examples/kubernetes-releases/kubernetes1.26.json",
+			name:         "1.27 example",
+			apiModelPath: "../examples/kubernetes-releases/kubernetes1.27.json",
 			setArgs:      defaultSet,
 		},
 		{
diff --git a/examples/kubernetes-releases/kubernetes1.27.json b/examples/kubernetes-releases/kubernetes1.27.json
new file mode 100644
index 000000000..66d534d70
--- /dev/null
+++ b/examples/kubernetes-releases/kubernetes1.27.json
@@ -0,0 +1,30 @@
+{
+    "apiVersion": "vlabs",
+    "properties": {
+      "orchestratorProfile": {
+        "orchestratorRelease": "1.27"
+      },
+      "masterProfile": {
+        "count": 1,
+        "dnsPrefix": "",
+        "vmSize": "Standard_D2_v3"
+      },
+      "agentPoolProfiles": [
+        {
+          "name": "agentpool1",
+          "count": 3,
+          "vmSize": "Standard_D2_v3"
+        }
+      ],
+      "linuxProfile": {
+        "adminUsername": "azureuser",
+        "ssh": {
+          "publicKeys": [
+            {
+              "keyData": ""
+            }
+          ]
+        }
+      }
+    }
+  }
\ No newline at end of file
diff --git a/pkg/api/common/const.go b/pkg/api/common/const.go
index ba776bbde..cac89361d 100644
--- a/pkg/api/common/const.go
+++ b/pkg/api/common/const.go
@@ -57,13 +57,13 @@ const (
 
 const (
 	// KubernetesDefaultRelease is the default Kubernetes release
-	KubernetesDefaultRelease string = "1.25"
+	KubernetesDefaultRelease string = "1.26"
 	// KubernetesDefaultReleaseWindows is the default Kubernetes release for Windows
-	KubernetesDefaultReleaseWindows string = "1.25"
+	KubernetesDefaultReleaseWindows string = "1.26"
 	// KubernetesDefaultReleaseAzureStack is the default Kubernetes release on Azure Stack
-	KubernetesDefaultReleaseAzureStack string = "1.25"
+	KubernetesDefaultReleaseAzureStack string = "1.26"
 	// KubernetesDefaultReleaseWindowsAzureStack is the default Kubernetes release for Windows on Azure Stack
-	KubernetesDefaultReleaseWindowsAzureStack string = "1.25"
+	KubernetesDefaultReleaseWindowsAzureStack string = "1.26"
 	// PodSecurityPolicyRemovedVersion is the first Kubernetes version that does not includes the PSP admission plugin
 	PodSecurityPolicyRemovedVersion = "1.25.0"
 )
diff --git a/pkg/api/common/versions.go b/pkg/api/common/versions.go
index 1f0511084..ae4efe570 100644
--- a/pkg/api/common/versions.go
+++ b/pkg/api/common/versions.go
@@ -355,10 +355,11 @@ var AllKubernetesSupportedVersions = map[string]bool{
 	"1.24.9":         false,
 	"1.24.11":        false,
 	"1.25.7":         false,
-	"1.25.13":        true,
+	"1.25.13":        false,
 	"1.26.6":         false,
 	"1.26.8":         false,
 	"1.26.9":         true,
+	"1.27.6":         true,
 }
 
 // AllKubernetesSupportedVersionsAzureStack is a hash table of all supported Kubernetes version strings on Azure Stack
@@ -404,10 +405,11 @@ var AllKubernetesSupportedVersionsAzureStack = map[string]bool{
 	"1.24.9":  false,
 	"1.24.11": false,
 	"1.25.7":  false,
-	"1.25.13": true,
+	"1.25.13": false,
 	"1.26.6":  false,
 	"1.26.8":  false,
 	"1.26.9":  true,
+	"1.27.6":  true,
 }
 
 // AllKubernetesWindowsSupportedVersionsAzureStack maintain a set of available k8s Windows versions in aks-engine on Azure Stack
@@ -448,10 +450,11 @@ var AllKubernetesWindowsSupportedVersionsAzureStack = map[string]bool{
 	"1.24.9":  false,
 	"1.24.11": false,
 	"1.25.7":  false,
-	"1.25.13": true,
+	"1.25.13": false,
 	"1.26.6":  false,
 	"1.26.8":  false,
 	"1.26.9":  true,
+	"1.27.6":  true,
 }
 
