diff --git a/.github/workflows/integration-tests-kubernetes.yml b/.github/workflows/integration-tests-kubernetes.yml
index 1de465cf5ec..403ff047c04 100644
--- a/.github/workflows/integration-tests-kubernetes.yml
+++ b/.github/workflows/integration-tests-kubernetes.yml
@@ -9,17 +9,35 @@ jobs:
   it-test-kubernetes:
     strategy:
       matrix:
+        kubectl-version:
+          - 1.22.17
         kubernetes-image:
-          - "kindest/node:v1.28.0@sha256:9f3ff58f19dcf1a0611d11e8ac989fdb30a28f40f236f59f0bea31fb956ccf5c"
-          - "kindest/node:v1.27.3@sha256:9dd3392d79af1b084671b05bcf65b21de476256ad1dcc853d9f3b10b4ac52dde"
-          - "kindest/node:v1.26.6@sha256:5e5d789e90c1512c8c480844e0985bc3b4da4ba66179cc5b540fe5b785ca97b5"
-          - "kindest/node:v1.25.11@sha256:ca7371d5d1f680778e40e9bcbbea06c3c61ac6f0e1a29cba5c58ff2dae1ba7f5"
-          - "kindest/node:v1.24.15@sha256:24473777a1eef985dc405c23ab9f4daddb1352ca23db60b75de9e7c408096491"
-          - "kindest/node:v1.23.0@sha256:49824ab1727c04e56a21a5d8372a402fcd32ea51ac96a2706a12af38934f81ac"
-          - "kindest/node:v1.22.0@sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047"
-          - "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
-          - "kindest/node:v1.20.7@sha256:cbeaf907fc78ac97ce7b625e4bf0de16e3ea725daf6b04f930bd14c67c671ff9"
-          - "kindest/node:v1.19.11@sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729"
+          - "kindest/node:v1.29.0@sha256:eaa1450915475849a73a9227b8f201df25e55e268e5d619312131292e324d570"
+          - "kindest/node:v1.28.0@sha256:b7a4cad12c197af3ba43202d3efe03246b3f0793f162afb40a33c923952d5b31"
+          - "kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72"
+          - "kindest/node:v1.26.6@sha256:6e2d8b28a5b601defe327b98bd1c2d1930b49e5d8c512e1895099e4504007adb"
+          - "kindest/node:v1.25.11@sha256:227fa11ce74ea76a0474eeefb84cb75d8dad1b08638371ecf0e86259b35be0c8"
+          - "kindest/node:v1.24.15@sha256:7db4f8bea3e14b82d12e044e25e34bd53754b7f2b0e9d56df21774e6f66a70ab"
+          - "kindest/node:v1.23.17@sha256:59c989ff8a517a93127d4a536e7014d28e235fb3529d9fba91b3951d461edfdb"
+          - "kindest/node:v1.22.17@sha256:f5b2e5698c6c9d6d0adc419c0deae21a425c07d81bbf3b6a6834042f25d4fba2"
+          - "kindest/node:v1.21.14@sha256:8a4e9bb3f415d2bb81629ce33ef9c76ba514c14d707f9797a01e3216376ba093"
+        include:
+          - kubectl-version: 1.29.1
+            kubernetes-image: "kindest/node:v1.29.0@sha256:eaa1450915475849a73a9227b8f201df25e55e268e5d619312131292e324d570"
+          - kubectl-version: 1.28.6
+            kubernetes-image: "kindest/node:v1.28.0@sha256:b7a4cad12c197af3ba43202d3efe03246b3f0793f162afb40a33c923952d5b31"
+          - kubectl-version: 1.27.10
+            kubernetes-image: "kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72"
+          - kubectl-version: 1.26.13
+            kubernetes-image: "kindest/node:v1.26.6@sha256:6e2d8b28a5b601defe327b98bd1c2d1930b49e5d8c512e1895099e4504007adb"
+          - kubectl-version: 1.25.16
+            kubernetes-image: "kindest/node:v1.25.11@sha256:227fa11ce74ea76a0474eeefb84cb75d8dad1b08638371ecf0e86259b35be0c8"
+          - kubectl-version: 1.24.17
+            kubernetes-image: "kindest/node:v1.24.15@sha256:7db4f8bea3e14b82d12e044e25e34bd53754b7f2b0e9d56df21774e6f66a70ab"
+          - kubectl-version: 1.23.17
+            kubernetes-image: "kindest/node:v1.23.17@sha256:59c989ff8a517a93127d4a536e7014d28e235fb3529d9fba91b3951d461edfdb"
+          - kubectl-version: 1.21.14
+            kubernetes-image: "kindest/node:v1.21.14@sha256:8a4e9bb3f415d2bb81629ce33ef9c76ba514c14d707f9797a01e3216376ba093"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -49,4 +67,4 @@ jobs:
       - name: Kubernetes Provider Integration Tests
         run: |
           version=$(echo '${{ matrix.kubernetes-image }}' | grep -o 'v[0-9]*\.[0-9]*')
-          ./gradlew --build-cache :clouddriver-kubernetes:integrationTest -Pkubernetes-image=${{ matrix.kubernetes-image }} -Pkubernetes-version=${version}
+          ./gradlew --build-cache :clouddriver-kubernetes:integrationTest -Pkubernetes-image=${{ matrix.kubernetes-image }} -Pkubectl-version=${{ matrix.kubectl-version }} -Pkubernetes-version=${version}
diff --git a/Dockerfile.java11.slim b/Dockerfile.java11.slim
index 52ce2c6a8b6..855ecb9dd47 100644
--- a/Dockerfile.java11.slim
+++ b/Dockerfile.java11.slim
@@ -2,8 +2,8 @@ FROM python:3.7-alpine3.16
 LABEL maintainer="sig-platform@spinnaker.io"
 ARG TARGETARCH
 
