diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh
index 75674bd297..b5d2108cc3 100755
--- a/.github/scripts/setup-talosctl.sh
+++ b/.github/scripts/setup-talosctl.sh
@@ -20,10 +20,10 @@ set -euo pipefail
 # inspects a single node, which reads as a fleet-wide fault rather than a stale
 # pin.
 # renovate: datasource=github-releases depName=siderolabs/talos extractVersion=^v(?<version>.+)$
-TALOS_VERSION="1.13.8"
+TALOS_VERSION="1.13.9"
 # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that
 # release's sha256sum.txt. UPDATE BOTH TOGETHER.
-TALOSCTL_SHA256="406b56f9e4ff03b1557cc941b1f163aec8a6ebb36e28f0bbbe6d083589529261"
+TALOSCTL_SHA256="7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e"
 
 asset_name="talosctl-linux-amd64"
 release_base="https://github.com/siderolabs/talos/releases/download/v${TALOS_VERSION}"
diff --git a/ksail.prod.yaml b/ksail.prod.yaml
index 1ec148211b..aa090565c6 100644
--- a/ksail.prod.yaml
+++ b/ksail.prod.yaml
@@ -157,10 +157,34 @@ spec:
     talos:
       # Pin Talos to match the ISO so 'ksail cluster update' doesn't attempt
       # an unwanted in-place upgrade to ksail's default version.
-      version: v1.13.8
+      version: v1.13.9
       # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated
       # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127).
       iso: 125127
+      # Per-node pod-eviction budget for the rolling drain during 'ksail
+      # cluster update'; KSail defaults to 10m. The static workers are the
+      # cluster's only Longhorn storage nodes, and Longhorn pins a
+      # per-instance-manager PodDisruptionBudget at zero allowed disruptions
+      # while that instance-manager still runs engines for attached volumes.
+      # Draining a worker therefore has to evict its workloads, let those
+      # volumes detach, and wait for Longhorn to release the PDB before the
+      # instance-manager itself can go — a sequence that exceeds 10m on a
+      # worker carrying several attached volumes, and an over-budget drain
+      # aborts the whole update.
+      #
+      # 30m is ~3x the 10m default. That default was reached on a worker
+      # carrying several attached volumes, so this leaves room for the
+      # evict/detach/PDB-release sequence above without being unbounded.
+      #
+      # This is an independent per-node drain limit. It is NOT bounded by
+      # connection.timeout, which governs the `workload reconcile` wait on the
+      # Flux Kustomization chain and is not consumed as this update's outer
+      # deadline.
+      #
+      # --force-drain is NOT the alternative here: it deletes pods bypassing
+      # PodDisruptionBudgets, which on Longhorn risks removing the
+      # instance-manager still serving a volume's last healthy replica.
+      drainTimeout: 30m
       # Talos Image Factory extensions baked into the node image. KSail
       # computes the schematic ID from this list and uses it both for
       # machine.install.image (derived during config generation — there is no