diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
index c8ec413969..58fd3fa856 100644
--- a/cluster/config-defaults.yaml
+++ b/cluster/config-defaults.yaml
@@ -121,7 +121,7 @@ skipper_default_filters: 'disableAccessLog(2,3,404,429) -> fifo(2000,20,"1s")'
 # skipper_default_filters_authentication defines filters that implement default request authentication
 skipper_default_filters_authentication: ''
 skipper_default_filters_append: 'stateBagToTag("auth-user", "client.uid")'
-skipper_disabled_filters: "static,bearerinjector,setRequestHeaderFromSecret"
+skipper_disabled_filters: "static,bearerinjector,setRequestHeaderFromSecret,basicAuth"
 skipper_lua_sources: "file"
 skipper_edit_route_placeholders: ""
 skipper_ingress_inline_routes: ""
@@ -1171,7 +1171,7 @@ sysctl_settings: ""
 # must ensure that no existing resources should be annotated with a TTL.
 # This can happen in the case where a test deployment is deployed to production
 # as is. Currently, it's a no-op since kube-janitor doesn't run in production.
-# 
+#
 # This is needed until we can implement namespace prefix matching to reduce
 # the scope of kube-janitor to a set of namespace names that aren't known
 # at the time of enaling kube-janitor. Once the feature is in place, it would
diff --git a/cluster/manifests/kube-node-ready-controller/daemonset.yaml b/cluster/manifests/kube-node-ready-controller/daemonset.yaml
index d335c645a5..aee4d25447 100644
--- a/cluster/manifests/kube-node-ready-controller/daemonset.yaml
+++ b/cluster/manifests/kube-node-ready-controller/daemonset.yaml
@@ -36,7 +36,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: controller
-        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-29
+        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-30
         resources:
           requests:
             cpu: {{.Cluster.ConfigItems.kube_node_ready_controller_cpu}}
diff --git a/cluster/manifests/kubenurse/daemonset.yaml b/cluster/manifests/kubenurse/daemonset.yaml
index 49d863a36b..cd9e673a2e 100644
--- a/cluster/manifests/kubenurse/daemonset.yaml
+++ b/cluster/manifests/kubenurse/daemonset.yaml
@@ -7,6 +7,8 @@ metadata:
   labels:
     application: kubernetes
     component: kubenurse
+  annotations:
+    node-ready.cluster.zalando.org/exclude: "true"
   name: kubenurse
   namespace: kubenurse
 spec:
diff --git a/cluster/manifests/skipper/deployment.yaml b/cluster/manifests/skipper/deployment.yaml
index dbefb69c38..38889bd22b 100644
--- a/cluster/manifests/skipper/deployment.yaml
+++ b/cluster/manifests/skipper/deployment.yaml
@@ -1,7 +1,7 @@
 {{/* image-updater-bot detects *image variables so use print to disable it for main image */}}
 
 {{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.21.220-1043" }}
-{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.220-1043" }}
+{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.224-1047" }}
 
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}