diff --git a/CHANGES.md b/CHANGES.md
index d8b7c43c..6c09f70c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -5,6 +5,11 @@ Notable changes between versions.
 ## Latest
 
 * Kubernetes v1.8.5
+* Recommend Docker 17.09 and validate against it
+  * Container Linux stable, beta, and alpha now provide Docker 17.09 (instead
+  of 1.12). Recommend images which provide 17.09.
+  * Older clusters (with CLUO addon) auto-update node's Container Linux version
+  and will begin using Docker 17.09.
 
 ## v1.8.4
 
diff --git a/docs/bare-metal.md b/docs/bare-metal.md
index a7c5f815..ac3621c6 100644
--- a/docs/bare-metal.md
+++ b/docs/bare-metal.md
@@ -162,7 +162,7 @@ module "bare-metal-mercury" {
   # install
   matchbox_http_endpoint  = "http://matchbox.example.com"
   container_linux_channel = "stable"
-  container_linux_version = "1520.6.0"
+  container_linux_version = "1576.4.0"
   ssh_authorized_key      = "ssh-rsa AAAAB3Nz..."
 
   # cluster
@@ -332,7 +332,7 @@ Learn about [version pinning](concepts.md#versioning), maintenance, and [addons]
 |:-----|:------------|:--------|
 | matchbox_http_endpoint | Matchbox HTTP read-only endpoint | http://matchbox.example.com:8080 |
 | container_linux_channel | Container Linux channel | stable, beta, alpha |
-| container_linux_version | Container Linux version of the kernel/initrd to PXE and the image to install | 1465.6.0 |
+| container_linux_version | Container Linux version of the kernel/initrd to PXE and the image to install | 1576.4.0 |
 | cluster_name | Cluster name | mercury |
 | k8s_domain_name | FQDN resolving to the controller(s) nodes. Workers and kubectl will communicate with this endpoint | "myk8s.example.com" |
 | ssh_authorized_key | SSH public key for ~/.ssh/authorized_keys | "ssh-rsa AAAAB3Nz..." |
diff --git a/docs/google-cloud.md b/docs/google-cloud.md
index 5cc0757c..9eb31fac 100644
--- a/docs/google-cloud.md
+++ b/docs/google-cloud.md
@@ -80,7 +80,7 @@ module "google-cloud-yavin" {
   region        = "us-central1"
   dns_zone      = "example.com"
   dns_zone_name = "example-zone"
-  os_image      = "coreos-stable-1520-6-0-v20171012"
+  os_image      = "coreos-stable-1576-4-0-v20171206"
 
   cluster_name       = "yavin"
   controller_count   = 1
@@ -197,7 +197,7 @@ Learn about [version pinning](concepts.md#versioning), maintenance, and [addons]
 | dns_zone | Google Cloud DNS zone | "google-cloud.example.com" |
 | dns_zone_name | Google Cloud DNS zone name | "example-zone" |
 | ssh_authorized_key | SSH public key for ~/.ssh_authorized_keys | "ssh-rsa AAAAB3NZ..." |
-| os_image | OS image for compute instances | "coreos-stable-1465-6-0-v20170817" |
+| os_image | OS image for compute instances | "coreos-stable-1576-4-0-v20171206" |
 | asset_dir | Path to a directory where generated assets should be placed (contains secrets) | "/home/user/.secrets/clusters/yavin" |
 
 Check the list of valid [regions](https://cloud.google.com/compute/docs/regions-zones/regions-zones) and list Container Linux [images](https://cloud.google.com/compute/docs/images) with `gcloud compute images list | grep coreos`.