diff --git a/master_node_install.sh b/master_node_install.sh
index 088ee34..9fafd0f 100644
--- a/master_node_install.sh
+++ b/master_node_install.sh
@@ -20,6 +20,10 @@ JOIN_COMMAND_FILE="/root/kubeadm-join-command.sh"
 INSTALL_HELM="${INSTALL_HELM:-true}"
 INSTALL_RANCHER="${INSTALL_RANCHER:-true}"
 
+# Rancher currently rejects Kubernetes 1.35.x in your setup.
+# This guard prevents the script from failing deep into the Rancher install step.
+RANCHER_MAX_SUPPORTED_K8S_MINOR="${RANCHER_MAX_SUPPORTED_K8S_MINOR:-34}"
+
 # Single-node/lab convenience:
 # Rancher, ingress-nginx, cert-manager, CoreDNS, etc. need schedulable capacity.
 # On a single control-plane node, removing the control-plane taint is the simplest way.
@@ -100,6 +104,30 @@ kubectl_ns_apply() {
   kubectl create namespace "${ns}" --dry-run=client -o yaml | kubectl apply -f -
 }
 
+k8s_major_minor() {
+  kubeadm version -o short 2>/dev/null | sed -E 's/^v([0-9]+)\.([0-9]+).*/\1 \2/'
+}
+
+is_rancher_k8s_supported() {
+  local version_parts
+  version_parts="$(k8s_major_minor)"
+  local major minor
+  major="$(awk '{print $1}' <<<"${version_parts}")"
+  minor="$(awk '{print $2}' <<<"${version_parts}")"
+
+  [[ -n "${major}" && -n "${minor}" ]] || return 1
+
+  if (( major > 1 )); then
+    return 1
+  fi
+
+  if (( minor > RANCHER_MAX_SUPPORTED_K8S_MINOR )); then
+    return 1
+  fi
+
+  return 0
+}
+
 # ---------- Root check ----------
 if [[ "${EUID}" -ne 0 ]]; then
   die "Run this script as root, for example: sudo ./master_node_install.sh"
@@ -293,7 +321,18 @@ fi
 echo "${RANCHER_BOOTSTRAP_PASSWORD}" >/root/rancher-bootstrap-password.txt
 chmod 600 /root/rancher-bootstrap-password.txt
 
-# ---------- Step 21: Install Helm repos ----------
+# ---------- Step 21: Kubernetes compatibility guard for Rancher ----------
+if [[ "${INSTALL_RANCHER}" == "true" ]]; then
+  log "Checking Kubernetes version compatibility for Rancher"
+
+  INSTALLED_K8S_VERSION="$(kubeadm version -o short 2>/dev/null || true)"
+  if ! is_rancher_k8s_supported; then
+    warn "Installed Kubernetes version is ${INSTALLED_K8S_VERSION}"
+    die "Rancher install is blocked because this script is configured to allow Kubernetes up to 1.${RANCHER_MAX_SUPPORTED_K8S_MINOR}.x only. Downgrade/pin kubeadm, kubectl, and kubelet to a supported version, then rerun."
+  fi
+fi
+
+# ---------- Step 22: Install Helm repos ----------
 if [[ "${INSTALL_HELM}" == "true" ]]; then
   log "Configuring Helm repositories"
   helm_repo_add_force ingress-nginx https://kubernetes.github.io/ingress-nginx
@@ -320,7 +359,7 @@ if [[ "${INSTALL_HELM}" == "true" ]]; then
   helm repo update
 fi
 
-# ---------- Step 22: Install ingress-nginx ----------
+# ---------- Step 23: Install ingress-nginx ----------
 if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   log "Installing ingress-nginx"
 
@@ -345,7 +384,7 @@ if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   kubectl -n "${INGRESS_NAMESPACE}" rollout status daemonset/ingress-nginx-controller --timeout=15m
 fi
 
-# ---------- Step 23: Install cert-manager ----------
+# ---------- Step 24: Install cert-manager ----------
 if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   log "Installing cert-manager"
 
@@ -364,7 +403,7 @@ if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   kubectl -n "${CERT_MANAGER_NAMESPACE}" rollout status deployment/cert-manager-webhook --timeout=15m
 fi
 
-# ---------- Step 24: Install Rancher ----------
+# ---------- Step 25: Install Rancher ----------
 if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   log "Installing Rancher"
 
@@ -384,7 +423,7 @@ if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   kubectl -n "${RANCHER_NAMESPACE}" rollout status deployment/rancher --timeout=20m || true
 fi
 
-# ---------- Step 25: Show cluster status ----------
+# ---------- Step 26: Show cluster status ----------
 log "Cluster status"
 kubectl get nodes -o wide || true
 echo
@@ -420,7 +459,6 @@ if [[ "${INSTALL_RANCHER}" == "true" ]]; then
   echo "  sudo cat /root/rancher-bootstrap-password.txt"
   echo
   echo "Notes:"
-  echo "  - sslip.io is used automatically when RANCHER_HOSTNAME is not set."
   echo "  - Because ingress-nginx is using host networking, access Rancher directly on this node's IP over 443."
   echo "  - If a local firewall is enabled, ensure ports 80 and 443 are allowed."
   echo