-# KUBECTL_RELEASE kept one minor version behind latest to maximise compatibility overlap
-ENV KUBECTL_RELEASE=1.22.17
+ENV KUBECTL_DEFAULT_RELEASE=1.22.17
+ENV KUBECTL_RELEASES="${KUBECTL_DEFAULT_RELEASE} 1.26.12 1.27.9 1.28.5 1.29.0"
 ENV AWS_CLI_VERSION=1.22
 ENV AWS_CLI_S3_CMD=2.0.2
 ENV AWS_AIM_AUTHENTICATOR_VERSION=0.5.9
@@ -38,13 +38,16 @@ RUN [ $TARGETARCH == 'amd64' ] &&  export GCP_ARCH="x86_64" || export GCP_ARCH="
   && rm -rf /opt/google-cloud-sdk/.install/.backup
 
 # kubectl + AWS IAM authenticator
-RUN wget https://cdn.dl.k8s.io/release/v${KUBECTL_RELEASE}/bin/linux/${TARGETARCH}/kubectl \
-  && chmod +x kubectl \
-  && mv ./kubectl /usr/local/bin/kubectl \
-  && wget -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
-	&& chmod +x ./aws-iam-authenticator \
-	&& mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
-    && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
+RUN for version in $KUBECTL_RELEASES; do \
+      release_version=$(echo ${version} | cut -d. -f1,2); \
+      wget -nv https://cdn.dl.k8s.io/release/v${version}/bin/linux/${TARGETARCH}/kubectl -O /usr/local/bin/kubectl-${release_version}; \
+      chmod +x /usr/local/bin/kubectl-${release_version}; \
+      done \
+  && ln -sf "/usr/local/bin/kubectl-$(echo ${KUBECTL_DEFAULT_RELEASE} | cut -d. -f1,2)" /usr/local/bin/kubectl \
+  && wget -nv -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
+  && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
 
