diff --git a/bootstrap/tasks/addons/system_upgrade_controller.yaml b/bootstrap/tasks/addons/system_upgrade_controller.yaml
index f3ed64b7..65e0f00c 100644
--- a/bootstrap/tasks/addons/system_upgrade_controller.yaml
+++ b/bootstrap/tasks/addons/system_upgrade_controller.yaml
@@ -2,7 +2,7 @@
 - name: Set addon facts
   ansible.builtin.set_fact:
     addon_name: system-upgrade-controller
-    addon_namespace: system-upgrade
+    addon_namespace: kube-system
 
 - name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
   when: item.state == 'directory'
diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2
index e73734f7..cf057a4d 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2
@@ -65,13 +65,12 @@ spec:
                       - key: node-role.kubernetes.io/control-plane
                         operator: Exists
           tolerations:
-            - { key: CriticalAddonsOnly, operator: Exists }
-            - { key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute }
+            - {key: CriticalAddonsOnly, operator: Exists}
+            - {key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute}
     serviceAccount:
-      create: true
       name: system-upgrade
     service:
       main:
diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2
index a666a2a1..f531caa7 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2
@@ -3,11 +3,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
 secrets:
   - name: system-upgrade
 ---
@@ -16,22 +11,13 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
   annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
     kubernetes.io/service-account.name: system-upgrade
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name:  system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -39,4 +25,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: system-upgrade
-    namespace: system-upgrade
+    namespace: kube-system
diff --git a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
index 6f5c48fd..6374d702 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
@@ -5,11 +5,11 @@ metadata:
   name: &app system-upgrade-controller
   namespace: flux-system
 spec:
-  targetNamespace: system-upgrade
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
+  path: ./kubernetes/apps/kube-system/system-upgrade-controller/app
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,13 +25,13 @@ metadata:
   name: &app system-upgrade-controller-plans
   namespace: flux-system
 spec:
-  targetNamespace: system-upgrade
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: system-upgrade-controller
-  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
+  path: ./kubernetes/apps/kube-system/system-upgrade-controller/plans
   prune: true
   sourceRef:
     kind: GitRepository
diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
index 35f94c74..3a4cf75e 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
@@ -5,7 +5,7 @@ metadata:
   name: agent
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
-  version: "v1.28.3+k3s1"
+  version: "v1.28.3+k3s2"
   serviceAccountName: system-upgrade
   concurrency: 1
   nodeSelector:
diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2
index 2a658c35..14d17ed1 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
index ab3643f6..00c2ae9b 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
@@ -5,19 +5,12 @@ metadata:
   name: server
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
-  version: "v1.28.3+k3s1"
+  version: "v1.28.3+k3s2"
   serviceAccountName: system-upgrade
   concurrency: 1
   cordon: true
   nodeSelector:
     matchExpressions:
-      - { key: node-role.kubernetes.io/control-plane, operator: Exists }
-  tolerations:
-    - { effect: NoSchedule, operator: Exists }
-    - { effect: NoExecute, operator: Exists }
-    - { key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists }
-    - { key: node-role.kubernetes.io/master, effect: NoSchedule, operator: Exists }
-    - { key: node-role.kubernetes.io/etcd, effect: NoExecute, operator: Exists }
-    - { key: CriticalAddonsOnly, operator: Exists }
+      - {key: node-role.kubernetes.io/control-plane, operator: Exists}
   upgrade:
     image: rancher/k3s-upgrade
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
index 61447694..d53f5a57 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
@@ -13,3 +13,6 @@ resources:
   {% if csi_driver_nfs.enabled | default(false) %}
   - ./csi-driver-nfs/ks.yaml
   {% endif %}
+  {% if system_upgrade_controller.enabled | default(false) %}
+  - ./system-upgrade-controller/ks.yaml
+  {% endif %}
diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2
deleted file mode 100644
index 07efa24a..00000000
--- a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2
+++ /dev/null
@@ -1,9 +0,0 @@
-#jinja2: trim_blocks: True, lstrip_blocks: True
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./namespace.yaml
-  {% if system_upgrade_controller.enabled | default(false) %}
-  - ./system-upgrade-controller/ks.yaml
-  {% endif %}
diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/namespace.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/namespace.yaml.j2
deleted file mode 100644
index 5ea024dd..00000000
--- a/bootstrap/templates/kubernetes/apps/system-upgrade/namespace.yaml.j2
+++ /dev/null
@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: system-upgrade
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled