diff --git a/justfile b/justfile
index 4b1f9cf973c2a..985f35866d74e 100644
--- a/justfile
+++ b/justfile
@@ -153,14 +153,14 @@ policy-test-cleanup:
     @while [ $({{ _kubectl }} get ns --selector='linkerd-policy-test' -o json |jq '.items | length') != "0" ]; do sleep 1 ; done
 
 policy-test-deps-pull:
-    docker pull -q docker.io/bitnami/kubectl:latest
+    docker pull -q docker.io/chainguard/kubectl:latest-dev
     docker pull -q docker.io/curlimages/curl:latest
     docker pull -q ghcr.io/olix0r/hokay:latest
 
 # Load all images into the test cluster.
 policy-test-deps-load: _k3d-init policy-test-deps-pull
     for i in {1..3} ; do {{ _k3d-load }} \
-        bitnami/kubectl:latest \
+        chainguard/kubectl:latest-dev \
         curlimages/curl:latest \
         fortio/fortio:latest \
         ghcr.io/olix0r/hokay:latest && exit || sleep 1 ; done
diff --git a/policy-test/src/curl.rs b/policy-test/src/curl.rs
index 1a27e3b90c4e5..9720af8717ad0 100644
--- a/policy-test/src/curl.rs
+++ b/policy-test/src/curl.rs
@@ -198,7 +198,7 @@ impl Runner {
                 service_account: Some("curl".to_string()),
                 init_containers: Some(vec![k8s::api::core::v1::Container {
                     name: "wait-for-web".to_string(),
-                    image: Some("docker.io/bitnami/kubectl:latest".to_string()),
+                    image: Some("docker.io/chainguard/kubectl:latest-dev".to_string()),
                     // In CI, we can hit failures where the watch isn't updated
                     // after the configmap is deleted, even with a long timeout.
                     // Instead, we use a relatively short timeout and retry the