diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index 5df9c08b62ae..bcc1d41c646e 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -339,6 +339,12 @@ spec:
                               description: The maximum number of parallel retries a single Envoy instance allows to the Kubernetes Service; defaults to 3.
                               format: int32
                               type: integer
+                            perHostMaxConnections:
+                              description: |-
+                                PerHostMaxConnections is the maximum number of connections
+                                that Envoy will allow to each individual host in a cluster.
+                              format: int32
+                              type: integer
                           type: object
                         dnsLookupFamily:
                           description: |-
@@ -1334,6 +1340,8 @@ spec:
                         Defines the XDSServer to use for `contour serve`.
                         Values: `envoy` (default), `contour (deprecated)`.
                         Other values will produce an error.
+                        Deprecated: this field will be removed in a future release when
+                        the `contour` xDS server implementation is removed.
                       type: string
                   type: object
               type: object
@@ -3960,6 +3968,12 @@ spec:
                                   description: The maximum number of parallel retries a single Envoy instance allows to the Kubernetes Service; defaults to 3.
                                   format: int32
                                   type: integer
+                                perHostMaxConnections:
+                                  description: |-
+                                    PerHostMaxConnections is the maximum number of connections
+                                    that Envoy will allow to each individual host in a cluster.
+                                  format: int32
+                                  type: integer
                               type: object
                             dnsLookupFamily:
                               description: |-
@@ -4955,6 +4969,8 @@ spec:
                             Defines the XDSServer to use for `contour serve`.
                             Values: `envoy` (default), `contour (deprecated)`.
                             Other values will produce an error.
+                            Deprecated: this field will be removed in a future release when
+                            the `contour` xDS server implementation is removed.
                           type: string
                       type: object
                   type: object
@@ -5083,6 +5099,34 @@ spec:
             spec:
               description: ExtensionServiceSpec defines the desired state of an ExtensionService resource.
               properties:
+                circuitBreakerPolicy:
+                  description: |-
+                    CircuitBreakerPolicy specifies the circuit breaker budget across the extension service.
+                    If defined this overrides the global circuit breaker budget.
+                  properties:
+                    maxConnections:
+                      description: The maximum number of connections that a single Envoy instance allows to the Kubernetes Service; defaults to 1024.
+                      format: int32
+                      type: integer
+                    maxPendingRequests:
+                      description: The maximum number of pending requests that a single Envoy instance allows to the Kubernetes Service; defaults to 1024.
+                      format: int32
+                      type: integer
+                    maxRequests:
+                      description: The maximum parallel requests a single Envoy instance allows to the Kubernetes Service; defaults to 1024
+                      format: int32
+                      type: integer
+                    maxRetries:
+                      description: The maximum number of parallel retries a single Envoy instance allows to the Kubernetes Service; defaults to 3.
+                      format: int32
+                      type: integer
+                    perHostMaxConnections:
+                      description: |-
+                        PerHostMaxConnections is the maximum number of connections
+                        that Envoy will allow to each individual host in a cluster.
+                      format: int32
+                      type: integer
+                  type: object
                 loadBalancerPolicy:
                   description: |-
                     The policy for load balancing GRPC service requests. Note that the
@@ -8562,7 +8606,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-29-1
+  name: contour-certgen-v1-30-1
   namespace: contour-external
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -8574,7 +8618,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -8792,9 +8836,6 @@ spec:
       app: contour
   template:
     metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8000"
       labels:
         app: contour
     spec:
@@ -8820,7 +8861,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -8895,10 +8936,6 @@ spec:
       app: envoy
   template:
     metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8002"
-        prometheus.io/path: /stats/prometheus
       labels:
         app: envoy
     spec:
@@ -8908,7 +8945,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -8936,7 +8973,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.30.2
+          image: docker.io/envoyproxy/envoy:v1.31.3
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -8957,6 +8994,9 @@ spec:
             - containerPort: 8443
               name: https
               protocol: TCP
+            - containerPort: 8002
+              name: metrics
+              protocol: TCP
           readinessProbe:
             httpGet:
               path: /ready
@@ -8998,7 +9038,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -9298,7 +9338,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-29-1
+  name: contour-certgen-v1-30-1
   namespace: contour-internal
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -9310,7 +9350,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -9435,9 +9475,6 @@ spec:
       app: contour
   template:
     metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8000"
       labels:
         app: contour
     spec:
@@ -9463,7 +9500,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -9538,10 +9575,6 @@ spec:
       app: envoy
   template:
     metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8002"
-        prometheus.io/path: /stats/prometheus
       labels:
         app: envoy
     spec:
@@ -9551,7 +9584,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -9579,7 +9612,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.30.2
+          image: docker.io/envoyproxy/envoy:v1.31.3
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -9600,6 +9633,9 @@ spec:
             - containerPort: 8443
               name: https
               protocol: TCP
+            - containerPort: 8002
+              name: metrics
+              protocol: TCP
           readinessProbe:
             httpGet:
               path: /ready
@@ -9641,7 +9677,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.29.1
+          image: ghcr.io/projectcontour/contour:v1.30.1
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 05261b3e8419..abb1254b9e10 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20241230-dfffc8f6"
+    app.kubernetes.io/version: "20250110-2f979439"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20241230-dfffc8f6"
+    app.kubernetes.io/version: "20250110-2f979439"
 data:
   _example: |
     ################################
@@ -111,7 +111,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20241230-dfffc8f6"
+    app.kubernetes.io/version: "20250110-2f979439"
 spec:
   replicas: 1
   selector:
@@ -123,14 +123,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20241230-dfffc8f6"
+        app.kubernetes.io/version: "20250110-2f979439"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:c258bf6c1b6b85909fb63bbc27e1f54de96f0b1f9a6be1fd4b3b034931ec3151
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:f765a9ac213ce748440ce0a623cdd07791e9696f8140289dc410bb43b441c566
           resources:
             requests:
               cpu: 40m
@@ -174,7 +174,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20241230-dfffc8f6"
+    app.kubernetes.io/version: "20250110-2f979439"
 spec:
   delegations:
     - secretName: routing-serving-certs