diff --git a/chart/templates/cronjob-ecr-credential-refresh.yaml b/chart/templates/cronjob-ecr-credential-refresh.yaml
index d2d6ec2..da2abf2 100644
--- a/chart/templates/cronjob-ecr-credential-refresh.yaml
+++ b/chart/templates/cronjob-ecr-credential-refresh.yaml
@@ -86,9 +86,14 @@ spec:
                 - |
                   set -euo pipefail
                   KUBECTL_VERSION="v1.32.3"
-                  KUBECTL_SHA256="ab209d0c5134b61486a0486585604a616a5bb2fc07df46d304b3c95817b2d79f"
-                  curl -sLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-                  echo "${KUBECTL_SHA256}  kubectl" | sha256sum -c -
+                  ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+                  if [[ "$ARCH" != "amd64" && "$ARCH" != "arm64" ]]; then
+                    echo "❌ Unsupported architecture: $(uname -m)" >&2; exit 1
+                  fi
+                  curl -fSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl"
+                  curl -fSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl.sha256"
+                  echo "$(cat kubectl.sha256)  kubectl" | sha256sum -c -
+                  rm kubectl.sha256
                   chmod +x kubectl && mv kubectl /usr/local/bin/
                   TOKEN=$(aws ecr get-login-password --region "$AWS_REGION")
                   kubectl create secret docker-registry "$SECRET_NAME" \
@@ -152,9 +157,14 @@ spec:
             - |
               set -euo pipefail
               KUBECTL_VERSION="v1.32.3"
-              KUBECTL_SHA256="ab209d0c5134b61486a0486585604a616a5bb2fc07df46d304b3c95817b2d79f"
-              curl -sLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-              echo "${KUBECTL_SHA256}  kubectl" | sha256sum -c -
+              ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+              if [[ "$ARCH" != "amd64" && "$ARCH" != "arm64" ]]; then
+                echo "❌ Unsupported architecture: $(uname -m)" >&2; exit 1
+              fi
+              curl -fSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl"
+              curl -fSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl.sha256"
+              echo "$(cat kubectl.sha256)  kubectl" | sha256sum -c -
+              rm kubectl.sha256
               chmod +x kubectl && mv kubectl /usr/local/bin/
               TOKEN=$(aws ecr get-login-password --region "$AWS_REGION")
               kubectl create secret docker-registry "$SECRET_NAME" \