diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a98da53..c905a19a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ### Changes
 
-- Align with upstream chart commit [16f5a1d](https://github.com/Kong/charts/tree/16f5a1dba7c7afb73369d65221a4fb78400ca4ec) ([Changes in upstream repository](https://github.com/Kong/charts/compare/kong-2.29.0...16f5a1d))
+- Align with upstream chart version [2.33.0](https://github.com/Kong/charts/releases/tag/kong-2.33.0) ([Changes in upstream repository](https://github.com/Kong/charts/compare/kong-2.29.0...kong-2.33.0))
 - Update kong to [3.5.0](https://github.com/Kong/kong/blob/3.5.0/changelog/3.5.0/3.5.0.md)
 - Update kong ingress controller to [3.0.1](https://github.com/Kong/kubernetes-ingress-controller/blob/main/CHANGELOG.md#301)
 - Execute enterprise tests with kong-gateway container image version [3.5.0.1-debian](https://docs.konghq.com/gateway/changelog/#3501)
diff --git a/README.md b/README.md
index 87e9c84d..48937a86 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ Giant Swarm offers a Kong Managed App which can be installed in workload cluster
 
 | Giant Swarm Chart Release | Upstream Chart Release | Kong Version | Kong IC Version | Kong-Gateway Enterprise container tag |
 | --- | --- | --- | --- | --- |
-| Unreleased | [16f5a1d](https://github.com/Kong/charts/compare/kong-2.29.0...16f5a1d) | [3.5.0](https://github.com/Kong/kong/blob/3.5.0/changelog/3.5.0/3.5.0.md) | [3.0.1](https://github.com/Kong/kubernetes-ingress-controller/blob/main/CHANGELOG.md#301) | 3.5.0.1-debian |
+| Unreleased | [2.33.0](https://github.com/Kong/charts/blob/main/charts/kong/CHANGELOG.md#2330) | [3.5.0](https://github.com/Kong/kong/blob/3.5.0/changelog/3.5.0/3.5.0.md) | [3.0.1](https://github.com/Kong/kubernetes-ingress-controller/blob/main/CHANGELOG.md#301) | 3.5.0.1-debian |
 | [v3.5.0](https://github.com/giantswarm/kong-app/blob/main/CHANGELOG.md#350---2023-10-16) | [2.29.0](https://github.com/Kong/charts/blob/main/charts/kong/CHANGELOG.md#2290) | [3.4.2](https://github.com/Kong/kong/blob/3.4.2/CHANGELOG.md#342) | [2.12.0](https://github.com/Kong/kubernetes-ingress-controller/blob/main/CHANGELOG.md#2111) | 3.4.1.1-debian |
 | [v3.4.0](https://github.com/giantswarm/kong-app/blob/main/CHANGELOG.md#340---2023-08-22) | [2.23.0](https://github.com/Kong/charts/blob/main/charts/kong/CHANGELOG.md#2230) | [3.3.1](https://github.com/Kong/kong/blob/3.3.1/CHANGELOG.md#331) | [2.10.4](https://github.com/Kong/kubernetes-ingress-controller/blob/v2.10.4/CHANGELOG.md#2103) | 3.3.1.0-debian |
 | [v3.3.0](https://github.com/giantswarm/kong-app/blob/main/CHANGELOG.md#330---2023-05-17) | [2.21.0](https://github.com/Kong/charts/blob/main/charts/kong/CHANGELOG.md#2210) | [3.2.2](https://github.com/Kong/kong/blob/3.2.2/CHANGELOG.md#322) | [2.9.3](https://github.com/Kong/kubernetes-ingress-controller/blob/v2.9.3/CHANGELOG.md#293) | 3.2.2.1-debian |
diff --git a/helm/kong-app/CHANGELOG.md b/helm/kong-app/CHANGELOG.md
index e204fd48..a4df9770 100644
--- a/helm/kong-app/CHANGELOG.md
+++ b/helm/kong-app/CHANGELOG.md
@@ -1,9 +1,12 @@
 # Changelog
 
-## Unreleased
+## 2.33.0
 
 ### Improvements
 
+* Only allow `None` ClusterIPs on ClusterIP-type Services.
+  [#961](https://github.com/Kong/charts/pull/961)
+  [#962](https://github.com/Kong/charts/pull/962)
 * Bumped Kong version to 3.5.
   [#957](https://github.com/Kong/charts/pull/957)
 * Support for `affinity` configuration has been added to migration job templates.
@@ -11,6 +14,9 @@
 * Validate Gateway API's `Gateway` and `HTTPRoute` resources in the controller's
   admission webhook only when KIC version is 3.0 or higher.
   [#954](https://github.com/Kong/charts/pull/954)
+* Added controller's RBAC rules for `KongServiceFacade` CRD (installed only when
+  KongServiceFacade feature gate turned on and KIC version >= 3.1.0).
+  [#963](https://github.com/Kong/charts/pull/963)
 
 ## 2.32.0
 
diff --git a/helm/kong-app/templates/_helpers.tpl b/helm/kong-app/templates/_helpers.tpl
index bd2f83d5..5ff57d67 100644
--- a/helm/kong-app/templates/_helpers.tpl
+++ b/helm/kong-app/templates/_helpers.tpl
@@ -252,8 +252,10 @@ spec:
   externalTrafficPolicy: {{ .externalTrafficPolicy }}
   {{- end }}
   {{- if .clusterIP }}
+  {{- if (or (not (eq .clusterIP "None")) (and (eq .type "ClusterIP") (eq .clusterIP "None"))) }}
   clusterIP: {{ .clusterIP }}
   {{- end }}
+  {{- end }}
   selector:
     {{- .selectorLabels | nindent 4 }}
 {{- end -}}
@@ -1261,6 +1263,25 @@ role sets used in the charts. Updating these requires separating out cluster
 resource roles into their separate templates.
 */}}
 {{- define "kong.kubernetesRBACRules" -}}
+{{- if and (semverCompare ">= 3.1.0" (include "kong.effectiveVersion" .Values.ingressController.image))
+           (contains (print .Values.ingressController.env.feature_gates) "KongServiceFacade=true") }}
+- apiGroups:
+  - incubator.konghq.com
+  resources:
+  - kongservicefacades
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - incubator.konghq.com
+  resources:
+  - kongservicefacades/status
+  verbs:
+  - get
+  - patch
+  - update
+{{- end }}
 {{- if (semverCompare ">= 3.0.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
 - apiGroups:
   - configuration.konghq.com
diff --git a/vendir.lock.yml b/vendir.lock.yml
index 01ab85f2..c1c69f6c 100644
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -2,10 +2,10 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - git:
-      commitTitle: Fix affinity template in migrations jobs
-      sha: 1fbdeadd588ed1c9be777b64539c1b8196770389
+      commitTitle: Merge branch 'upstream-main'
+      sha: 1b5d16d55b1ed63f34eb8330c13b4a050d745989
       tags:
-      - kong-2.32.0-71-g1fbdead
+      - kong-2.33.0-71-g1b5d16d
     path: kong
   path: vendor
 - contents: