diff --git a/mise-tasks/indri-services-check b/mise-tasks/indri-services-check
index 919bb12..73b52b2 100755
--- a/mise-tasks/indri-services-check
+++ b/mise-tasks/indri-services-check
@@ -75,6 +75,12 @@ check_service "PostgreSQL" "ssh indri '/opt/homebrew/opt/postgresql@18/bin/pg_is
 check_http "Zot Registry" "https://registry.tail8d86e.ts.net/v2/_catalog"
 check_service "Zot metrics file" "ssh indri 'test -f /opt/homebrew/var/node_exporter/textfile/zot.prom'"
 
+echo ""
+echo "Kubernetes cluster:"
+check_service "minikube" "ssh indri 'minikube status --format={{.Host}} | grep -q Running'"
+check_service "k8s-apiserver (indri)" "ssh indri 'kubectl get --raw /healthz'"
+check_service "k8s-apiserver (remote)" "kubectl --kubeconfig=$HOME/.kube/minikube-indri/config.yml --context=minikube-indri get --raw /healthz"
+
 echo ""
 if [ $FAILED -eq 0 ]; then
     echo -e "${GREEN}All services healthy!${NC}"
diff --git a/plans/k8s-migration.md b/plans/k8s-migration.md
index c1b53aa..3e7b9c6 100644
--- a/plans/k8s-migration.md
+++ b/plans/k8s-migration.md
@@ -742,6 +742,10 @@ mise run indri-services-check
 # k8s-apiserver...     OK
 ```
 
+**Implementation Notes:**
+- Added a third check `k8s-apiserver (remote)` that verifies kubectl access from gilbert, not just via SSH to indri. This ensures the 1Password credential flow and remote API server access are working.
+- The remote check uses both `--kubeconfig` and `--context` flags explicitly since the script runs in bash (not fish) and doesn't inherit the KUBECONFIG environment variable from fish config.
+
 ---
 
 ### Step 0.12: Create Zettelkasten Documentation