diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c9ab7c9..00a7365 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -66,6 +66,8 @@ jobs:
           setup-jq: true
           setup-semver: true
           setup-deterministic-zip: true
+          setup-kubectl: true
+          kubectl-version: 'v1.33.0'
 
       - name: Verify Setup
         run: |
@@ -132,6 +134,9 @@ jobs:
           echo "::group::Verify deterministic-zip Installation"
             deterministic-zip --version
           echo "::endgroup::"
+          echo "::group::Verify kubectl Installation"
+            kubectl version --client
+          echo "::endgroup::"
 
   test-egress-policy:
     name: Test Egress Policy Input
@@ -613,3 +618,55 @@ jobs:
       - name: Verify deterministic-zip Installation
         run: |
           deterministic-zip --version
+
+  test-setup-kubectl:
+    name: Test Setup kubectl
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        id: harden-runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run Setup kubectl Action
+        uses: ./
+        with:
+          setup-kubectl: true
+
+      - name: Verify kubectl Installation
+        run: |
+          kubectl version --client
+
+  test-setup-kubectl-custom-version:
+    name: Test Setup kubectl (custom version)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        id: harden-runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run Setup kubectl Action (non-default version)
+        uses: ./
+        with:
+          setup-kubectl: true
+          kubectl-version: 'v1.31.0'
+
+      - name: Verify kubectl Version Matches Input
+        env:
+          EXPECTED_VERSION: v1.31.0
+        run: |
+          ACTUAL="$(kubectl version --client)"
+          echo "kubectl reported: ${ACTUAL}"
+          if ! echo "${ACTUAL}" | grep -qF "${EXPECTED_VERSION}"; then
+            echo "Expected kubectl version ${EXPECTED_VERSION}, got: ${ACTUAL}"
+            exit 1
+          fi
diff --git a/README.md b/README.md
index 84099cf..986e1c6 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Common steps for initializing a job for GitHub actions. This composite action co
 - Security hardening with Step Security's Harden Runner (configurable egress policy)
 - Repository checkout with configurable options
 - Multi-language support (Node.js, Java, Python, Go, Rust, Swift)
-- Build tool setup (Gradle, Task, gomplate, jq)
+- Build tool setup (Gradle, Task, gomplate, jq, kubectl)
 - Automatic caching for dependencies and build artifacts
 
 ## Usage
@@ -175,6 +175,13 @@ Common steps for initializing a job for GitHub actions. This composite action co
 > per-platform SHA-256 (fail-closed) rather than the release's own `.sha256` sidecar, so an
 > upstream asset swap is rejected. Supports Linux/macOS on `amd64`/`arm64`.
 
+**kubectl**
+
+| Input           | Description               | Required | Default |
+|-----------------|---------------------------|----------|---------|
+| setup-kubectl   | Whether to setup kubectl  | No       | false   |
+| kubectl-version | kubectl version to use    | No       | v1.33.0 |
+
 ### Outputs
 
 **Checkout Outputs**
diff --git a/action.yml b/action.yml
index 23d4a30..0bf5d20 100644
--- a/action.yml
+++ b/action.yml
@@ -182,6 +182,14 @@ inputs:
     description: 'Whether to setup deterministic-zip'
     required: false
     default: 'false'
+  setup-kubectl:
+    description: 'Whether to setup kubectl'
+    required: false
+    default: 'false'
+  kubectl-version:
+    description: 'kubectl version to use (e.g. v1.33.0)'
+    required: false
+    default: 'v1.33.0'
 
 # expose outputs from the sub-actions
 outputs:
@@ -657,6 +665,22 @@ runs:
         deterministic-zip --version
         echo "::endgroup::"
 
+    - name: Set Up KubeCtl Parameters
+      id: setup-kubectl-params
+      if: ${{ inputs.setup-kubectl == 'true' }}
+      shell: bash
+      run: |
+        echo "::group::Setting up KubeCtl"
+        echo "Version: ${{ inputs.kubectl-version }}"
+        echo "::endgroup::"
+
+    - name: Install KubeCtl
+      id: setup-kubectl
+      if: ${{ inputs.setup-kubectl == 'true' }}
+      uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+      with:
+        version: ${{ inputs.kubectl-version }}
+
 branding:
   icon: 'arrow-up-right'
   color: 'green'