diff --git a/.github/workflows/e2e-test-train-api.yaml b/.github/workflows/e2e-test-train-api.yaml
index 045c3b19e2..8d4ca0e734 100644
--- a/.github/workflows/e2e-test-train-api.yaml
+++ b/.github/workflows/e2e-test-train-api.yaml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Run tests
         run: |
-          pip install pytest
+          pip install pytest "kubernetes<36"
           python3 -m pip install -e sdk/python[huggingface]
           pytest -s sdk/python/test/e2e-fine-tune-llm/test_e2e_pytorch_fine_tune_llm.py --log-cli-level=debug
         env:
diff --git a/.github/workflows/integration-tests.yaml b/.github/workflows/integration-tests.yaml
index a450a76b16..9626d8216b 100644
--- a/.github/workflows/integration-tests.yaml
+++ b/.github/workflows/integration-tests.yaml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Run tests
         run: |
-          pip install pytest
+          pip install pytest "kubernetes<36"
           python3 -m pip install -e sdk/python; pytest -s sdk/python/test/e2e --log-cli-level=debug --namespace=default
         env:
           GANG_SCHEDULER_NAME: ${{ matrix.gang-scheduler-name }}
diff --git a/.github/workflows/test-example-notebooks.yaml b/.github/workflows/test-example-notebooks.yaml
index 0ee767e165..61338ef2ea 100644
--- a/.github/workflows/test-example-notebooks.yaml
+++ b/.github/workflows/test-example-notebooks.yaml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Install Python Dependencies
         run: |
-          pip install papermill==2.6.0 jupyter==1.1.1 ipykernel==6.29.5
+          pip install papermill==2.6.0 jupyter==1.1.1 ipykernel==6.29.5 "kubernetes<36"
 
       - name: Run Jupyter Notebook with Papermill
         shell: bash
diff --git a/.github/workflows/test-python.yaml b/.github/workflows/test-python.yaml
index 9a706461b7..11ebce3928 100644
--- a/.github/workflows/test-python.yaml
+++ b/.github/workflows/test-python.yaml
@@ -28,7 +28,12 @@ jobs:
 
       - name: Install dependencies
         run: |
-          pip install pytest python-dateutil urllib3 kubernetes
+          # TODO: kubernetes 36.0.0 switched to Pydantic models, breaking the
+          # FakeResponse deserialization hack in the SDK unit tests. To remove
+          # this pin, either adapt FakeResponse in
+          # sdk/python/kubeflow/training/utils/utils.py for Pydantic or mock
+          # ApiClient.deserialize directly in the test suite.
+          pip install pytest python-dateutil urllib3 "kubernetes<36"
           pip install -U './sdk/python[huggingface]'
 
       - name: Run unit test for training sdk
diff --git a/build/images/kubectl-delivery/Dockerfile b/build/images/kubectl-delivery/Dockerfile
index 7ad21aa273..7957bb18c1 100644
--- a/build/images/kubectl-delivery/Dockerfile
+++ b/build/images/kubectl-delivery/Dockerfile
@@ -1,16 +1,18 @@
-FROM alpine:3.17 AS build
+ARG ALPINE_VERSION=3.22
 
-ARG TARGETARCH
+FROM alpine:${ALPINE_VERSION} AS build
 
-# Install kubectl.
-ENV K8S_VERSION v1.30.7
+ARG TARGETARCH
+ARG K8S_VERSION=v1.30.7
 
 RUN apk add --no-cache wget
 RUN wget -q https://dl.k8s.io/release/${K8S_VERSION}/bin/linux/${TARGETARCH}/kubectl
+RUN wget -q https://dl.k8s.io/release/${K8S_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256
+RUN test "$(cat kubectl.sha256)" = "$(sha256sum kubectl | cut -d' ' -f1)"
 RUN chmod +x ./kubectl
 RUN mv ./kubectl /bin/kubectl
 
-FROM alpine:3.17
+FROM alpine:${ALPINE_VERSION}
 COPY --from=build /bin/kubectl /bin/kubectl
 RUN apk add --no-cache bash
 
diff --git a/sdk/python/test/e2e/test_e2e_jaxjob.py b/sdk/python/test/e2e/test_e2e_jaxjob.py
index 7471f67338..9ddb18cfd4 100644
--- a/sdk/python/test/e2e/test_e2e_jaxjob.py
+++ b/sdk/python/test/e2e/test_e2e_jaxjob.py
@@ -156,5 +156,5 @@ def generate_container() -> V1Container:
     return V1Container(
         name=CONTAINER_NAME,
         image=os.getenv("JAX_JOB_IMAGE", "docker.io/kubeflow/jaxjob-dist-spmd-mnist:latest"),
-        resources=V1ResourceRequirements(limits={"memory": "3Gi", "cpu": "1.2"}),
+        resources=V1ResourceRequirements(limits={"memory": "5Gi", "cpu": "1.2"}),
     )