diff --git a/README.md b/README.md
index ee54887..b3f7064 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,8 @@ Already have a clone? Just run it directly:
   `credential.helper store` (plaintext `~/.git-credentials`, 0600) for
   HTTPS auth.
 - `bin/` — installs userland devops CLIs (jq, kubectl, helm, k9s,
-  kubectx/kubens, stern, yq, OpenTofu, terragrunt) as self-contained,
+  kubectx/kubens, stern, yq, OpenTofu, terragrunt, plus kind when rootless
+  Docker is available) as self-contained,
   statically linked release binaries into `~/.local/bin`. No sudo, nothing
   outside `$HOME`, so they persist across Kasm redeploys with no reinstall.
   Idempotent: each tool records its version under `~/.local/bin/.versions`
diff --git a/bin/install.sh b/bin/install.sh
index 0cf5357..f413acc 100755
--- a/bin/install.sh
+++ b/bin/install.sh
@@ -20,6 +20,15 @@ REPO_ROOT="$(dirname -- "$SCRIPT_DIR")"
 ARCH="$(fetch_arch)"       # x86_64 / aarch64
 DEB="$(fetch_arch_deb)"    # amd64 / arm64
 
+# docker_rootless_available — true only if a rootless Docker daemon is up and
+# reachable. kind needs a container runtime to create clusters; on Kasm we run
+# Docker rootless (never system Docker), so kind is worth installing only when
+# that daemon answers. SecurityOptions lists name=rootless under rootless mode.
+docker_rootless_available() {
+  command -v docker >/dev/null 2>&1 || return 1
+  docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'
+}
+
 # jq — command-line JSON processor (single static binary).
 install_jq() {
   ver=1.8.2
@@ -58,6 +67,16 @@ install_k9s() {
   mark_version k9s "$ver"
 }
 
+# kind — run local Kubernetes clusters in Docker (single static binary). Gated
+# on rootless Docker at the call site since it is useless without a runtime.
+install_kind() {
+  ver=v0.32.0
+  have_version kind "$ver" && { fsay "kind $ver already installed."; return 0; }
+  install_raw_bin \
+    "https://github.com/kubernetes-sigs/kind/releases/download/$ver/kind-linux-$DEB" kind
+  mark_version kind "$ver"
+}
+
 # kubectx / kubens — fast context and namespace switching. Uses x86_64 token.
 install_kubectx() {
   ver=v0.11.0
@@ -119,6 +138,11 @@ install_jq
 install_kubectl
 install_helm
 install_k9s
+if docker_rootless_available; then
+  install_kind
+else
+  fsay "Skipping kind: rootless Docker not available."
+fi
 install_kubectx
 install_kubens
 install_stern