 RUN rm /var/cache/apk/*
 
diff --git a/Dockerfile.java11.ubuntu b/Dockerfile.java11.ubuntu
index a5315b33580..fcc9ea2704a 100644
--- a/Dockerfile.java11.ubuntu
+++ b/Dockerfile.java11.ubuntu
@@ -3,7 +3,8 @@ LABEL maintainer="sig-platform@spinnaker.io"
 ARG TARGETARCH
 ENV GOOGLE_CLOUD_SDK_VERSION=412.0.0
 ENV PATH "$PATH:/opt/google-cloud-sdk/bin/"
-ENV KUBECTL_RELEASE=1.22.17
+ENV KUBECTL_DEFAULT_RELEASE=1.22.17
+ENV KUBECTL_RELEASES="${KUBECTL_DEFAULT_RELEASE} 1.26.12 1.27.9 1.28.5 1.29.0"
 ENV AWS_CLI_VERSION=1.22
 ENV AWS_CLI_S3_CMD=2.0.2
 ENV AWS_AIM_AUTHENTICATOR_VERSION=0.5.9
@@ -27,13 +28,16 @@ RUN pip install --upgrade  --no-build-isolation awscli==${AWS_CLI_VERSION} s3cmd
   && apt remove -y python3-pip
 
 # kubectl + AWS IAM authenticator
-RUN wget https://cdn.dl.k8s.io/release/v${KUBECTL_RELEASE}/bin/linux/${TARGETARCH}/kubectl \
-  && chmod +x kubectl \
-  && mv ./kubectl /usr/local/bin/kubectl \
-  && wget -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
-	&& chmod +x ./aws-iam-authenticator \
-	&& mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
-    && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
+RUN for version in $KUBECTL_RELEASES; do \
+      release_version=$(echo ${version} | cut -d. -f1,2); \
+      wget -nv https://cdn.dl.k8s.io/release/v${version}/bin/linux/${TARGETARCH}/kubectl -O /usr/local/bin/kubectl-${release_version}; \
+      chmod +x /usr/local/bin/kubectl-${release_version}; \
+      done \
+  && ln -sf "/usr/local/bin/kubectl-$(echo ${KUBECTL_DEFAULT_RELEASE} | cut -d. -f1,2)" /usr/local/bin/kubectl \
+  && wget -nv -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
+  && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
 
 # Google cloud SDK
 RUN [ $TARGETARCH == 'amd64' ] &&  export GCP_ARCH="x86_64" || export GCP_ARCH="arm"  \
diff --git a/Dockerfile.slim b/Dockerfile.slim
index 2be397c24b1..f2e9e56eb65 100644
--- a/Dockerfile.slim
+++ b/Dockerfile.slim
@@ -2,8 +2,8 @@ FROM python:3.7-alpine3.16
 LABEL maintainer="sig-platform@spinnaker.io"
 ARG TARGETARCH
 
-# KUBECTL_RELEASE kept one minor version behind latest to maximise compatibility overlap
-ENV KUBECTL_RELEASE=1.22.17
+ENV KUBECTL_DEFAULT_RELEASE=1.22.17
+ENV KUBECTL_RELEASES="${KUBECTL_DEFAULT_RELEASE} 1.26.12 1.27.9 1.28.5 1.29.0"
 ENV AWS_CLI_VERSION=1.22
 ENV AWS_CLI_S3_CMD=2.0.2
 ENV AWS_AIM_AUTHENTICATOR_VERSION=0.5.9
@@ -38,13 +38,16 @@ RUN [ $TARGETARCH == 'amd64' ] &&  export GCP_ARCH="x86_64" || export GCP_ARCH="
   && rm -rf /opt/google-cloud-sdk/.install/.backup
 
 # kubectl + AWS IAM authenticator
-RUN wget https://cdn.dl.k8s.io/release/v${KUBECTL_RELEASE}/bin/linux/${TARGETARCH}/kubectl \
-  && chmod +x kubectl \
-  && mv ./kubectl /usr/local/bin/kubectl \
-  && wget -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
-	&& chmod +x ./aws-iam-authenticator \
-	&& mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
-    && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
+RUN for version in $KUBECTL_RELEASES; do \
+      release_version=$(echo ${version} | cut -d. -f1,2); \
+      wget -nv https://cdn.dl.k8s.io/release/v${version}/bin/linux/${TARGETARCH}/kubectl -O /usr/local/bin/kubectl-${release_version}; \
+      chmod +x /usr/local/bin/kubectl-${release_version}; \
+      done \
+  && ln -sf "/usr/local/bin/kubectl-$(echo ${KUBECTL_DEFAULT_RELEASE} | cut -d. -f1,2)" /usr/local/bin/kubectl \
+  && wget -nv -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
+  && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
 
