diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index ddee1c8..137cffe 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -54,6 +54,7 @@ jobs:
           jq --version
 
       - name: Create ephemeral K3s cluster
+        shell: bash
         run: |
           k3d cluster delete security-baseline-ci >/dev/null 2>&1 || true
           k3d cluster create --config ci/k3d-ci-cluster-config.yaml
@@ -76,6 +77,16 @@ jobs:
           fi
           sed -i -E "s#https://0\.0\.0\.0:#https://${api_host}:#" "$HOME/.kube/config"
           kubectl config set-cluster k3d-security-baseline-ci --tls-server-name 0.0.0.0 >/dev/null
+          for ((attempt = 1; attempt <= 90; attempt++)); do
+            if kubectl get --raw='/readyz' >/dev/null 2>&1; then
+              break
+            fi
+            if [[ "$attempt" -eq 90 ]]; then
+              kubectl get --raw='/readyz'
+              exit 1
+            fi
+            sleep 2
+          done
           kubectl wait --for=condition=Ready nodes --all --timeout=180s
           kubectl get nodes -o wide