diff --git a/.github/config/kube-linter.yaml b/.github/config/kube-linter.yaml
new file mode 100644
index 00000000..2dfb4745
--- /dev/null
+++ b/.github/config/kube-linter.yaml
@@ -0,0 +1,10 @@
+checks:
+  # k8s/lgtm.yaml is intentionally a development and demo deployment. It follows the
+  # image's `latest` release, uses its default user and writable paths, and leaves resource
+  # sizing to the user.
+  exclude:
+    - latest-tag
+    - no-read-only-root-fs
+    - run-as-non-root
+    - unset-cpu-requirements
+    - unset-memory-requirements
diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 6f8e9102..4bac614b 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -327,6 +327,7 @@
         "google-java-format",
         "hadolint",
         "java",
+        "kube-linter",
         "lychee",
         "node",
         "npm:renovate",
diff --git a/mise.toml b/mise.toml
index c13c9a24..38277c3f 100644
--- a/mise.toml
+++ b/mise.toml
@@ -19,6 +19,7 @@ editorconfig-checker = "3.8.0"
 golangci-lint = "2.12.2"
 google-java-format = "1.35.0"
 hadolint = "2.14.0"
+kube-linter = "0.8.3"
 lychee = "0.24.2"
 # @yarnpkg/libzip 3.2.2 is npm-signed and matches Yarn's release commit, but
 # was published without provenance; mise's no-downgrade policy otherwise rejects Renovate.