diff --git a/build/Dockerfile b/build/Dockerfile
index 9f62902f..777907a7 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -8,6 +8,10 @@ RUN --mount=target=. \
     --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg \
     cd httphandler && GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /out/ksserver .
+RUN --mount=target=. \
+    --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg \
+    go run downloader/main.go
 
 FROM gcr.io/distroless/static-debian12:nonroot
 
@@ -15,6 +19,7 @@ USER nonroot
 WORKDIR /home/nonroot/
 
 COPY --from=builder /out/ksserver /usr/bin/ksserver
+COPY --from=builder /root/.kubescape /home/nonroot/.kubescape
 
 ARG image_version client
 ENV RELEASE=$image_version CLIENT=$client
diff --git a/downloader/main.go b/downloader/main.go
new file mode 100644
index 00000000..0b16d8df
--- /dev/null
+++ b/downloader/main.go
@@ -0,0 +1,22 @@
+package main
+
+import (
+	"context"
+	"github.com/kubescape/go-logger"
+	"github.com/kubescape/go-logger/helpers"
+	"github.com/kubescape/kubescape/v3/core/core"
+	metav1 "github.com/kubescape/kubescape/v3/core/meta/datastructures/v1"
+)
+
+func main() {
+	ks := core.NewKubescape()
+	downloads := []metav1.DownloadInfo{
+		{Target: "artifacts"},                         // download all artifacts
+		{Target: "framework", Identifier: "security"}, // force add the "security" framework
+	}
+	for _, download := range downloads {
+		if err := ks.Download(context.Background(), &download); err != nil {
+			logger.L().Error("failed to download artifact", helpers.Error(err), helpers.String("target", download.Target))
+		}
+	}
+}