diff --git a/AGENTS.md b/AGENTS.md
index fc49a75..3f71ce2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,10 +22,10 @@ make kubeconform
 make clean
 
 # Quick build + inspect without persisting output
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 
 # Check all resource kinds produced by an overlay
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
 
 # Run pre-commit checks against all files
 uvx pre-commit run --all-files
@@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`):
 
 ### 5. Validate
 ```bash
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 make kubeconform
 ```
 
@@ -215,7 +215,7 @@ Examples:
 
 Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
 
-Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
+The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform.
 
 ---
 
diff --git a/Makefile b/Makefile
index 37ed939..a3996e4 100644
--- a/Makefile
+++ b/Makefile
@@ -3,8 +3,11 @@
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
 build:
-	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
-	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
+	@kube_version="$$(cat ci/kube-version)"; \
+	if [ -z "$$kube_version" ]; then echo "cannot read ci/kube-version" >&2; exit 1; fi; \
+	target="$(filter-out $@,$(MAKECMDGOALS))"; \
+	mkdir -p "manifests/$$target"; \
+	kustomize build --enable-helm --helm-kube-version "$$kube_version" "$$target" --output "manifests/$$target"
 
 # Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
 schemas:
diff --git a/ci/kube-version b/ci/kube-version
new file mode 100644
index 0000000..91a50ee
--- /dev/null
+++ b/ci/kube-version
@@ -0,0 +1 @@
+1.33.13
diff --git a/ci/validate-apps.sh b/ci/validate-apps.sh
index 2e6c1e7..f7b8fd1 100755
--- a/ci/validate-apps.sh
+++ b/ci/validate-apps.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \
diff --git a/ci/validate-clusters.sh b/ci/validate-clusters.sh
index eb1dee0..a4efc6e 100755
--- a/ci/validate-clusters.sh
+++ b/ci/validate-clusters.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \
diff --git a/migration.md b/migration.md
index 2238279..13865c2 100644
--- a/migration.md
+++ b/migration.md
@@ -49,8 +49,8 @@
 - Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/<app-name>`
 
 ### 9. Validation
-- Run `kustomize build --enable-helm apps/overlays/au-syd1/<app-name>` to generate all resources
-- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
+- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>` to generate all resources
+- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
 - Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist`
 - Run `make kubeconform` to validate all resources
 - Fix any validation errors