When building a CAPI image for v1.33.4, it ends up building the image using v1.33.7 (upstream) instead. This can be confusing if the image name has a different version to the one that the image builder builds for CAPI.
There is a chance unattended upgrades are upgrading the version of kubernetes being installed from the version we try to set.