diff --git a/scripts/update_k8s.sh b/scripts/update_k8s.sh
index 3684fc1d..19abe7ef 100755
--- a/scripts/update_k8s.sh
+++ b/scripts/update_k8s.sh
@@ -82,7 +82,10 @@ sudo apt-get install -y "kubeadm=$RELEASE-*"
 
 if [[ "$ROLE" == "master" ]]; then
     echo "==> Master path: kubeadm upgrade plan + apply"
-    sudo kubeadm upgrade plan
+    # `plan` runs the same CoreDNS preflight as `apply`, so once master's kubeadm
+    # is on the new version it fails here too (under set -e) — ignore the same
+    # two CoreDNS checks. See the apply block below for the full rationale.
+    sudo kubeadm upgrade plan --ignore-preflight-errors=CoreDNSMigration,CoreDNSUnsupportedPlugins
     # The first apply may fail with "static Pod hash for component <X> did
     # not change after 5m0s" — kubeadm's 5min wait for the kubelet to reload
     # a static pod is too tight on our cluster (apiserver-to-kubelet status
diff --git a/stacks/k8s-version-upgrade/scripts/upgrade-step.sh b/stacks/k8s-version-upgrade/scripts/upgrade-step.sh
index 57ef87fc..fb1f2fcc 100644
--- a/stacks/k8s-version-upgrade/scripts/upgrade-step.sh
+++ b/stacks/k8s-version-upgrade/scripts/upgrade-step.sh
@@ -325,9 +325,13 @@ phase_preflight() {
     exit 1
   fi
 
-  # 4. kubeadm upgrade plan matches target
+  # 4. kubeadm upgrade plan matches target. `plan` runs the same CoreDNS
+  # preflight as `apply`; once master's kubeadm is on the new version it errors
+  # on a Keel-drifted CoreDNS (start version unsupported) and, under pipefail,
+  # aborts this whole check. Ignore the two CoreDNS checks here too so plan
+  # still emits its "kubeadm upgrade apply vX.Y.Z" line. (See update_k8s.sh.)
   local plan_target
-  plan_target=$(ssh "${SSH_OPTS[@]}" "wizard@k8s-master$NODE_DOMAIN" 'sudo kubeadm upgrade plan' \
+  plan_target=$(ssh "${SSH_OPTS[@]}" "wizard@k8s-master$NODE_DOMAIN" 'sudo kubeadm upgrade plan --ignore-preflight-errors=CoreDNSMigration,CoreDNSUnsupportedPlugins' \
     | grep -oE 'kubeadm upgrade apply v[0-9]+\.[0-9]+\.[0-9]+' \
     | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1 | tr -d v)
   if [ "$plan_target" != "$TARGET_VERSION" ]; then