diff --git a/deploy/firecracker/rootfs/Dockerfile.default b/deploy/firecracker/rootfs/Dockerfile.default
index ed431a296..c659936a3 100644
--- a/deploy/firecracker/rootfs/Dockerfile.default
+++ b/deploy/firecracker/rootfs/Dockerfile.default
@@ -79,6 +79,21 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libfuse3-3 \
     && rm -rf /var/lib/apt/lists/*
 
+# ── GitHub CLI (gh) ──────────────────────────────────────────────────────────
+# Agents do GitHub operations (PRs, issues, auth) via `gh`. It isn't in Ubuntu's
+# default repos, so add GitHub's apt source (keyring fetched with curl, installed
+# above). The signed-by keyring means no apt-key / gnupg is needed, and
+# dpkg --print-architecture keeps it correct on both amd64 and arm64 VMs.
+RUN install -d -m 755 /etc/apt/keyrings \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+       -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+       > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install rclone from upstream so we track current backend support. The
 # version pinned into the rootfs is whatever was current at image build
 # time; sandboxes surface it via `mounts.list().rcloneVersion` for ops triage.