diff --git a/build/common.sh b/build/common.sh
index 86220d8b40f6..c6fa01b214f3 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -88,7 +88,7 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
 # These are the default versions (image tags) for their respective base images.
 readonly __default_debian_iptables_version=buster-v1.6.5
 readonly __default_go_runner_version=v2.3.1-go1.16.6-buster.0
-readonly __default_setcap_version=buster-v2.0.1
+readonly __default_setcap_version=buster-v2.0.3
 
 # These are the base images for the Docker-wrapped binaries.
 readonly KUBE_GORUNNER_IMAGE="${KUBE_GORUNNER_IMAGE:-$KUBE_BASE_IMAGE_REGISTRY/go-runner:$__default_go_runner_version}"
diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index 499e044ea0d7..63d321fc4beb 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -218,7 +218,7 @@ dependencies:
       match: configs\[Pause\] = Config{gcRegistry, "pause", "\d+\.\d+.\d+"}
 
   - name: "k8s.gcr.io/setcap: dependents"
-    version: buster-v2.0.1
+    version: buster-v2.0.3
     refPaths:
     - path: build/common.sh
       match: __default_setcap_version=