diff --git a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
index 2a115887..b6eb3681 100644
--- a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
+++ b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml
@@ -53,8 +53,21 @@ spec:
                 echo "CNI plugins already installed (${installed})"
               else
                 echo "Fetching ${URL}"
-                apk add --no-cache curl tar
-                curl -fsSL "${URL}" -o /tmp/plugins.tgz
+                # busybox wget + tar, NOT `apk add --no-cache curl tar`.
+                # Installing tools at container start is not acceptable here: it
+                # makes the install path depend on package-index availability at
+                # exactly the moment a node is being (re)built, and this is a
+                # DaemonSet — it runs on every node.
+                #
+                # Nothing needed to be added in the first place. Verified in
+                # alpine:3.21: `tar` is already busybox (v1.37.0) and handles
+                # -xzf, and busybox `wget` follows GitHub's release redirect to
+                # objects.githubusercontent.com over TLS using the base image's
+                # /etc/ssl/certs/ca-certificates.crt — fetched the real 48MB
+                # tarball and extracted an executable macvlan from it.
+                # Only `curl` is genuinely absent from the base, and wget covers
+                # what it was used for here.
+                wget -q -O /tmp/plugins.tgz "${URL}"
                 # Extract everything: the tarball entries are stored with a
                 # `./` prefix, so selective extraction by bare name fails.
                 # All standard plugins are tiny (~5-10MB total) and harmless