diff --git a/tests/gha-run-k8s-common.sh b/tests/gha-run-k8s-common.sh
index 12128e902d..2e3b23dda5 100644
--- a/tests/gha-run-k8s-common.sh
+++ b/tests/gha-run-k8s-common.sh
@@ -94,6 +94,33 @@ function install_kubectl() {
     sudo az aks install-cli
 }
 
+# Install the kustomize tool in /usr/local/bin if it doesn't exist on
+# the system yet.
+#
+function install_kustomize() {
+	local arch
+	local checksum
+	local version
+
+	if command -v kustomize >/dev/null; then
+		return
+	fi
+
+	ensure_yq
+	version=$(get_from_kata_deps "externals.kustomize.version")
+	arch=$(arch_to_golang)
+	checksum=$(get_from_kata_deps "externals.kustomize.checksum.${arch}")
+
+	local tarball="kustomize_${version}_linux_${arch}.tar.gz"
+	curl -Lf -o "$tarball" "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${version}/${tarball}"
+
+	local rc=0
+	echo "${checksum} $tarball" | sha256sum -c || rc=$?
+	[ $rc -eq 0 ] && sudo tar -xvzf "${tarball}" -C /usr/local/bin || rc=$?
+	rm -f "$tarball"
+	[ $rc -eq 0 ]
+}
+
 function get_cluster_credentials() {
     test_type="${1:-k8s}"
 
diff --git a/versions.yaml b/versions.yaml
index 77a7afc1c3..82a229b100 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -260,6 +260,17 @@ externals:
       .*/v?([\d\.]+)\.tar\.gz
     version: "1.23.1-00"
 
+  kustomize:
+    description: "Kubernetes native configuration management"
+    url: "https://github.com/kubernetes-sigs/kustomize"
+    version: "v5.3.0"
+    checksum:
+      amd64: "3ab32f92360d752a2a53e56be073b649abc1e7351b912c0fb32b960d1def854c"
+      arm64: "a1ec622d4adeb483e3cdabd70f0d66058b1e4bcec013c4f74f370666e1e045d8"
+      # yamllint disable-line rule:line-length
+      ppc64le: "946b1aa9325e7234157881fe2098e59c05c6834e56205bf6ec0a9a5fc83c9cc4"
+      s390x: "0b1a00f0e33efa2ecaa6cda9eeb63141ddccf97a912425974d6b65e66cf96cd4"
+
   libseccomp:
     description: "High level interface to Linux seccomp filter"
     url: "https://github.com/seccomp/libseccomp"