diff --git a/.gitignore b/.gitignore
index 5c5e4e5642..48c889f0ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,9 @@ bin
 envfile
 .envrc
 
+# For Konflux
+!vendor/github.com/subosito/gotenv/.env
+
 # kubeconfigs
 kind.kubeconfig
 minikube.kubeconfig
diff --git a/Makefile b/Makefile
index 4fbd24a143..555af995aa 100644
--- a/Makefile
+++ b/Makefile
@@ -144,7 +144,7 @@ EKS_SOURCE_TEMPLATE ?= eks/cluster-template-eks-control-plane-only.yaml
 
 # set up `setup-envtest` to install kubebuilder dependency
 export KUBEBUILDER_ENVTEST_KUBERNETES_VERSION ?= 1.24.2
-SETUP_ENVTEST_VER := v0.0.0-20230131074648-f5014c077fc3
+SETUP_ENVTEST_VER := v0.0.0-20240813182054-0c7827e417ac
 SETUP_ENVTEST_BIN := setup-envtest
 SETUP_ENVTEST := $(abspath $(TOOLS_BIN_DIR)/$(SETUP_ENVTEST_BIN)-$(SETUP_ENVTEST_VER))
 SETUP_ENVTEST_PKG := sigs.k8s.io/controller-runtime/tools/setup-envtest
diff --git a/openshift/fetch_ext_bins.sh b/openshift/fetch_ext_bins.sh
deleted file mode 100755
index 4273c1621b..0000000000
--- a/openshift/fetch_ext_bins.sh
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2018 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# Enable tracing in this script off by setting the TRACE variable in your
-# environment to any value:
-#
-# $ TRACE=1 test.sh
-TRACE=${TRACE:-""}
-if [[ -n "${TRACE}" ]]; then
-  set -x
-fi
-
-k8s_version=1.24.1
-goarch=amd64
-goos="unknown"
-
-if [[ "${OSTYPE}" == "linux"* ]]; then
-  goos="linux"
-elif [[ "${OSTYPE}" == "darwin"* ]]; then
-  goos="darwin"
-fi
-
-if [[ "$goos" == "unknown" ]]; then
-  echo "OS '$OSTYPE' not supported. Aborting." >&2
-  exit 1
-fi
-
-# Turn colors in this script off by setting the NO_COLOR variable in your
-# environment to any value:
-#
-# $ NO_COLOR=1 test.sh
-NO_COLOR=${NO_COLOR:-""}
-if [[ -z "${NO_COLOR}" ]]; then
-  header=$'\e[1;33m'
-  reset=$'\e[0m'
-else
-  header=''
-  reset=''
-fi
-
-function header_text {
-  echo "$header$*$reset"
-}
-
-tmp_root=/tmp
-
-kb_root_dir=${tmp_root}/kubebuilder
-
-# Skip fetching and untaring the tools by setting the SKIP_FETCH_TOOLS variable
-# in your environment to any value:
-#
-# $ SKIP_FETCH_TOOLS=1 ./fetch_ext_bins.sh
-#
-# If you skip fetching tools, this script will use the tools already on your
-# machine, but rebuild the kubebuilder and kubebuilder-bin binaries.
-SKIP_FETCH_TOOLS=${SKIP_FETCH_TOOLS:-""}
-
-function prepare_staging_dir {
-  header_text "preparing staging dir"
-
-  if [[ -z "${SKIP_FETCH_TOOLS}" ]]; then
-    rm -rf "${kb_root_dir}"
-  else
-    rm -f "${kb_root_dir}/kubebuilder/bin/kubebuilder"
-    rm -f "${kb_root_dir}/kubebuilder/bin/kubebuilder-gen"
-    rm -f "${kb_root_dir}/kubebuilder/bin/vendor.tar.gz"
-  fi
-}
-
-# fetch k8s API gen tools and make it available under kb_root_dir/bin.
-function fetch_tools {
-  if [[ -n "$SKIP_FETCH_TOOLS" ]]; then
-    return 0
-  fi
-
-  header_text "fetching tools"
-  kb_tools_archive_name="kubebuilder-tools-${k8s_version}-${goos}-${goarch}.tar.gz"
-  kb_tools_download_url="https://storage.googleapis.com/kubebuilder-tools/${kb_tools_archive_name}"
-
-  kb_tools_archive_path="${tmp_root}/${kb_tools_archive_name}"
-  if [[ ! -f ${kb_tools_archive_path} ]]; then
-    echo ${kb_tools_download_url}
-    curl -fsL ${kb_tools_download_url} -o "${kb_tools_archive_path}"
-
-  fi
-  tar -zvxf "${kb_tools_archive_path}" -C "${tmp_root}/"
-}
-
-function setup_envs {
-  header_text "setting up env vars"
-
-  # Setup env vars
-  export PATH=/tmp/kubebuilder/bin:$PATH
-  export TEST_ASSET_KUBECTL=/tmp/kubebuilder/bin/kubectl
-  export TEST_ASSET_KUBE_APISERVER=/tmp/kubebuilder/bin/kube-apiserver
-  export TEST_ASSET_ETCD=/tmp/kubebuilder/bin/etcd
-}
diff --git a/openshift/unit-tests.sh b/openshift/unit-tests.sh
index cdd34fe6c5..7149caa131 100755
--- a/openshift/unit-tests.sh
+++ b/openshift/unit-tests.sh
@@ -1,26 +1,25 @@
 #!/bin/bash
 
