diff --git a/k8s-tools/Dockerfile b/k8s-tools/Dockerfile
index 4c66df54..f20daf6f 100644
--- a/k8s-tools/Dockerfile
+++ b/k8s-tools/Dockerfile
@@ -50,8 +50,8 @@ RUN echo "Computed sha256sum: $(sha256sum ${KAPP_FILENAME})" \
     && mv kapp-linux-amd64 kapp
 
 # renovate: datasource=github-tags depName=kubernetes/kubectl
-ENV KUBECTL_VERSION 1.26.15
-ENV KUBECTL_SUM b75f359e6fad3cdbf05a0ee9d5872c43383683bb8527a9e078bb5b8a44350a41
+ENV KUBECTL_VERSION 1.28.13
+ENV KUBECTL_SUM d7d363dd5a4c95444329bc5239b8718ebe84a043052958b2f15ee2feef9a28c6
 ENV KUBECTL_FILENAME kubectl
 ADD https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl .
 RUN echo "Computed sha256sum: $(sha256sum ${KUBECTL_FILENAME})" \
diff --git a/k8s-tools/k8s-tools_spec.rb b/k8s-tools/k8s-tools_spec.rb
index a094e47b..baef427a 100644
--- a/k8s-tools/k8s-tools_spec.rb
+++ b/k8s-tools/k8s-tools_spec.rb
@@ -7,7 +7,7 @@
 CREDHUB_CLI_VERSION='2.9.31' # renovate: datasource=github-releases depName=cloudfoundry/credhub-cli
 KUSTOMIZE_VERSION="5.0.3" # renovate: datasource=github-releases depName=kubernetes-sigs/kustomize
 KAPP_VERSION="0.62.1" # renovate: datasource=github-releases depName=k14s/kapp
-KUBECTL_VERSION="1.26.15" # renovate: datasource=github-tags depName=kubernetes/kubectl
+KUBECTL_VERSION="1.28.13" # renovate: datasource=github-tags depName=kubernetes/kubectl
 HELM_VERSION="3.14.4" # renovate: datasource=github-releases depName=helm/helm
 KUTTL_VERSION="0.17.0" # renovate: datasource=github-releases depName=kudobuilder/kuttl
 RUBY_VERSION = "3.1"
@@ -26,11 +26,11 @@
   end
 
   it "has the expected version of Kubectl (#{KUBECTL_VERSION}) with embedded Kustomize" do
-    OLD_KUSTOMIZE_VERSION="4.5.7"
+    EMBEDDED_KUSTOMIZE_VERSION="5.0.4-0.20230601165947-6ce0bf390ce3"
     expect(
-        command("kubectl version --short --client=true").stdout.strip
+        command("kubectl version --client=true").stdout.strip
     # ).to eq("Client Version: v#{KUBECTL_VERSION}\nKustomize Version: v#{KUSTOMIZE_VERSION}")
-    ).to eq("Client Version: v#{KUBECTL_VERSION}\nKustomize Version: v#{OLD_KUSTOMIZE_VERSION}")
+    ).to eq("Client Version: v#{KUBECTL_VERSION}\nKustomize Version: v#{EMBEDDED_KUSTOMIZE_VERSION}")
   end
 
   it "has the expected version of YTT (#{YTT_VERSION})" do