diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index af56988..7f50b46 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -21,6 +21,23 @@ jobs:
       - name: Install k3d
         run: curl -sfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
 
+      - name: Install kubectl
+        shell: bash
+        run: |
+          set -euo pipefail
+          kubectl_version=v1.35.5
+          temp_dir="$(mktemp -d)"
+          trap 'rm -rf "$temp_dir"' EXIT
+          curl --fail --location --retry 3 \
+            --output "$temp_dir/kubectl" \
+            "https://dl.k8s.io/release/${kubectl_version}/bin/linux/amd64/kubectl"
+          curl --fail --location --retry 3 \
+            --output "$temp_dir/kubectl.sha256" \
+            "https://dl.k8s.io/release/${kubectl_version}/bin/linux/amd64/kubectl.sha256"
+          printf '%s  %s\n' "$(cat "$temp_dir/kubectl.sha256")" "$temp_dir/kubectl" | sha256sum --check --strict -
+          install -m 0755 "$temp_dir/kubectl" /usr/local/bin/kubectl
+          kubectl version --client
+
       - name: Create ephemeral K3s cluster
         run: |
           k3d cluster create --config ci/k3d-ci-cluster-config.yaml