 set -o errexit
+set -o nounset
 set -o pipefail
 
 echo "Running unit-tests.sh"
 
-# Ensure that some home var is set and that it's not the root
+# Ensure that some home var is set and that it's not the root.
 export HOME=${HOME:=/tmp/kubebuilder/testing}
-if [ $HOME == "/" ]; then
+if [ "$HOME" == "/" ]; then
   export HOME=/tmp/kubebuilder/testing
 fi
 
-export GOFLAGS='-mod=readonly'
+REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+# shellcheck source=../hack/ensure-go.sh
+source "${REPO_ROOT}/hack/ensure-go.sh"
 
-source ./openshift/fetch_ext_bins.sh
-fetch_tools
-setup_envs
+# Override vendoring: the upstream repo does not vendor, but the OpenShift fork
+# does. Tests depend on non-Go assets (e.g. CRD YAMLs) from the module cache
+# that are not present in the vendor directory.
+unset GOFLAGS
+export GOFLAGS=-mod=mod
 
-go test ./api/...
-go test ./bootstrap/...
-go test ./cmd/...
-go test ./controllers/...
-go test ./controlplane/...
-go test ./exp/...
-go test ./pkg/...
+cd "${REPO_ROOT}" && make test-verbose
diff --git a/util/system/util.go b/util/system/util.go
index 786150950d..70b0b4f581 100644
--- a/util/system/util.go
+++ b/util/system/util.go
@@ -30,10 +30,11 @@ const (
 	namespaceEnvVarName = "POD_NAMESPACE"
 	// defaultNamespace is the default value from manifest.
 	defaultNamespace = "capa-system"
-	// inClusterNamespacePath is the file the default namespace to be used for namespaced API operations is placed at.
-	inClusterNamespacePath = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
 )
 
+// inClusterNamespacePath is the file the default namespace to be used for namespaced API operations is placed at.
+var inClusterNamespacePath = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
+
 // GetManagerNamespace return the namespace where the controller is running.
 func GetManagerNamespace() string {
 	ns, err := GetNamespaceFromFile(inClusterNamespacePath)
diff --git a/util/system/util_test.go b/util/system/util_test.go
index 78f60395df..1a0ac02436 100644
--- a/util/system/util_test.go
+++ b/util/system/util_test.go
@@ -25,6 +25,12 @@ import (
 )
 
 func TestGetManagerNamespace(t *testing.T) {
+	// Override inClusterNamespacePath so the test exercises the env var
+	// fallback even when running inside a pod (e.g. OpenShift CI).
+	origPath := inClusterNamespacePath
+	inClusterNamespacePath = "/nonexistent"
+	t.Cleanup(func() { inClusterNamespacePath = origPath })
+
 	cases := []struct {
 		Name      string
 		runBefore func()
diff --git a/vendor/github.com/subosito/gotenv/.env b/vendor/github.com/subosito/gotenv/.env
new file mode 100644
index 0000000000..6405eca71f
--- /dev/null
+++ b/vendor/github.com/subosito/gotenv/.env
@@ -0,0 +1 @@
+HELLO=world