diff --git a/.gitignore b/.gitignore
index 873b13abd..1a330bec5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@ integration.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
+_output/
diff --git a/Dockerfile b/Dockerfile
index 5633422c7..28ddfeddb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,8 +3,6 @@ WORKDIR /go/src/github.com/open-cluster-management/registration
 COPY . .
 ENV GO_PACKAGE github.com/open-cluster-management/registration
 
-RUN curl -O -L https://github.com/kubernetes-sigs/kustomize/releases/download/v2.0.0/kustomize_2.0.0_linux_amd64; mv kustomize_2.0.0_linux_amd64 kustomize; chmod u+x kustomize; mv kustomize /usr/bin/kustomize
-
 RUN make build --warn-undefined-variables
 
 FROM registry.access.redhat.com/ubi8/ubi-minimal:8.1-398
diff --git a/Makefile b/Makefile
index 6cbbb91f6..b3a128376 100644
--- a/Makefile
+++ b/Makefile
@@ -8,6 +8,7 @@ include $(addprefix ./vendor/github.com/openshift/build-machinery-go/make/, \
 	targets/openshift/deps.mk \
 	targets/openshift/images.mk \
 	targets/openshift/bindata.mk \
+	lib/tmp.mk \
 )
 
 IMAGE_REGISTRY?=quay.io/open-cluster-management
@@ -15,6 +16,10 @@ IMAGE_TAG?=latest
 IMAGE_NAME?=$(IMAGE_REGISTRY)/registration:$(IMAGE_TAG)
 KUBECONFIG ?= ./.kubeconfig
 KUBECTL?=kubectl
+KUSTOMIZE?=$(PERMANENT_TMP_GOPATH)/bin/kustomize
+KUSTOMIZE_VERSION?=v3.5.4
+KUSTOMIZE_ARCHIVE_NAME?=kustomize_$(KUSTOMIZE_VERSION)_$(GOHOSTOS)_$(GOHOSTARCH).tar.gz
+kustomize_dir:=$(dir $(KUSTOMIZE))
 
 $(call add-bindata,spokecluster,./pkg/hub/spokecluster/manifests/...,bindata,bindata,./pkg/hub/spokecluster/bindata/bindata.go)
 $(call add-bindata,spokecluster-e2e,./deploy/spoke/...,bindata,bindata,./test/e2e/bindata/bindata.go)
@@ -32,10 +37,10 @@ clean:
 	$(RM) ./registration
 .PHONY: clean
 
-deploy-hub:
+deploy-hub: ensure-kustomize
 	cp deploy/hub/kustomization.yaml deploy/hub/kustomization.yaml.tmp
 	cd deploy/hub && kustomize edit set image quay.io/open-cluster-management/registration:latest=$(IMAGE_NAME)
-	kustomize build deploy/hub | kubectl apply -f -
+	$(KUSTOMIZE) build deploy/hub | kubectl apply -f -
 	mv deploy/hub/kustomization.yaml.tmp deploy/hub/kustomization.yaml
 
 cluster-ip: 
@@ -52,19 +57,30 @@ e2e-bootstrap-secret: cluster-ip
 	$(KUBECTL) delete secret e2e-bootstrap-secret -n open-cluster-management --ignore-not-found
 	$(KUBECTL) create secret generic e2e-bootstrap-secret --from-file=kubeconfig=e2e-kubeconfig -n open-cluster-management
 
-deploy-spoke:
+deploy-spoke: ensure-kustomize
 	cp deploy/spoke/kustomization.yaml deploy/spoke/kustomization.yaml.tmp
 	cd deploy/spoke && kustomize edit set image quay.io/open-cluster-management/registration:latest=$(IMAGE_NAME)
-	kustomize build deploy/spoke | kubectl apply -f -
+	$(KUSTOMIZE) build deploy/spoke | kubectl apply -f -
 	mv deploy/spoke/kustomization.yaml.tmp deploy/spoke/kustomization.yaml
 
 deploy-all: deploy-hub bootstrap-secret deploy-spoke
 
 # test-e2e target is currently a NOP that deploys the hub and self-joins the
 # hosting cluster to itself as a spoke; it will be used to prototype e2e in ci.
-test-e2e: deploy-hub e2e-bootstrap-secret
+test-e2e: ensure-kustomize deploy-hub e2e-bootstrap-secret
 	go test ./test/e2e -v -ginkgo.v
 
+ensure-kustomize:
+ifeq "" "$(wildcard $(KUSTOMIZE))"
+	$(info Installing kustomize into '$(KUSTOMIZE)')
+	mkdir -p '$(kustomize_dir)'
+	curl -s -f -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F$(KUSTOMIZE_VERSION)/$(KUSTOMIZE_ARCHIVE_NAME) -o '$(kustomize_dir)$(KUSTOMIZE_ARCHIVE_NAME)'
+	tar -C '$(kustomize_dir)' -zvxf '$(kustomize_dir)$(KUSTOMIZE_ARCHIVE_NAME)'
+	chmod +x '$(KUSTOMIZE)';
+else
+	$(info Using existing kustomize from "$(KUSTOMIZE)")
+endif
+
 GO_TEST_PACKAGES :=./pkg/... ./cmd/...
 
 include ./test/integration-test.mk