diff --git a/README.md b/README.md
index 0c51d10..ebee5cd 100644
--- a/README.md
+++ b/README.md
@@ -40,8 +40,9 @@ Already have a clone? Just run it directly:
 - `bin/` — installs userland devops CLIs as self-contained, statically
   linked release binaries into `~/.local/bin`: jq, kubectl, helm, k9s,
   kubectx/kubens, stern, yq, OpenTofu, terragrunt, task (go-task, the
-  Taskfile runner), the 1Password CLI `op` for secrets storage, and the
-  opencode coding agent. kind is installed
+  Taskfile runner), the 1Password CLI `op` for secrets storage, the
+  opencode coding agent, and zarf (DevSecOps for Offline and Airgapped
+  Kubernetes). kind is installed
   only when full (non-rootless) Docker is available — it doesn't work
   against rootless Docker, so it is skipped on Kasm. No sudo, nothing
   outside `$HOME`, so tools persist across Kasm redeploys with no
diff --git a/bin/install.sh b/bin/install.sh
index 1ddc28f..0161e7c 100755
--- a/bin/install.sh
+++ b/bin/install.sh
@@ -156,6 +156,19 @@ install_opencode() {
   mark_version opencode "$ver"
 }
 
+# zarf — a DevSecOps tool for Offline and Airgapped Kubernetes (single static binary).
+install_zarf() {
+  ver=v0.81.0
+  have_version zarf "$ver" && { fsay "zarf $ver already installed."; return 0; }
+  case "$DEB" in
+    amd64) _zarf_arch=amd64 ;;
+    *) _zarf_arch=arm64 ;;
+  esac
+  install_raw_bin \
+    "https://github.com/zarf-dev/zarf/releases/download/$ver/zarf_${ver}_Linux_$_zarf_arch" zarf
+  mark_version zarf "$ver"
+}
+
 # task — go-task, the Taskfile.yml task runner. Binary is at the archive root.
 install_task() {
   ver=v3.52.0
@@ -194,5 +207,6 @@ install_task
 install_terragrunt
 install_1p
 install_opencode
+install_zarf
 
 fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."