diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40d3de6d01..430ee720dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,105 @@
+## Fleet 4.33.0 (Jun 12, 2023)
+
+* Upgraded Go version to 1.19.10.
+
+* Added support for ChromeOS devices.
+
+* Added instructions to inform users how to add ChromeOS hosts.
+
+* Added ChromeOS details to the dashboard, manage hosts, and host details pages.
+
+* Added ability for users to create policies that target ChromeOS.
+
+* Added built-in label for ChromeOS.
+
+* Added query to fill in `device_mapping` from ChromeOS hosts.
+
+* Improved the performance of live query results rendering to address usability issues when querying tens of thousands of hosts.
+
+* Reduced size of live query websocket message by removing unused host data.
+
+* Added the `POST /fleet/mdm/apple/profiles/preassign` endpoint to store profiles to be assigned to a host for subsequent matching with an existing (or new) team.
+
+* Added the `POST /fleet/mdm/apple/profiles/match` endpoint to match pre-assigned profiles to an existing team or create one if needed, and assign the host to that team.
+
+* Updated `GET /mdm/apple/profiles` endpoint to return empty array instead of null if no profiles are found.
+
+* Improved ingestion of MDM devices from ABM:
+  - If a device's operation_type is `modified`, but the device doesn't exist in Fleet yet, a DEP profile will be assigned to the device and a new record will be created in Fleet.
+  - If a device's operation_type is `deleted`, the device won't be prompted to migrate to Fleet if the feature has been configured.
+
+* Added "Verified" profile status for profiles verified with osquery.
+
+* Added "Action required" status for disk encryption profile in UI for host details and device user pages.
+
+* Added UI for the end user authentication page for MDM macos setup.
+
+* Added new host detail query to verify MDM profiles and updated API to include verified status.
+
+* Added documentation in the guide for `fleetctl get mdm-commands`.
+
+* Moved post-DEP (automatic) MDM enrollment to a worker job for increased resiliency with retries.
+
+* Added better UI error for manual enroll MDM modal.
+
+* Updated `GET /api/_version_/fleet/config` to now omits fields `smtp_settings` and `sso_settings` if not set.
+
+* Added a response payload to the `POST /api/latest/fleet/spec/teams` contributor API endpoint so that it returns an object with a `team_ids_by_name` key which maps team names with their corresponding id.
+
+* Ensure we send post-enrollment commands to MDM devices that are re-enrolling after being wiped.
+
+* Added error message to UI when Redis disconnects during a live query session.
+
+* Optimized query used for listing activities on the dashboard.
+
+* Added ability for users to delete multiple pages of hosts.
+
+* Added ability to deselect label filter on host table.
+
+* Added support for value `null` on `FLEET_JIT_USER_ROLE_GLOBAL` and `FLEET_JIT_USER_ROLE_TEAM_*` SAML attributes. Fleet will accept and ignore such `null` attributes.
+
+* Deprecate `enable_jit_role_sync` setting and only change role for existing users if role attributes are set in the `SAMLResponse`.
+
+* Improved styling in sandbox mode.
+
+* Patched a potential security issue.
+
+* Improved icon clarity.
+
+* Fixed issues with the MDM migration flow.
+
+* Fixed a bug with applying team specs via `fleetctl apply` and updating a team via the `PATCH /api/latest/fleet/mdm/teams/{id}` endpoint so that the MDM updates settings (`minimum_version` and `deadline`) are not cleared if not provided in the payload.
+
+* Fixed table formatting for the output of `fleetctl get mdm-command-results`.
+
+* Fixed the `/api/latest/fleet/mdm/apple_bm` endpoint so that it returns 400 instead of 500 when it fails to authenticate with Apple's Business Manager API, as this indicates a Fleet configuration issue with the Apple BM certificate or token.
+
+* Fixed a bug that would show MDM URLs for the same server as different servers if they contain query parameters.
+
+* Fixed an issue preventing a user with the `gitops` role from applying some MDM settings via `fleetctl apply` (the `macos_setup_assistant` and `bootstrap_package` settings).
+
+* Fixed `GET /api/v1/fleet/spec/labels/{name}` endpoint so that it now includes the label id.
+
+* Fixed Observer/Observer+ role being able to see team secrets.
+
+* Fixed UI bug where `inherited_page=0` was incorrectly added to some URLs.
+
+* Fixed misaligned icons in UI.
+
+* Fixed tab misalignment caused by new font.
+
+* Fixed dashed line styling on multiline activities.
+
+* Fixed a bug in the users table where users that are observer+ for all of more than one team were listed as "Various roles".
+
+* Fixed 500 error being returned if SSO session is not found.
+
+* Fixed issue with `chrome_extensions` virtual table not returning a path value on `fleetd-chrome`, which was breaking software ingestion.
+
+* Fixed bug with page navigation inside 'My Device' page.
+
+* Fixed a styling bug in the add hosts modal in sandbox mode.
+
 ## Fleet 4.32.0 (May 24, 2023)
 
 * Added support to add a EULA as part of the AEP/DEP unboxing flow.
diff --git a/changes/10566-optimize-list-activity-query b/changes/10566-optimize-list-activity-query
deleted file mode 100644
index 70f31f309e..0000000000
--- a/changes/10566-optimize-list-activity-query
+++ /dev/null
@@ -1 +0,0 @@
-Optimized query used for listing activities on the Dashboard.
\ No newline at end of file
diff --git a/changes/10605-abm-assignment b/changes/10605-abm-assignment
deleted file mode 100644
index f7da5a7dec..0000000000
--- a/changes/10605-abm-assignment
+++ /dev/null
@@ -1,3 +0,0 @@
-* Improved ingestion of MDM devices from ABM:
-  - If a device's operation_type is `modified`, but the device doesn't exist in Fleet yet, a DEP profile will be assigned to the device and a new record will be created in Fleet.
-  - If a device's operation_type is `deleted`, the device won't be prompted to migrate to Fleet if the feature has been configured.
diff --git a/changes/10784-change-role-of-existing-users-only-if-sso-attrs-are-present b/changes/10784-change-role-of-existing-users-only-if-sso-attrs-are-present
deleted file mode 100644
index f6b970d7a8..0000000000
--- a/changes/10784-change-role-of-existing-users-only-if-sso-attrs-are-present
+++ /dev/null
@@ -1 +0,0 @@
-* Deprecate `enable_jit_role_sync` setting and only change role for existing users if role attributes are set in the `SAMLResponse`.
diff --git a/changes/10878-support-sso-role-attributes-with-null-value b/changes/10878-support-sso-role-attributes-with-null-value
deleted file mode 100644
index e949aa315d..0000000000
--- a/changes/10878-support-sso-role-attributes-with-null-value
+++ /dev/null
@@ -1 +0,0 @@
-* Support value `null` on `FLEET_JIT_USER_ROLE_GLOBAL` and `FLEET_JIT_USER_ROLE_TEAM_*` SAML attributes. Fleet will accept and ignore such `null` attributes.
diff --git a/changes/10957-add-error-message-to-ui-when-redis-disconnects b/changes/10957-add-error-message-to-ui-when-redis-disconnects
deleted file mode 100644
index 8da07076f9..0000000000
--- a/changes/10957-add-error-message-to-ui-when-redis-disconnects
+++ /dev/null
@@ -1 +0,0 @@
-* Add error message to UI when Redis disconnects during a live query session.
diff --git a/changes/10957-reduce-size-distributed-query-result-struct b/changes/10957-reduce-size-distributed-query-result-struct
deleted file mode 100644
index b827d12eb0..0000000000
--- a/changes/10957-reduce-size-distributed-query-result-struct
+++ /dev/null
@@ -1 +0,0 @@
-* Reduce size of live query websocket message by removing unused host data.
diff --git a/changes/11257-post-enrollment-commands b/changes/11257-post-enrollment-commands
deleted file mode 100644
index 5c723108b2..0000000000
--- a/changes/11257-post-enrollment-commands
+++ /dev/null
@@ -1 +0,0 @@
-* Ensure we send post-enrollment commands to MDM devices that are re-enrolling after being wiped.
diff --git a/changes/11266-omit-sso-and-smtp-if-not-set b/changes/11266-omit-sso-and-smtp-if-not-set
deleted file mode 100644
index bf81559e0a..0000000000
--- a/changes/11266-omit-sso-and-smtp-if-not-set
+++ /dev/null
@@ -1 +0,0 @@
-* `GET /api/_version_/fleet/config` to omit fields `smtp_settings` and `sso_settings` if not set.
diff --git a/changes/11525-bug-software-table-device-page b/changes/11525-bug-software-table-device-page
deleted file mode 100644
index 184a8d2a70..0000000000
--- a/changes/11525-bug-software-table-device-page
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed bug with page navigation inside 'My Device' page.
diff --git a/changes/11674-observer_plus-on-multiple-teams b/changes/11674-observer_plus-on-multiple-teams
deleted file mode 100644
index ab11d06bad..0000000000
--- a/changes/11674-observer_plus-on-multiple-teams
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fix a bug in the users table where users that are observer+ for all of more than one team were
-  listed as "Various roles"
diff --git a/changes/11825-chromeos-to-dashboard b/changes/11825-chromeos-to-dashboard
deleted file mode 100644
index 99457f76be..0000000000
--- a/changes/11825-chromeos-to-dashboard
+++ /dev/null
@@ -1 +0,0 @@
-- Add ChromeOS features to the Dashboard page
diff --git a/changes/11826-chromeos-support-dashboard b/changes/11826-chromeos-support-dashboard
deleted file mode 100644
index e95891fa0a..0000000000
--- a/changes/11826-chromeos-support-dashboard
+++ /dev/null
@@ -1,3 +0,0 @@
-- Added built-in label for ChromeOS.
-- Fixed issue with `chrome_extensions` virtual table not returning a path value on `fleetd-chrome`,
-  which was breaking software ingestion.
diff --git a/changes/11828-chromeos-to-manage-hosts b/changes/11828-chromeos-to-manage-hosts
deleted file mode 100644
index 37533f30ed..0000000000
--- a/changes/11828-chromeos-to-manage-hosts
+++ /dev/null
@@ -1 +0,0 @@
-- Added features for ChromeOS support to the ManageHosts page
diff --git a/changes/11829-tailor-host-chromeos-responses b/changes/11829-tailor-host-chromeos-responses
deleted file mode 100644
index c5fbdf30d6..0000000000
--- a/changes/11829-tailor-host-chromeos-responses
+++ /dev/null
@@ -1,3 +0,0 @@
-- Changed `os_version` column reported from ChromeOS hosts from `Chrome OS` to `ChromeOS`
-- Changed ChromeOS host's computer name prefix from `ChromeOS` to `Chromebook`
-- Added query to fill in `device_mapping` from ChromeOS hosts.
diff --git a/changes/11830-chromeos-to-host-details-page b/changes/11830-chromeos-to-host-details-page
deleted file mode 100644
index 31957828a8..0000000000
--- a/changes/11830-chromeos-to-host-details-page
+++ /dev/null
@@ -1 +0,0 @@
-- Added UI features relating to Chromebooks to the Host Details page
diff --git a/changes/11836-allow-users-create-chromeos-policies b/changes/11836-allow-users-create-chromeos-policies
deleted file mode 100644
index 4b60eac155..0000000000
--- a/changes/11836-allow-users-create-chromeos-policies
+++ /dev/null
@@ -1 +0,0 @@
-Allow users to create policies that target ChromeOS
diff --git a/changes/11856-live-query-results-performance b/changes/11856-live-query-results-performance
deleted file mode 100644
index d570a7c5b0..0000000000
--- a/changes/11856-live-query-results-performance
+++ /dev/null
@@ -1,2 +0,0 @@
-- Improved the performance of live query results rendering to address usability issues when querying
-  tens of thousands of hosts.
diff --git a/changes/11885-fix-bulk-delete-hosts b/changes/11885-fix-bulk-delete-hosts
deleted file mode 100644
index d4a53fc711..0000000000
--- a/changes/11885-fix-bulk-delete-hosts
+++ /dev/null
@@ -1 +0,0 @@
-Users can delete multiple pages of hosts
\ No newline at end of file
diff --git a/changes/11993-sandbox-add-hosts-modal b/changes/11993-sandbox-add-hosts-modal
deleted file mode 100644
index 6644444c43..0000000000
--- a/changes/11993-sandbox-add-hosts-modal
+++ /dev/null
@@ -1 +0,0 @@
-- Fix a styling bug in the add hosts modal in sandbox mode
diff --git a/changes/12065-sandbox-styling-improvements b/changes/12065-sandbox-styling-improvements
deleted file mode 100644
index 73e959d06d..0000000000
--- a/changes/12065-sandbox-styling-improvements
+++ /dev/null
@@ -1 +0,0 @@
-- Improvements to styling in Sandbox mode
diff --git a/changes/12106-mdm-server-url b/changes/12106-mdm-server-url
deleted file mode 100644
index 03c52a6fd7..0000000000
--- a/changes/12106-mdm-server-url
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed a bug that would show MDM URLs for the same server as different servers if they contain query parameters.
diff --git a/changes/12113-sso-status b/changes/12113-sso-status
deleted file mode 100644
index abd04e5927..0000000000
--- a/changes/12113-sso-status
+++ /dev/null
@@ -1 +0,0 @@
-* return a 4xx error if a SSO session is not found
diff --git a/changes/12177-go-version b/changes/12177-go-version
deleted file mode 100644
index 3fa126ad8d..0000000000
--- a/changes/12177-go-version
+++ /dev/null
@@ -1 +0,0 @@
-* Upgrade Go version to 1.19.10
diff --git a/changes/7601-deselect-label-filter b/changes/7601-deselect-label-filter
deleted file mode 100644
index 52bc095fbd..0000000000
--- a/changes/7601-deselect-label-filter
+++ /dev/null
@@ -1 +0,0 @@
-- Ability to deselect label filter on host table
diff --git a/changes/8962-update-icons b/changes/8962-update-icons
deleted file mode 100644
index 509061c962..0000000000
--- a/changes/8962-update-icons
+++ /dev/null
@@ -1 +0,0 @@
-- Cleaner icons
diff --git a/changes/bug-2939-obs-shouldnot-see-secrets b/changes/bug-2939-obs-shouldnot-see-secrets
deleted file mode 100644
index e40a64aab5..0000000000
--- a/changes/bug-2939-obs-shouldnot-see-secrets
+++ /dev/null
@@ -1 +0,0 @@
-- Users with Observer/Observer+ role should not be able to see team secrets.
diff --git a/changes/bug_spec_labels_api_not_including_ids b/changes/bug_spec_labels_api_not_including_ids
deleted file mode 100644
index 80bf4c9289..0000000000
--- a/changes/bug_spec_labels_api_not_including_ids
+++ /dev/null
@@ -1 +0,0 @@
-- GET /api/v1/fleet/spec/labels/{name} endpoint should include the label id
diff --git a/changes/bugfix-inherited-page-param b/changes/bugfix-inherited-page-param
deleted file mode 100644
index 2163b76548..0000000000
--- a/changes/bugfix-inherited-page-param
+++ /dev/null
@@ -1 +0,0 @@
-- Fixed UI bug where `inherited_page=0` was incorrectly added to some URLs
diff --git a/changes/issue-11002-add-mdm-macos-setup-end-user-auth-page b/changes/issue-11002-add-mdm-macos-setup-end-user-auth-page
deleted file mode 100644
index 70e31fe96a..0000000000
--- a/changes/issue-11002-add-mdm-macos-setup-end-user-auth-page
+++ /dev/null
@@ -1 +0,0 @@
-- add UI for the end user authentication page for mdm macos setup
diff --git a/changes/issue-11008-document-get-mdm-commands b/changes/issue-11008-document-get-mdm-commands
deleted file mode 100644
index e72e4d823f..0000000000
--- a/changes/issue-11008-document-get-mdm-commands
+++ /dev/null
@@ -1 +0,0 @@
-* Added documentation in the guide for `fleetctl get mdm-commands`.
diff --git a/changes/issue-11238-add-verified-to-UI-for-profile-status b/changes/issue-11238-add-verified-to-UI-for-profile-status
deleted file mode 100644
index c9764760e5..0000000000
--- a/changes/issue-11238-add-verified-to-UI-for-profile-status
+++ /dev/null
@@ -1 +0,0 @@
-- add "verified" profile status to fleet UI
diff --git a/changes/issue-11239-backend-mdm-verified b/changes/issue-11239-backend-mdm-verified
deleted file mode 100644
index 774c6e3c89..0000000000
--- a/changes/issue-11239-backend-mdm-verified
+++ /dev/null
@@ -1 +0,0 @@
-- Added new host detail query to verify MDM profiles and updated API to include verified status.
diff --git a/changes/issue-11280-list-mdm-config-profiles b/changes/issue-11280-list-mdm-config-profiles
deleted file mode 100644
index 9905183cf7..0000000000
--- a/changes/issue-11280-list-mdm-config-profiles
+++ /dev/null
@@ -1 +0,0 @@
-- Updated `GET /mdm/apple/profiles` endpoint to return empty array instead of null if no profiles are found.
diff --git a/changes/issue-11376-add-better-error-for-manual-modal b/changes/issue-11376-add-better-error-for-manual-modal
deleted file mode 100644
index cb0fc26e8a..0000000000
--- a/changes/issue-11376-add-better-error-for-manual-modal
+++ /dev/null
@@ -1 +0,0 @@
-- add better UI error for manual enroll mdm modal
diff --git a/changes/issue-11416-return-400-for-auth-error b/changes/issue-11416-return-400-for-auth-error
deleted file mode 100644
index 32610498f9..0000000000
--- a/changes/issue-11416-return-400-for-auth-error
+++ /dev/null
@@ -1 +0,0 @@
-* Updated the `/api/latest/fleet/mdm/apple_bm` to return 400 instead of 500 when it fails to authenticate with Apple's Business Manager API, as this indicates a Fleet configuration issue with the Apple BM certificate or token.
diff --git a/changes/issue-11449-allow-gitops-apply-mdm-features b/changes/issue-11449-allow-gitops-apply-mdm-features
deleted file mode 100644
index 90d7c6d602..0000000000
--- a/changes/issue-11449-allow-gitops-apply-mdm-features
+++ /dev/null
@@ -1,2 +0,0 @@
-* Fixed an issue preventing a user with the `gitops` role to apply some MDM settings via `fleetctl apply` (the `macos_setup_assistant` and `bootstrap_package` settings)
-* Added a response payload to the `POST /api/latest/fleet/spec/teams` contributor API endpoint, it now returns an object with a `team_ids_by_name` key which maps team names with their corresponding id.
diff --git a/changes/issue-11617-action-required-ui b/changes/issue-11617-action-required-ui
deleted file mode 100644
index 8eddb96345..0000000000
--- a/changes/issue-11617-action-required-ui
+++ /dev/null
@@ -1 +0,0 @@
-- Added "Action required" status for disk encryption profile in UI for host details and device user pages
\ No newline at end of file
diff --git a/changes/issue-11690-post-dep-enrollment-worker b/changes/issue-11690-post-dep-enrollment-worker
deleted file mode 100644
index ad90de7cc9..0000000000
--- a/changes/issue-11690-post-dep-enrollment-worker
+++ /dev/null
@@ -1 +0,0 @@
-* Moved post-DEP (automatic) MDM enrollment to a worker job for increased resiliency with retries.
diff --git a/changes/issue-11763-fix-misaligned-icons b/changes/issue-11763-fix-misaligned-icons
deleted file mode 100644
index c3df3d250d..0000000000
--- a/changes/issue-11763-fix-misaligned-icons
+++ /dev/null
@@ -1 +0,0 @@
-- fix misaligned icons in UI
diff --git a/changes/issue-11773-activity-styling-fix b/changes/issue-11773-activity-styling-fix
deleted file mode 100644
index 6a035d2c8f..0000000000
--- a/changes/issue-11773-activity-styling-fix
+++ /dev/null
@@ -1 +0,0 @@
-- Clean up dashed line styling on multiline activities
diff --git a/changes/issue-11827-chromeos-add-hosts b/changes/issue-11827-chromeos-add-hosts
deleted file mode 100644
index 434a0ac11f..0000000000
--- a/changes/issue-11827-chromeos-add-hosts
+++ /dev/null
@@ -1 +0,0 @@
-- Inform users how to add ChromeOS hosts
diff --git a/changes/issue-11960-fix-jumpy-tabs b/changes/issue-11960-fix-jumpy-tabs
deleted file mode 100644
index 25e0748677..0000000000
--- a/changes/issue-11960-fix-jumpy-tabs
+++ /dev/null
@@ -1 +0,0 @@
-- Fix jump tabs caused by new font
diff --git a/changes/issue-12019-add-preassign-profiles b/changes/issue-12019-add-preassign-profiles
deleted file mode 100644
index 981158cb73..0000000000
--- a/changes/issue-12019-add-preassign-profiles
+++ /dev/null
@@ -1,2 +0,0 @@
-* Added the `POST /fleet/mdm/apple/profiles/preassign` endpoint to store profiles to be assigned to a host, for subsequent matching with an existing (or new) team.
-* Added the `POST /fleet/mdm/apple/profiles/match` endpoint to match pre-assigned profiles to an existing team or create one if needed, and assign the host to that team.
diff --git a/changes/issue-12058-fix-apply-teams b/changes/issue-12058-fix-apply-teams
deleted file mode 100644
index 5330a72e0d..0000000000
--- a/changes/issue-12058-fix-apply-teams
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed a bug with applying team specs via `fleetctl apply` and updating a team via the `PATCH /api/latest/fleet/mdm/teams/{id}` endpoint so that the MDM updates settings (`minimum_version` and `deadline`) are not cleared if not provided in the payload.
diff --git a/changes/issue-12128-fleetctl-get-mdm-command-results-alignment b/changes/issue-12128-fleetctl-get-mdm-command-results-alignment
deleted file mode 100644
index f23e9a047b..0000000000
--- a/changes/issue-12128-fleetctl-get-mdm-command-results-alignment
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed the table formatting for the output of `fleetctl get mdm-command-results`.
diff --git a/changes/mdm-migration-issues b/changes/mdm-migration-issues
deleted file mode 100644
index 55be31d8e9..0000000000
--- a/changes/mdm-migration-issues
+++ /dev/null
@@ -1,3 +0,0 @@
-* Fixed issues with the MDM migration flow that caused:
- - Prompt not showing up if the device belongs to a team.
- - Prompt showing up if the device is DEP capable, but manually enrolled into Fleet.
diff --git a/changes/security-patch b/changes/security-patch
deleted file mode 100644
index 0272266313..0000000000
--- a/changes/security-patch
+++ /dev/null
@@ -1 +0,0 @@
-* Patched a potential security issue
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index 68716fe487..e3daf42b95 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -8,4 +8,4 @@ version: v5.0.1
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.32.0
+appVersion: v4.33.0
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index afce40ee4d..cb4cfc58ee 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -2,7 +2,7 @@
 # All settings related to how Fleet is deployed in Kubernetes
 hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
-imageTag: v4.32.0 # Version of Fleet to deploy
+imageTag: v4.33.0 # Version of Fleet to deploy
 podAnnotations: {} # Additional annotations to add to the Fleet pod
 serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
 resources:
diff --git a/infrastructure/dogfood/terraform/aws/variables.tf b/infrastructure/dogfood/terraform/aws/variables.tf
index a12a2b849d..d39ace6762 100644
--- a/infrastructure/dogfood/terraform/aws/variables.tf
+++ b/infrastructure/dogfood/terraform/aws/variables.tf
@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.32.0"
+  default     = "fleetdm/fleet:v4.33.0"
 }
 
 variable "software_inventory" {
diff --git a/infrastructure/dogfood/terraform/gcp/variables.tf b/infrastructure/dogfood/terraform/gcp/variables.tf
index 01a09694c6..ae75bc33bd 100644
--- a/infrastructure/dogfood/terraform/gcp/variables.tf
+++ b/infrastructure/dogfood/terraform/gcp/variables.tf
@@ -68,5 +68,5 @@ variable "redis_mem" {
 }
 
 variable "image" {
-  default = "fleet:v4.32.0"
+  default = "fleet:v4.33.0"
 }
diff --git a/infrastructure/sandbox/JITProvisioner/jitprovisioner.tf b/infrastructure/sandbox/JITProvisioner/jitprovisioner.tf
index 21817b6343..6e33e2afa7 100644
--- a/infrastructure/sandbox/JITProvisioner/jitprovisioner.tf
+++ b/infrastructure/sandbox/JITProvisioner/jitprovisioner.tf
@@ -206,7 +206,7 @@ resource "random_uuid" "jitprovisioner" {
 
 # Use the local to make the trigger work.
 locals {
-  fleet_tag = "v4.32.0"
+  fleet_tag = "v4.33.0"
 }
 
 resource "null_resource" "standard-query-library" {
diff --git a/infrastructure/sandbox/PreProvisioner/lambda/deploy_terraform/main.tf b/infrastructure/sandbox/PreProvisioner/lambda/deploy_terraform/main.tf
index 0ac98f1786..796ab5a4d3 100644
--- a/infrastructure/sandbox/PreProvisioner/lambda/deploy_terraform/main.tf
+++ b/infrastructure/sandbox/PreProvisioner/lambda/deploy_terraform/main.tf
@@ -165,7 +165,7 @@ resource "helm_release" "main" {
 
   set {
     name  = "imageTag"
-    value = "v4.32.0"
+    value = "v4.33.0"
   }
 
   set {
diff --git a/tools/fleetctl-npm/package.json b/tools/fleetctl-npm/package.json
index 01ec1b69da..cb069c6372 100644
--- a/tools/fleetctl-npm/package.json
+++ b/tools/fleetctl-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.32.0",
+  "version": "v4.33.0",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"