diff --git a/Dockerfile b/Dockerfile
index b26ea9bdf..56adf3d1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -86,6 +86,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 COPY --chmod=0755 --from=docker/mcp-gateway:v2 /docker-mcp /usr/local/lib/docker/cli-plugins/docker-mcp
+COPY --chmod=0755 --from=registry.k8s.io/kubectl:v1.37.0 /bin/kubectl /usr/local/bin/kubectl
 USER agent
 ENV DOCKER_AGENT_NO_TOUR=1 \
     DOCKER_AGENT_HIDE_TELEMETRY_BANNER=1 \
diff --git a/docs/configuration/sandbox/index.md b/docs/configuration/sandbox/index.md
index 4d4453cd0..018ae92cd 100644
--- a/docs/configuration/sandbox/index.md
+++ b/docs/configuration/sandbox/index.md
@@ -206,6 +206,7 @@ layers onto `docker/sandbox-templates:shell-docker` and adds:
 
 - The `docker-agent` binary.
 - `vim` and `tmux`, for interactive debugging inside the VM.
+- `kubectl`, for interacting with Kubernetes clusters from inside the VM.
 - The **`docker-mcp`** Docker CLI plugin, installed at `~/.docker/cli-plugins/docker-mcp`.
 
 The image carries the label `com.docker.sandboxes.flavor=docker-agent-docker`