diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3df1759..91538bb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -225,10 +225,13 @@ jobs:
       # kind-action is not used here: it would create a cluster with kindnet,
       # which accepts NetworkPolicy and ignores it. policy-check.sh builds its
       # own cluster with Calico, so only the binary is needed.
+      # Installed under the runner temp directory rather than /usr/local/bin,
+      # which the runner user cannot chmod.
       - name: Install kind
         run: |
-          curl -fsSLo /usr/local/bin/kind \
+          curl -fsSLo "$RUNNER_TEMP/kind" \
             https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
-          chmod +x /usr/local/bin/kind
+          chmod +x "$RUNNER_TEMP/kind"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
       - name: Verify the egress policy is enforced
         run: bash test/e2e/kubernetes/policy-check.sh