diff --git a/cli/pkg/upgrade/1_12_2_20251020.go b/cli/pkg/upgrade/1_12_2_20251020.go
index 537718d31..d800e3293 100644
--- a/cli/pkg/upgrade/1_12_2_20251020.go
+++ b/cli/pkg/upgrade/1_12_2_20251020.go
@@ -153,7 +153,7 @@ type upgradeL4 struct {
 
 func (u *upgradeL4) Execute(runtime connector.Runtime) error {
 	if _, err := runtime.GetRunner().SudoCmd(
-		"/usr/local/bin/kubectl set image deployment/l4-bfl-proxy proxy=beclab/l4-bfl-proxy:v0.3.5 -n os-network", false, true); err != nil {
+		"/usr/local/bin/kubectl set image deployment/l4-bfl-proxy proxy=beclab/l4-bfl-proxy:v0.3.6 -n os-network", false, true); err != nil {
 		return errors.Wrap(errors.WithStack(err), "failed to upgrade L4 network proxy")
 	}
 
diff --git a/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml b/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
index 354f0292b..0b6f5ebc1 100644
--- a/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
+++ b/framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml
@@ -304,7 +304,7 @@ spec:
         - name: BACKUP_SERVER
           value: backup-server.os-framework:8082
         - name: L4_PROXY_IMAGE_VERSION
-          value: v0.3.5
+          value: v0.3.6
         - name: L4_PROXY_SERVICE_ACCOUNT
           value: os-network-internal
         - name: L4_PROXY_NAMESPACE
diff --git a/framework/l4-bfl-proxy/.olares/Olares.yaml b/framework/l4-bfl-proxy/.olares/Olares.yaml
index d9c6f6cd2..122b07c0c 100644
--- a/framework/l4-bfl-proxy/.olares/Olares.yaml
+++ b/framework/l4-bfl-proxy/.olares/Olares.yaml
@@ -3,5 +3,5 @@ target: prebuilt
 output:
   containers:
     - 
-      name: beclab/l4-bfl-proxy:v0.3.4
+      name: beclab/l4-bfl-proxy:v0.3.6
 # must have blank new line            
\ No newline at end of file