 RUN rm /var/cache/apk/*
 
diff --git a/Dockerfile.ubuntu b/Dockerfile.ubuntu
index 8f57287f548..c12865f9462 100644
--- a/Dockerfile.ubuntu
+++ b/Dockerfile.ubuntu
@@ -3,7 +3,8 @@ LABEL maintainer="sig-platform@spinnaker.io"
 ARG TARGETARCH
 ENV GOOGLE_CLOUD_SDK_VERSION=412.0.0
 ENV PATH "$PATH:/opt/google-cloud-sdk/bin/"
-ENV KUBECTL_RELEASE=1.22.17
+ENV KUBECTL_DEFAULT_RELEASE=1.22.17
+ENV KUBECTL_RELEASES="${KUBECTL_DEFAULT_RELEASE} 1.26.12 1.27.9 1.28.5 1.29.0"
 ENV AWS_CLI_VERSION=1.22
 ENV AWS_CLI_S3_CMD=2.0.2
 ENV AWS_AIM_AUTHENTICATOR_VERSION=0.5.9
@@ -27,13 +28,16 @@ RUN pip install --upgrade  --no-build-isolation awscli==${AWS_CLI_VERSION} s3cmd
   && apt remove -y python3-pip
 
 # kubectl + AWS IAM authenticator
-RUN wget https://cdn.dl.k8s.io/release/v${KUBECTL_RELEASE}/bin/linux/${TARGETARCH}/kubectl \
-  && chmod +x kubectl \
-  && mv ./kubectl /usr/local/bin/kubectl \
-  && wget -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
-	&& chmod +x ./aws-iam-authenticator \
-	&& mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
-    && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
+RUN for version in $KUBECTL_RELEASES; do \
+      release_version=$(echo ${version} | cut -d. -f1,2); \
+      wget -nv https://cdn.dl.k8s.io/release/v${version}/bin/linux/${TARGETARCH}/kubectl -O /usr/local/bin/kubectl-${release_version}; \
+      chmod +x /usr/local/bin/kubectl-${release_version}; \
+      done \
+  && ln -sf "/usr/local/bin/kubectl-$(echo ${KUBECTL_DEFAULT_RELEASE} | cut -d. -f1,2)" /usr/local/bin/kubectl \
+  && wget -nv -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_AIM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_AIM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/local/bin/aws-iam-authenticator\
+  && ln -sf /usr/local/bin/aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
 
 # Google cloud SDK
 RUN [ $TARGETARCH == 'amd64' ] &&  export GCP_ARCH="x86_64" || export GCP_ARCH="arm"  \
diff --git a/clouddriver-kubernetes/clouddriver-kubernetes.gradle b/clouddriver-kubernetes/clouddriver-kubernetes.gradle
index 93df28fd6e5..b4a6033b1ac 100644
--- a/clouddriver-kubernetes/clouddriver-kubernetes.gradle
+++ b/clouddriver-kubernetes/clouddriver-kubernetes.gradle
@@ -126,6 +126,7 @@ task integrationTest(type: Test) {
 
   environment "IT_BUILD_HOME", "$project.buildDir/it"
   environment "IMAGE", project.getProperties().get("kubernetes-image")
+  environment "KUBECTL_VERSION", project.getProperties().get("kubectl-version")
   environment "KUBERNETES_VERSION", project.getProperties().get("kubernetes-version")
   useJUnitPlatform()
 
diff --git a/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/DeployManifestIT.java b/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/DeployManifestIT.java
index ee67bf0f30c..aed10a8d374 100644
--- a/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/DeployManifestIT.java
+++ b/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/DeployManifestIT.java
@@ -17,8 +17,11 @@
 package com.netflix.spinnaker.clouddriver.kubernetes.it;
 
