diff --git a/config/repositories.yaml b/config/repositories.yaml
index cd59bc7..bb9278b 100644
--- a/config/repositories.yaml
+++ b/config/repositories.yaml
@@ -41,7 +41,7 @@ repositories:
     master: https://ghcr.io/nearnodeflash/lustre-fs-operator
     useRemoteK: false
     remoteReference:
-      build: v0.1.18
+      build: v0.1.19
       url: https://github.com/NearNodeFlash/lustre-fs-operator.git/config/default/?ref=%s
 buildConfiguration:
   # Environment variables to set when calling any 'make' or 'deploy'
@@ -68,7 +68,7 @@ thirdPartyServices:
   - name: storage-version-migrator
     useRemoteKTar: false
     kustomization: config/storage-version-migrator/kustomization.yaml
-    url: https://github.com/NearNodeFlash/kube-storage-version-migrator/releases/download/v0.1.2/manifests.tar
+    url: https://github.com/NearNodeFlash/kube-storage-version-migrator/releases/download/v0.1.3/manifests.tar
     waitCmd: kubectl wait deploy -n kube-system trigger --for jsonpath='{.status.availableReplicas}=1'
   - name: nnf-storedversions-maint
     useRemoteFTar: false
diff --git a/dws b/dws
index 6408788..1fbf6b0 160000
--- a/dws
+++ b/dws
@@ -1 +1 @@
-Subproject commit 640878885c332227ce72ec39e283e8e41e4f3315
+Subproject commit 1fbf6b02a0503684e141b7450164f90831b13136
diff --git a/lustre-fs-operator b/lustre-fs-operator
index 9bcf1c1..3d79715 160000
--- a/lustre-fs-operator
+++ b/lustre-fs-operator
@@ -1 +1 @@
-Subproject commit 9bcf1c18142c32fd8aa333ba7b009091c7a1b27c
+Subproject commit 3d7971522cb5af49b705974121a78da6070a9c63
diff --git a/nnf-dm b/nnf-dm
index d0b0d4e..7513f7f 160000
--- a/nnf-dm
+++ b/nnf-dm
@@ -1 +1 @@
-Subproject commit d0b0d4e5b4ec601b40185e88213227631299cc9b
+Subproject commit 7513f7fff7a31b269441cac1ac820aa107d6141f
diff --git a/nnf-integration-test b/nnf-integration-test
index fc76176..3f64267 160000
--- a/nnf-integration-test
+++ b/nnf-integration-test
@@ -1 +1 @@
-Subproject commit fc761762b8d28f68cdbd3260a6d4b0e55437a70b
+Subproject commit 3f642673ec66e23a9a7dcd14b6e462792756ca42
diff --git a/nnf-sos b/nnf-sos
index 1acd3ed..e8de505 160000
--- a/nnf-sos
+++ b/nnf-sos
@@ -1 +1 @@
-Subproject commit 1acd3ed884bb253a409b004d04c9be60a4783de8
+Subproject commit e8de505a1fd8cd209de81b7bccfa6ec8bc740cc9
diff --git a/tools/kind.sh b/tools/kind.sh
index be4620d..a86efa0 100755
--- a/tools/kind.sh
+++ b/tools/kind.sh
@@ -22,6 +22,25 @@
 set -e
 set -o pipefail
 
+# This script must be run from the root of the nnf-deploy repo, not from tools/.
+if [[ ! -f "tools/kind.sh" ]]; then
+    echo "ERROR: kind.sh must be run from the root of the nnf-deploy repo."
+    echo "  cd \$(git -C \"\$(dirname \"\$0\")\" rev-parse --show-toplevel) && tools/kind.sh $*"
+    exit 1
+fi
+
+# kind v0.31.0+ is required for Kubernetes 1.35 support.
+KIND_MIN_VERSION="0.31.0"
+KIND_VERSION=$(kind version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+if [[ -z "$KIND_VERSION" ]]; then
+    echo "ERROR: kind is not installed or not in PATH."
+    exit 1
+fi
+if ! printf '%s\n%s\n' "$KIND_MIN_VERSION" "$KIND_VERSION" | sort -V -C; then
+    echo "ERROR: kind v$KIND_VERSION is installed but v$KIND_MIN_VERSION or later is required for Kubernetes 1.35."
+    exit 1
+fi
+
 usage() {
     echo "Usage: $0 [--no-argocd] <CMD>"
     echo
@@ -103,8 +122,17 @@ function inject_ca_certs {
 
     echo "Injecting CA certificates from $certs into KIND nodes..."
     for node in $(kind get nodes); do
-        docker cp "$certs" "$node:/usr/local/share/ca-certificates/extra-ca-certs.crt"
-        docker exec "$node" update-ca-certificates
+        # Pipe the bundle via stdin and split into individual .crt files so that
+        # update-ca-certificates / c_rehash does not emit
+        # "skipping ... it does not contain exactly one certificate or CRL".
+        docker exec -i "$node" bash -c '
+            awk "/-----BEGIN CERTIFICATE-----/{n++; f=sprintf(\"/usr/local/share/ca-certificates/extra-ca-cert-%d.crt\",n)} f{print > f}"
+        ' < "$certs"
+        # The ca-certificates.crt bundle always triggers a benign c_rehash warning;
+        # filter it so only real warnings surface.
+        local uca_out
+        uca_out=$(docker exec "$node" update-ca-certificates 2>&1)
+        echo "$uca_out" | grep -Fv "skipping ca-certificates.crt" || true
         docker exec "$node" systemctl restart containerd
         echo "  $node: done"
     done
@@ -152,6 +180,7 @@ nodes:
   kubeadmConfigPatches:
   - |
     kind: ClusterConfiguration
+    apiVersion: kubeadm.k8s.io/v1beta3
     apiServer:
         # enable auditing flags on the API server
         extraArgs:
@@ -187,7 +216,7 @@ EOF
         mkdir -p /tmp/nnf && dd if=/dev/zero of=/tmp/nnf/file.in bs=128 count=0 seek=$((1024 * 1024))
     fi
 
-    kind create cluster --wait 60s --image=kindest/node:v1.31.2 --config $CONFIG
+    kind create cluster --wait 60s --image=kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f --config $CONFIG
 
     # If corporate/custom CA certificates are available, inject them into
     # each KIND node so containerd can pull from registries behind a TLS