diff --git a/pipeline-compliance/plumber.yaml b/pipeline-compliance/plumber.yaml
index bec5e82..c7b74fc 100644
--- a/pipeline-compliance/plumber.yaml
+++ b/pipeline-compliance/plumber.yaml
@@ -66,6 +66,7 @@ github:
           # ── Kubernetes ──────────────────────────────────────────────
           - azure/setup-kubectl # Install kubectl
           - azure/setup-helm # Install Helm
+          - imranismail/setup-kustomize # Install Kustomize
 
           # ── Infrastructure as Code ──────────────────────────────────
           - hashicorp/setup-terraform # Install Terraform
@@ -413,7 +414,8 @@ github:
         - gradle/publish-plugin
         - softprops/action-gh-release
         - ncipollo/release-action
-        - goreleaser/goreleaser-action
+        # goreleaser/goreleaser-action
+        # it can run with --snapshot and therefore isn't inherently a publisher
         - crazy-max/ghaction-docker-buildx
         - changesets/action
       # Cache-restoring actions AND their per-action semantics. mode: