diff --git a/install.sh b/install.sh
index 57ae861..78e31b6 100755
--- a/install.sh
+++ b/install.sh
@@ -2,8 +2,15 @@
 
 set -eu
 
-chart_version=10.7.2
+chart_version=10.10.5
 project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+expected_context=kubernetes-admin@kubernetes
+
+current_context=$(kubectl config current-context)
+if [ "$current_context" != "$expected_context" ]; then
+  echo "Refusing mutation: expected context $expected_context, got $current_context" >&2
+  exit 1
+fi
 
 for command in helm kubectl openssl base64 curl; do
   if ! command -v "$command" >/dev/null 2>&1; then
diff --git a/render.sh b/render.sh
index 15355eb..46fa25a 100755
--- a/render.sh
+++ b/render.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-version=${ARGOCD_CHART_VERSION:-10.7.2}
+version=${ARGOCD_CHART_VERSION:-10.10.5}
 output=${1:?Usage: render.sh OUTPUT_FILE}
 chart=$(mktemp)
 trap 'rm -f "${chart}"' EXIT
diff --git a/test.sh b/test.sh
index d3844f2..e1730b1 100755
--- a/test.sh
+++ b/test.sh
@@ -9,7 +9,7 @@ if grep -Eq '^kind: Secret$' "${workdir}/argocd.yaml"; then
   echo "Rendered Argo CD state must not contain Secrets" >&2; exit 1
 fi
 image=ghcr.io/yannh/kubeconform:v0.7.0
-validate() { if command -v kubeconform >/dev/null; then kubeconform -strict -exit-on-error -summary "$@"; else local file=${!#}; docker run --rm -i "${image}" -strict -exit-on-error -summary "${@:1:$#-1}" < "$file"; fi; }
+validate() { if command -v kubeconform >/dev/null; then kubeconform -strict -exit-on-error -summary "$@"; else local file=${!#}; podman run --rm -i "${image}" -strict -exit-on-error -summary "${@:1:$#-1}" < "$file"; fi; }
 validate -ignore-missing-schemas "${workdir}/argocd.yaml"
 validate "${project_dir}/ci-deployer.yaml"
 echo "Argo CD chart and CI resources are valid."