diff --git a/Makefile b/Makefile
index bede3ff..a447be2 100644
--- a/Makefile
+++ b/Makefile
@@ -133,6 +133,9 @@ $(FETCH_DIR)/talosctl:
 $(FETCH_DIR)/kubectl:
 	$(call git_clone,$@,$(KUBECTL_REPO),$(KUBECTL_REF))
 
+$(FETCH_DIR)/kustomize:
+	$(call git_clone,$@,$(KUSTOMIZE_REPO),$(KUSTOMIZE_REF))
+
 $(FETCH_DIR)/go/bin/go: $(FETCH_DIR)/go
 	$(call toolchain," \
 		cd $(FETCH_DIR)/go/src && \
@@ -192,6 +195,19 @@ $(OUT_DIR)/kubectl: $(FETCH_DIR)/kubectl $(GO)
 			-o /home/build/$@ $(KUBECTL_PKG) \
 	")
 
+$(OUT_DIR)/kustomize: $(FETCH_DIR)/kustomize $(GO)
+	$(call toolchain," \
+		cd $(FETCH_DIR)/kustomize && \
+		export CGO_ENABLED=0 && \
+		export GOCACHE=/home/build/$(CACHE_DIR) && \
+		export GOPATH=/home/build/$(CACHE_DIR) && \
+		/home/build/$(GO) build \
+			-v \
+			-trimpath \
+			-ldflags='-w -extldflags=-static' \
+			-o /home/build/$@ $(KUSTOMIZE_PKG) \
+	")
+
 # Note: Decryption MUST reset the mod time to avoid encryption/decryption loops
 # Encrypt if:
 # - Both files exist, local is newer than remote
diff --git a/config/global.env b/config/global.env
index 5ec3054..31d148e 100644
--- a/config/global.env
+++ b/config/global.env
@@ -16,6 +16,7 @@ KSOPS_REF=b524c792a9ce0409dfec1aa9da42ea56ab85a16f
 KSOPS_REPO=https://github.com/viaduct-ai/kustomize-sops
 KUSTOMIZE_REF=3cac8448d3d604e1a38cd3c4bfe4585438f259ed
 KUSTOMIZE_REPO=https://github.com/kubernetes-sigs/kustomize
+KUSTOMIZE_PKG=./kustomize
 HELM_REF=c9f554d75773799f72ceef38c51210f1842a1dea
 HELM_REPO=https://github.com/helm/helm
 HELM_PKG=./cmd/helm