diff --git a/k8s/security/iam/authentik-provision-job.yaml b/k8s/security/iam/authentik-provision-job.yaml
index a1a2969..5caa541 100644
--- a/k8s/security/iam/authentik-provision-job.yaml
+++ b/k8s/security/iam/authentik-provision-job.yaml
@@ -479,11 +479,19 @@ spec:
               until wget -q -O /dev/null http://authentik-server.iam.svc.cluster.local/-/health/ready/ 2>/dev/null; do
                 sleep 5
               done
-              echo "installing kubectl..."
-              apk add --no-cache curl >/dev/null
-              KVER=$(curl -sL https://dl.k8s.io/release/stable.txt)
-              curl -sLo /usr/local/bin/kubectl "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl"
-              chmod +x /usr/local/bin/kubectl
+              echo "installing kubectl (via python urllib - no apk/curl: this"
+              echo "container runs as non-root UID 1000 and can't write to"
+              echo "apk's directories or /usr/local/bin, both root-owned in"
+              echo "the python:3.12-alpine image; /tmp is world-writable)..."
+              python3 -c "
+              import urllib.request, os, stat
+              kver = urllib.request.urlopen('https://dl.k8s.io/release/stable.txt').read().decode().strip()
+              url = f'https://dl.k8s.io/release/{kver}/bin/linux/amd64/kubectl'
+              urllib.request.urlretrieve(url, '/tmp/kubectl')
+              st = os.stat('/tmp/kubectl')
+              os.chmod('/tmp/kubectl', st.st_mode | stat.S_IEXEC)
+              "
+              export PATH="/tmp:$PATH"
               echo "running provisioning script..."
               python3 /script/authentik-provision.py
       volumes: