diff --git a/build/debian-hyperkube-base/Dockerfile b/build/debian-hyperkube-base/Dockerfile
index 8bfbef14463..ab342528272 100644
--- a/build/debian-hyperkube-base/Dockerfile
+++ b/build/debian-hyperkube-base/Dockerfile
@@ -34,6 +34,7 @@ RUN echo CACHEBUST>/dev/null && clean-install \
     git \
     glusterfs-client \
     iptables \
+    ipset \
     jq \
     kmod \
     openssh-client \
diff --git a/build/debian-hyperkube-base/Makefile b/build/debian-hyperkube-base/Makefile
index ff798c1d070..3309a50d118 100644
--- a/build/debian-hyperkube-base/Makefile
+++ b/build/debian-hyperkube-base/Makefile
@@ -19,7 +19,7 @@
 
 REGISTRY?=staging-k8s.gcr.io
 IMAGE?=debian-hyperkube-base
-TAG=0.8
+TAG=0.9
 ARCH?=amd64
 CACHEBUST?=1
 
diff --git a/build/root/WORKSPACE b/build/root/WORKSPACE
index c876b3454d6..613c36ad964 100644
--- a/build/root/WORKSPACE
+++ b/build/root/WORKSPACE
@@ -67,10 +67,10 @@ docker_pull(
 
 docker_pull(
     name = "debian-hyperkube-base-amd64",
-    digest = "sha256:fc1b461367730660ac5a40c1eb2d1b23221829acf8a892981c12361383b3742b",
+    digest = "sha256:d83594ecd85345144584523e7fa5388467edf5d2dfa30d0a1bcbf184cddf4a7b",
     registry = "k8s.gcr.io",
     repository = "debian-hyperkube-base-amd64",
-    tag = "0.8",  # ignored, but kept here for documentation
+    tag = "0.9",  # ignored, but kept here for documentation
 )
 
 docker_pull(