 // GetDefaultKubernetesVersion returns the default Kubernetes version, that is the latest patch of the default release
diff --git a/pkg/api/k8s_versions.go b/pkg/api/k8s_versions.go
index 7c745ee3a..7d4d0b8b2 100644
--- a/pkg/api/k8s_versions.go
+++ b/pkg/api/k8s_versions.go
@@ -785,6 +785,89 @@ func getK8sVersionComponents(version, kubernetesImageBaseType string, overrides
 	var ret map[string]string
 	k8sComponent := kubernetesImageBaseVersionedImages[kubernetesImageBaseType][majorMinor]
 	switch majorMinor {
+	case "1.27":
+		ret = map[string]string{
+			common.APIServerComponentName:                     getDefaultImage(common.APIServerComponentName, kubernetesImageBaseType) + ":v" + version,
+			common.ControllerManagerComponentName:             getDefaultImage(common.ControllerManagerComponentName, kubernetesImageBaseType) + ":v" + version,
+			common.KubeProxyAddonName:                         getDefaultImage(common.KubeProxyAddonName, kubernetesImageBaseType) + ":v" + version,
+			common.SchedulerComponentName:                     getDefaultImage(common.SchedulerComponentName, kubernetesImageBaseType) + ":v" + version,
+			common.CloudControllerManagerComponentName:        "oss/kubernetes/azure-cloud-controller-manager:v1.27.9",
+			common.CloudNodeManagerAddonName:                  "oss/kubernetes/azure-cloud-node-manager:v1.27.4",
+			common.WindowsArtifactComponentName:               "v" + version + "/windowszip/v" + version + "-1int.zip",
+			common.WindowsArtifactAzureStackComponentName:     "v" + version + "/windowszip/v" + version + "-1int.zip",
+			common.DashboardAddonName:                         dashboardImageReference,
+			common.DashboardMetricsScraperContainerName:       dashboardMetricsScraperImageReference,
+			common.ExecHealthZComponentName:                   getDefaultImage(common.ExecHealthZComponentName, kubernetesImageBaseType),
+			common.AddonResizerComponentName:                  k8sComponent[common.AddonResizerComponentName],
+			common.MetricsServerAddonName:                     k8sComponent[common.MetricsServerAddonName],
+			common.CoreDNSAddonName:                           getDefaultImage(common.CoreDNSAddonName, kubernetesImageBaseType),
+			common.CoreDNSAutoscalerName:                      clusterProportionalAutoscalerImageReference,
+			common.KubeDNSAddonName:                           getDefaultImage(common.KubeDNSAddonName, kubernetesImageBaseType),
+			common.AddonManagerComponentName:                  k8sComponent[common.AddonManagerComponentName],
+			common.DNSMasqComponentName:                       getDefaultImage(common.DNSMasqComponentName, kubernetesImageBaseType),
+			common.PauseComponentName:                         pauseImageReference,
+			common.TillerAddonName:                            tillerImageReference,
+			common.ReschedulerAddonName:                       getDefaultImage(common.ReschedulerAddonName, kubernetesImageBaseType),
+			common.ACIConnectorAddonName:                      virtualKubeletImageReference,
+			common.ClusterAutoscalerAddonName:                 k8sComponent[common.ClusterAutoscalerAddonName],
+			common.DNSSidecarComponentName:                    getDefaultImage(common.DNSSidecarComponentName, kubernetesImageBaseType),
+			common.BlobfuseFlexVolumeAddonName:                blobfuseFlexVolumeImageReference,
+			common.SMBFlexVolumeAddonName:                     smbFlexVolumeImageReference,
+			common.IPMASQAgentAddonName:                       getDefaultImage(common.IPMASQAgentAddonName, kubernetesImageBaseType),
+			common.AzureNetworkPolicyAddonName:                azureNPMContainerImageReference,
+			common.CalicoTyphaComponentName:                   calicoTyphaImageReference,
+			common.CalicoCNIComponentName:                     calicoCNIImageReference,
+			common.CalicoNodeComponentName:                    calicoNodeImageReference,
+			common.CalicoPod2DaemonComponentName:              calicoPod2DaemonImageReference,
+			common.CalicoClusterAutoscalerComponentName:       calicoClusterProportionalAutoscalerImageReference,
+			common.CiliumAgentContainerName:                   ciliumAgentImageReference,
+			common.CiliumCleanStateContainerName:              ciliumCleanStateImageReference,
+			common.CiliumOperatorContainerName:                ciliumOperatorImageReference,
+			common.CiliumEtcdOperatorContainerName:            ciliumEtcdOperatorImageReference,
+			common.AntreaControllerContainerName:              antreaControllerImageReference,
+			common.AntreaAgentContainerName:                   antreaAgentImageReference,
+			common.AntreaOVSContainerName:                     antreaOVSImageReference,
+			"antrea" + common.AntreaInstallCNIContainerName:   antreaInstallCNIImageReference,
+			common.NMIContainerName:                           aadPodIdentityNMIImageReference,
+			common.MICContainerName:                           aadPodIdentityMICImageReference,
+			common.AzurePolicyAddonName:                       azurePolicyImageReference,
+			common.GatekeeperContainerName:                    gatekeeperImageReference,
+			common.NodeProblemDetectorAddonName:               nodeProblemDetectorImageReference,
+			common.CSIProvisionerContainerName:                k8sComponent[common.CSIProvisionerContainerName],
+			common.CSIAttacherContainerName:                   k8sComponent[common.CSIAttacherContainerName],
+			common.CSILivenessProbeContainerName:              k8sComponent[common.CSILivenessProbeContainerName],
