diff --git a/AGENTS.md b/AGENTS.md
index fc49a75..3f71ce2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,10 +22,10 @@ make kubeconform
 make clean
 
 # Quick build + inspect without persisting output
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 
 # Check all resource kinds produced by an overlay
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
 
 # Run pre-commit checks against all files
 uvx pre-commit run --all-files
@@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`):
 
 ### 5. Validate
 ```bash
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 make kubeconform
 ```
 
@@ -215,7 +215,7 @@ Examples:
 
 Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
 
-Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
+The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform.
 
 ---
 
diff --git a/Makefile b/Makefile
index 100ae8a..4d8f68b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,10 @@
 .PHONY: build clean schemas
 
-KUBE_VERSION := $(shell cat ci/kube-version)
+MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
+KUBE_VERSION := $(strip $(shell cat $(MAKEFILE_DIR)/ci/kube-version 2>/dev/null))
+ifeq ($(KUBE_VERSION),)
+$(error cannot read $(MAKEFILE_DIR)/ci/kube-version)
+endif
 
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
diff --git a/ci/kube-version b/ci/kube-version
index 1304b01..91a50ee 100644
--- a/ci/kube-version
+++ b/ci/kube-version
@@ -1 +1 @@
-1.33.7
+1.33.13
diff --git a/ci/validate-apps.sh b/ci/validate-apps.sh
index c925d52..f7b8fd1 100755
--- a/ci/validate-apps.sh
+++ b/ci/validate-apps.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
diff --git a/ci/validate-clusters.sh b/ci/validate-clusters.sh
index 9395d7f..a4efc6e 100755
--- a/ci/validate-clusters.sh
+++ b/ci/validate-clusters.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
diff --git a/migration.md b/migration.md
index 2238279..13865c2 100644
--- a/migration.md
+++ b/migration.md
@@ -49,8 +49,8 @@
 - Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/<app-name>`
 
 ### 9. Validation
-- Run `kustomize build --enable-helm apps/overlays/au-syd1/<app-name>` to generate all resources
-- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
+- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>` to generate all resources
+- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
 - Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist`
 - Run `make kubeconform` to validate all resources
 - Fix any validation errors