diff --git a/docs/operations/k3s-ha-runbook.md b/docs/operations/k3s-ha-runbook.md
index b9257af..e5109c6 100644
--- a/docs/operations/k3s-ha-runbook.md
+++ b/docs/operations/k3s-ha-runbook.md
@@ -43,8 +43,8 @@ node scripts/ci-validate-migrations.mjs <当前线上完整GitSHA>
 ```bash
 ./scripts/cluster/bootstrap-wireguard.sh
 ./scripts/cluster/bootstrap-k3s.sh backup
-./scripts/cluster/bootstrap-k3s.sh install
 ./scripts/cluster/harden-node-network.sh
+./scripts/cluster/bootstrap-k3s.sh install
 ./scripts/cluster/verify-cluster.sh precutover
 ```
 
diff --git a/scripts/cluster/bootstrap-k3s.sh b/scripts/cluster/bootstrap-k3s.sh
index 22ef470..1a9148b 100755
--- a/scripts/cluster/bootstrap-k3s.sh
+++ b/scripts/cluster/bootstrap-k3s.sh
@@ -12,12 +12,14 @@ action=${1:-all}
 }
 
 load_cluster_env
-require_commands node openssl ssh scp shasum
+require_commands curl node openssl ssh scp shasum
 
 secret_root="$cluster_root/.local-secrets/cluster"
 cluster_environment="$secret_root/cluster.env"
 kubeconfig="$secret_root/kubeconfig"
 k3s_version=v1.36.2+k3s1
+k3s_sha256=65a55ec56c24eab44383086166ec620a491952b7e23941a49ddca6e8a4c4b4de
+k3s_binary="$secret_root/k3s-${k3s_version}-amd64"
 
 install -d -m 0700 "$secret_root"
 
@@ -109,11 +111,30 @@ write_node_config() {
 }
 
 install_cluster() {
-  local configuration_directory
+  local configuration_directory temporary_binary actual_k3s_sha256
   for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST"; do
     cluster_ssh "$host" 'ping -c 2 -W 2 10.77.0.1 >/dev/null'
   done
 
+  if [[ ! -f $k3s_binary ]] ||
+      [[ $(shasum -a 256 "$k3s_binary" | awk '{print $1}') != "$k3s_sha256" ]]; then
+    temporary_binary=$(mktemp "$secret_root/.k3s-download.XXXXXX")
+    trap 'rm -f -- "${temporary_binary:-}"' RETURN
+    curl -fL --retry 3 --connect-timeout 15 \
+      "https://github.com/k3s-io/k3s/releases/download/${k3s_version/+/%2B}/k3s" \
+      -o "$temporary_binary"
+    actual_k3s_sha256=$(shasum -a 256 "$temporary_binary" | awk '{print $1}')
+    [[ $actual_k3s_sha256 == "$k3s_sha256" ]] || {
+      echo "K3s binary checksum mismatch: $actual_k3s_sha256" >&2
+      return 1
+    }
+    chmod 0700 "$temporary_binary"
+    mv "$temporary_binary" "$k3s_binary"
+    temporary_binary=
+  fi
+  actual_k3s_sha256=$(shasum -a 256 "$k3s_binary" | awk '{print $1}')
+  [[ $actual_k3s_sha256 == "$k3s_sha256" ]]
+
   if [[ ! -f $cluster_environment ]]; then
     umask 077
     printf 'K3S_TOKEN=%s\n' "$(openssl rand -hex 32)" >"$cluster_environment"
@@ -187,14 +208,19 @@ REMOTE
   for index in 0 1 2; do
     host=${node_hosts[$index]}
     echo "[k3s] installing $k3s_version on $host"
-    cluster_ssh "$host" bash -s -- "$k3s_version" <<'REMOTE'
+    cluster_scp "$k3s_binary" "$host:/usr/local/bin/k3s"
+    cluster_ssh "$host" bash -s -- "$k3s_version" "$k3s_sha256" <<'REMOTE'
 set -euo pipefail
 version=$1
+expected_sha256=$2
+chmod 0755 /usr/local/bin/k3s
+echo "$expected_sha256  /usr/local/bin/k3s" | sha256sum -c -
 install_script=$(mktemp)
 trap 'rm -f -- "$install_script"' EXIT
 curl -fsSL https://get.k3s.io -o "$install_script"
 chmod 0700 "$install_script"
-INSTALL_K3S_VERSION="$version" INSTALL_K3S_EXEC=server "$install_script"
+INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_VERSION="$version" \
+  INSTALL_K3S_EXEC=server "$install_script"
 k3s --version | grep -F "$version"
 REMOTE
     if [[ $index -eq 0 ]]; then