+			common.CSILivenessProbeWindowsContainerName:       k8sComponent[common.CSILivenessProbeWindowsContainerName],
+			common.CSINodeDriverRegistrarContainerName:        k8sComponent[common.CSINodeDriverRegistrarContainerName],
+			common.CSINodeDriverRegistrarWindowsContainerName: k8sComponent[common.CSINodeDriverRegistrarWindowsContainerName],
+			common.CSISnapshotterContainerName:                k8sComponent[common.CSISnapshotterContainerName],
+			common.CSISnapshotControllerContainerName:         k8sComponent[common.CSISnapshotControllerContainerName],
+			common.CSIResizerContainerName:                    k8sComponent[common.CSIResizerContainerName],
+			common.CSIAzureDiskContainerName:                  k8sComponent[common.CSIAzureDiskContainerName],
+			common.CSIAzureFileContainerName:                  csiAzureFileImageReference,
+			common.KubeFlannelContainerName:                   kubeFlannelImageReference,
+			"flannel" + common.FlannelInstallCNIContainerName: flannelInstallCNIImageReference,
+			common.KubeRBACProxyContainerName:                 KubeRBACProxyImageReference,
+			common.ScheduledMaintenanceManagerContainerName:   ScheduledMaintenanceManagerImageReference,
+			"nodestatusfreq":                                  DefaultKubernetesNodeStatusUpdateFrequency,
+			"nodegraceperiod":                                 DefaultKubernetesCtrlMgrNodeMonitorGracePeriod,
+			"podeviction":                                     DefaultKubernetesCtrlMgrPodEvictionTimeout,
+			"routeperiod":                                     DefaultKubernetesCtrlMgrRouteReconciliationPeriod,
+			"backoffretries":                                  strconv.Itoa(DefaultKubernetesCloudProviderBackoffRetries),
+			"backoffjitter":                                   strconv.FormatFloat(DefaultKubernetesCloudProviderBackoffJitter, 'f', -1, 64),
+			"backoffduration":                                 strconv.Itoa(DefaultKubernetesCloudProviderBackoffDuration),
+			"backoffexponent":                                 strconv.FormatFloat(DefaultKubernetesCloudProviderBackoffExponent, 'f', -1, 64),
+			"ratelimitqps":                                    strconv.FormatFloat(DefaultKubernetesCloudProviderRateLimitQPS, 'f', -1, 64),
+			"ratelimitqpswrite":                               strconv.FormatFloat(DefaultKubernetesCloudProviderRateLimitQPSWrite, 'f', -1, 64),
+			"ratelimitbucket":                                 strconv.Itoa(DefaultKubernetesCloudProviderRateLimitBucket),
+			"ratelimitbucketwrite":                            strconv.Itoa(DefaultKubernetesCloudProviderRateLimitBucketWrite),
+			"gchighthreshold":                                 strconv.Itoa(DefaultKubernetesGCHighThreshold),
+			"gclowthreshold":                                  strconv.Itoa(DefaultKubernetesGCLowThreshold),
+			common.NVIDIADevicePluginAddonName:                nvidiaDevicePluginImageReference,
+			common.CSISecretsStoreProviderAzureContainerName:  csiSecretsStoreProviderAzureImageReference,
+			common.CSISecretsStoreDriverContainerName:         csiSecretsStoreDriverImageReference,
+			common.AzureArcOnboardingAddonName:                azureArcOnboardingImageReference,
+			common.AzureKMSProviderComponentName:              azureKMSProviderImageReference,
+		}
 	case "1.26":
 		ret = map[string]string{
 			common.APIServerComponentName:                     getDefaultImage(common.APIServerComponentName, kubernetesImageBaseType) + ":v" + version,
diff --git a/vhd/packer/configure-windows-vhd.ps1 b/vhd/packer/configure-windows-vhd.ps1
index 9bafafcbf..3d386d29c 100644
--- a/vhd/packer/configure-windows-vhd.ps1
+++ b/vhd/packer/configure-windows-vhd.ps1
@@ -50,8 +50,8 @@ function Get-ContainerImages {
                 "mcr.microsoft.com/oss/kubernetes/pause:1.4.1",
                 "mcr.microsoft.com/oss/kubernetes/pause:3.4.1",
                 "mcr.microsoft.com/oss/kubernetes/pause:3.8",
-                "mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.25.9",
                 "mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.26.10",
+                "mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.27.4",
                 "mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.10.0",
                 "mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.10.0-windows-hp",
                 "mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.26.5",
@@ -123,8 +123,8 @@ function Get-FilesToCacheOnVHD {
             "https://kubernetesartifacts.azureedge.net/csi-proxy/v1.1.3/binaries/csi-proxy-v1.1.3.tar.gz"
         );
         "c:\akse-cache\win-k8s\"      = @(
-            "https://kubernetesartifacts.azureedge.net/kubernetes/v1.25.13/windowszip/v1.25.13-1int.zip",
-            "https://kubernetesartifacts.azureedge.net/kubernetes/v1.26.9/windowszip/v1.26.9-1int.zip"
+            "https://kubernetesartifacts.azureedge.net/kubernetes/v1.26.9/windowszip/v1.26.9-1int.zip",
+            "https://kubernetesartifacts.azureedge.net/kubernetes/v1.27.6/windowszip/v1.27.6-1int.zip"
         );
         "c:\akse-cache\win-vnet-cni\" = @(
             "https://kubernetesartifacts.azureedge.net/azure-cni/v1.4.32/binaries/azure-vnet-cni-singletenancy-windows-amd64-v1.4.32.zip"
diff --git a/vhd/packer/install-dependencies.sh b/vhd/packer/install-dependencies.sh
index 5bea892e8..f4705bb19 100644
--- a/vhd/packer/install-dependencies.sh
+++ b/vhd/packer/install-dependencies.sh
@@ -210,8 +210,8 @@ loadContainerImage ${BUSYBOX_IMAGE}
 echo "  - ${BUSYBOX_IMAGE}" >> ${VHD_LOGS_FILEPATH}
 
