diff --git a/infra/docker/Dockerfile.ci-builder-cpu b/infra/docker/Dockerfile.ci-builder-cpu
index 53c2f1174..07b39969e 100644
--- a/infra/docker/Dockerfile.ci-builder-cpu
+++ b/infra/docker/Dockerfile.ci-builder-cpu
@@ -1,6 +1,6 @@
 # CUDA-free CI builder image for Foxhunt service compilation
 # ~2-3GB vs ~8GB for the CUDA devel variant (Dockerfile.ci-builder)
-# Contains: Rust 1.89, protoc, sccache, rclone, OpenTofu, Terragrunt, git, OpenSSL, clang, mold, lld, make
+# Contains: Rust 1.89, protoc, sccache, rclone, OpenTofu, Terragrunt, kubectl, git, OpenSSL, clang, mold, lld, make
 # Base: Ubuntu 24.04 (glibc 2.39) — matches local dev and training runtime
 # Build: docker build -f infra/docker/Dockerfile.ci-builder-cpu -t foxhunt-ci-builder-cpu .
 # Push:  docker tag foxhunt-ci-builder-cpu gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ci-builder-cpu:latest
@@ -67,5 +67,9 @@ RUN curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v0.7
     && echo "7f6592fc7faa55b75d7a50ac6a485c48be502486ea61680836f19677b6e8e1b9  /usr/local/bin/terragrunt" | sha256sum -c - \
     && chmod +x /usr/local/bin/terragrunt
 
+# kubectl 1.31.4 (CI deploy + argo template self-apply)
+RUN curl -fsSL "https://dl.k8s.io/release/v1.31.4/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl \
+    && chmod +x /usr/local/bin/kubectl
+
 # Verify
-RUN rustc --version && cargo --version && git --version && protoc --version && sccache --version && make --version && mold --version && rclone --version && tofu --version && terragrunt --version
+RUN rustc --version && cargo --version && git --version && protoc --version && sccache --version && make --version && mold --version && rclone --version && tofu --version && terragrunt --version && kubectl version --client
diff --git a/infra/k8s/argo/ci-pipeline-template.yaml b/infra/k8s/argo/ci-pipeline-template.yaml
index 689dba3ba..e33f2ba5b 100644
--- a/infra/k8s/argo/ci-pipeline-template.yaml
+++ b/infra/k8s/argo/ci-pipeline-template.yaml
@@ -1192,7 +1192,7 @@ spec:
         k8s.scaleway.com/pool-name: platform
       serviceAccountName: argo-workflow
       container:
-        image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/foxhunt-runtime:latest
+        image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ci-builder-cpu:latest
         command: ["/bin/sh", "-c"]
         resources:
           requests: