diff --git a/runner.Dockerfile b/runner.Dockerfile
index f539075..51fd148 100644
--- a/runner.Dockerfile
+++ b/runner.Dockerfile
@@ -9,7 +9,7 @@ RUN set -ex; \
   ); \
   \
   export DEBIAN_FRONTEND=noninteractive; \
-  runDeps='ca-certificates curl git jq unzip findutils patch xz-utils'; \
+  runDeps='ca-certificates curl git jq unzip findutils patch xz-utils gpg apt-transport-https'; \
   buildDeps=''; \
   apt-get update && apt-get install -y $runDeps $buildDeps --no-install-recommends; \
   \
@@ -43,7 +43,14 @@ COPY bin/y-kustomize /usr/local/src/ystack/bin/
 RUN y-kustomize version
 
 COPY bin/y-helm /usr/local/src/ystack/bin/
-RUN y-helm version --client=true
+# RUN y-helm version --client=true
+RUN curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg > /dev/null \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list \
+  && apt-get update \
+  && apt-get install helm \
+  && helm version --client=true \
+  && ln -s $(which helm) /usr/local/src/ystack/bin/helm \
+  && y-helm version --client=true
 
 COPY bin/y-buildctl /usr/local/src/ystack/bin/
 RUN y-buildctl --version