 K8S_VERSIONS="
+1.27.6
 1.26.9
-1.25.13
 "
 for KUBERNETES_VERSION in ${K8S_VERSIONS}; do
   for component in kube-apiserver kube-controller-manager kube-proxy kube-scheduler; do
@@ -224,16 +224,25 @@ for KUBERNETES_VERSION in ${K8S_VERSIONS}; do
 done
 
 # Starting with 1.16 we pull cloud-controller-manager and cloud-node-manager
-CLOUD_MANAGER_VERSIONS="
+CLOUD_CONTROLLER_MANAGER_VERSIONS="
+1.27.9
 1.26.10
-1.25.9
 "
-for CLOUD_MANAGER_VERSION in ${CLOUD_MANAGER_VERSIONS}; do
-  for COMPONENT in azure-cloud-controller-manager azure-cloud-node-manager; do
-    CONTAINER_IMAGE="mcr.microsoft.com/oss/kubernetes/${COMPONENT}:v${CLOUD_MANAGER_VERSION}"
-    loadContainerImage ${CONTAINER_IMAGE}
-    echo "  - ${CONTAINER_IMAGE}" >> ${VHD_LOGS_FILEPATH}
-  done
+for CLOUD_CONTROLLER_MANAGER_VERSION in ${CLOUD_CONTROLLER_MANAGER_VERSIONS}; do
+  CONTAINER_IMAGE="mcr.microsoft.com/oss/kubernetes/azure-cloud-controller-manager:v${CLOUD_CONTROLLER_MANAGER_VERSION}"
+  loadContainerImage ${CONTAINER_IMAGE}
+  echo "  - ${CONTAINER_IMAGE}" >> ${VHD_LOGS_FILEPATH}
+done
+
+# Starting with 1.16 we pull cloud-controller-manager and cloud-node-manager
+CLOUD_NODE_MANAGER_VERSIONS="
+1.27.4
+1.26.10
+"
+for CLOUD_NODE_MANAGER_VERSION in ${CLOUD_NODE_MANAGER_VERSIONS}; do
+  CONTAINER_IMAGE="mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v${CLOUD_NODE_MANAGER_VERSION}"
+  loadContainerImage ${CONTAINER_IMAGE}
+  echo "  - ${CONTAINER_IMAGE}" >> ${VHD_LOGS_FILEPATH}
 done
 
 AZUREDISK_CSI_VERSIONS="