 import static io.restassured.RestAssured.given;
-import static org.hamcrest.Matchers.*;
-import static org.junit.jupiter.api.Assertions.*;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableList;
@@ -1844,6 +1847,9 @@ public void shouldDeployUsingServerSideApply() throws IOException, InterruptedEx
                 + " get deployment "
                 + DEPLOYMENT_1_NAME
                 + " -o=jsonpath='{.metadata.managedFields[?(@.operation==\"Apply\")].manager}'");
+    // kubectl v1.26+ adds a "kubectl-last-applied" manager as well. Remove it. The jsonpath
+    // implementation in kubectl is really limited, so we have to do this in java.
+    applyManager = applyManager.replaceAll("\\s?kubectl-last-applied\\s?", "");
     assertEquals(
         "kubectl",
         applyManager,
diff --git a/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/containers/KubernetesCluster.java b/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/containers/KubernetesCluster.java
index aba0c926ac6..d8d086a205b 100644
--- a/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/containers/KubernetesCluster.java
+++ b/clouddriver-kubernetes/src/integration/java/com/netflix/spinnaker/clouddriver/kubernetes/it/containers/KubernetesCluster.java
@@ -21,14 +21,26 @@
 import static org.assertj.core.api.Assertions.fail;
 
 import com.google.gson.Gson;
-import java.io.*;
+import java.io.BufferedWriter;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Reader;
 import java.net.URL;
 import java.nio.channels.Channels;
 import java.nio.channels.ReadableByteChannel;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 import org.springframework.util.FileCopyUtils;
 
@@ -37,7 +49,7 @@ public class KubernetesCluster {
   private static KubernetesCluster INSTANCE;
   private static final String IMAGE = System.getenv("IMAGE");
   private static final String KIND_VERSION = "0.20.0";
-  private static final String KUBECTL_VERSION = "1.22.17";
+  private static final String KUBECTL_VERSION = System.getenv("KUBECTL_VERSION");
   private static final Path IT_BUILD_HOME = Paths.get(System.getenv("IT_BUILD_HOME"));
   private static final Path KUBECFG_PATH = Paths.get(IT_BUILD_HOME.toString(), "kubecfg.yml");
   private static final Path KUBECTL_PATH = Paths.get(IT_BUILD_HOME.toString(), "kubectl");
@@ -149,8 +161,7 @@ private void downloadDependencies() throws IOException {
     if (!kubectl.toFile().exists()) {
       String url =
           String.format(
-              "https://storage.googleapis.com/kubernetes-release/release/v%s/bin/%s/%s/kubectl",
-              KUBECTL_VERSION, os, arch);
+              "https://cdn.dl.k8s.io/release/v%s/bin/%s/%s/kubectl", KUBECTL_VERSION, os, arch);
       System.out.println("Downloading kubectl from " + url);
       downloadFile(kubectl, url);
     }
diff --git a/clouddriver-web/pkg_scripts/postInstall.sh b/clouddriver-web/pkg_scripts/postInstall.sh
index 176e71361b6..33cef4636b4 100755
--- a/clouddriver-web/pkg_scripts/postInstall.sh
+++ b/clouddriver-web/pkg_scripts/postInstall.sh
@@ -1,8 +1,8 @@
 #!/bin/sh
 
 # Remember to also update Dockerfile.*
-# KUBECTL_RELEASE kept one minor version behind latest to maximise compatibility overlap
-KUBECTL_RELEASE=1.22.17
+KUBECTL_DEFAULT_RELEASE=1.22.17
+KUBECTL_RELEASES="${KUBECTL_DEFAULT_RELEASE} 1.26.12 1.27.9 1.28.5 1.29.0"
 
 # ubuntu
 # check that owner group exists
@@ -17,9 +17,12 @@ fi
 
 install_kubectl() {
   if [ -z "$(which kubectl)" ]; then
-    wget "https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_RELEASE}/bin/linux/amd64/kubectl"
-    chmod +x kubectl
-    mv ./kubectl /usr/local/bin/kubectl
+    for version in $KUBECTL_RELEASES; do
+      release_version=$(echo "${version}" | cut -d. -f1,2); \
+      wget -nv "https://cdn.dl.k8s.io/release/v${version}/bin/linux/amd64/kubectl" -O "/usr/local/bin/kubectl-${release_version}";
+      chmod +x "/usr/local/bin/kubectl-${release_version}";
+    done
+    ln -sf "/usr/local/bin/kubectl-$(echo ${KUBECTL_DEFAULT_RELEASE} | cut -d. -f1,2)" /usr/local/bin/kubectl
   fi
 }