diff --git a/cmd/k8s-operator/deploy/chart/templates/.gitignore b/cmd/k8s-operator/deploy/chart/templates/.gitignore
new file mode 100644
index 000000000..ae7c682d9
--- /dev/null
+++ b/cmd/k8s-operator/deploy/chart/templates/.gitignore
@@ -0,0 +1,10 @@
+# Don't add helm chart CRDs to git. Canonical CRD files live in
+# cmd/k8s-operator/deploy/crds.
+#
+# Generate for local usage with:
+# go run tailscale.com/cmd/k8s-operator/generate helmcrd
+/connector.yaml
+/dnsconfig.yaml
+/proxyclass.yaml
+/proxygroup.yaml
+/recorder.yaml
diff --git a/cmd/k8s-operator/generate/main.go b/cmd/k8s-operator/generate/main.go
index 25435a47c..6904f1df0 100644
--- a/cmd/k8s-operator/generate/main.go
+++ b/cmd/k8s-operator/generate/main.go
@@ -41,11 +41,16 @@ func main() {
 	if len(os.Args) < 2 {
 		log.Fatalf("usage ./generate [staticmanifests|helmcrd]")
 	}
-	repoRoot := "../../"
+	gitOut, err := exec.Command("git", "rev-parse", "--show-toplevel").CombinedOutput()
+	if err != nil {
+		log.Fatalf("error determining git root: %v: %s", err, gitOut)
+	}
+
+	repoRoot := strings.TrimSpace(string(gitOut))
 	switch os.Args[1] {
 	case "helmcrd": // insert CRDs to Helm templates behind a installCRDs=true conditional check
 		log.Print("Adding CRDs to Helm templates")
-		if err := generate("./"); err != nil {
+		if err := generate(repoRoot); err != nil {
 			log.Fatalf("error adding CRDs to Helm templates: %v", err)
 		}
 		return
diff --git a/cmd/k8s-operator/operator.go b/cmd/k8s-operator/operator.go
index 1d988eb03..89c8ff3e2 100644
--- a/cmd/k8s-operator/operator.go
+++ b/cmd/k8s-operator/operator.go
@@ -67,6 +67,9 @@ import (
 // Generate static manifests for deploying Tailscale operator on Kubernetes from the operator's Helm chart.
 //go:generate go run tailscale.com/cmd/k8s-operator/generate staticmanifests
 
+// Generate the helm chart's CRDs (which are ignored from git).
+//go:generate go run tailscale.com/cmd/k8s-operator/generate helmcrd
+
 // Generate CRD API docs.
 //go:generate go run github.com/elastic/crd-ref-docs --renderer=markdown --source-path=../../k8s-operator/apis/ --config=../../k8s-operator/api-docs-config.yaml --output-path=../../k8s-operator/api.md