diff --git a/Cargo.lock b/Cargo.lock
index 43549935..07345c5a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1555,7 +1555,7 @@ dependencies = [
  "diesel-async",
  "http 1.4.2",
  "jiff",
- "k8s-openapi",
+ "k8s-openapi 0.28.0",
  "kube",
  "node-semver",
  "percent-encoding",
@@ -3589,7 +3589,7 @@ dependencies = [
  "futures",
  "hostname",
  "jiff",
- "k8s-openapi",
+ "k8s-openapi 0.28.0",
  "kube",
  "lloggs",
  "miette",
@@ -3647,13 +3647,25 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "k8s-openapi"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c6922f6afe80418dd6019818af5d0d34584c371780ff09b9752370c25b4abb"
+dependencies = [
+ "base64 0.22.1",
+ "jiff",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "kube"
 version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acc5a6a69da2975ed9925d56b5dcfc9cc739b66f37add06785b7c9f6d1e88741"
 dependencies = [
- "k8s-openapi",
+ "k8s-openapi 0.27.1",
  "kube-client",
  "kube-core",
 ]
@@ -3677,7 +3689,7 @@ dependencies = [
  "hyper-util",
  "jiff",
  "jsonpath-rust",
- "k8s-openapi",
+ "k8s-openapi 0.27.1",
  "kube-core",
  "pem",
  "rustls 0.23.40",
@@ -3703,7 +3715,7 @@ dependencies = [
  "form_urlencoded",
  "http 1.4.2",
  "jiff",
- "k8s-openapi",
+ "k8s-openapi 0.27.1",
  "serde",
  "serde-value",
  "serde_json",
@@ -4668,7 +4680,7 @@ dependencies = [
  "futures",
  "http 1.4.2",
  "jiff",
- "k8s-openapi",
+ "k8s-openapi 0.28.0",
  "kube",
  "lloggs",
  "miette",
diff --git a/Cargo.toml b/Cargo.toml
index d5ed1918..08beb31e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,7 +34,7 @@ jiff = { version = "0.2.24", features = ["serde"] }
 # duplicate k8s-openapi with no version feature → build failure). `v1_32` is a
 # conservative recent control-plane version — CONFIRM against the actual EKS
 # control-plane version with ops before release (see spec open-question).
-k8s-openapi = { version = "0.27.1", features = ["v1_32"] }
+k8s-openapi = { version = "0.28.0", features = ["v1_32"] }
 # Disable kube's default `ring` crypto backend and use `aws-lc-rs` instead, so
 # we don't pull in a second rustls provider alongside the one the AWS SDK and
 # the rest of the workspace already use.