diff --git a/templates/dkai-agent/README.md b/templates/dkai-agent/README.md
index 353f9c4..e5fa558 100644
--- a/templates/dkai-agent/README.md
+++ b/templates/dkai-agent/README.md
@@ -15,6 +15,7 @@ Fork of **DKAI Arch** (`dkai-arch`) with the same Arch Linux base, AppArmor sand
 
 - **`agent` CLI** installed under `/home/coder/.local/bin` (and on `PATH`), same as DKAI Arch.
 - **`kubectl`** from Arch **`extra/kubectl`** via the initial **`pacman`** install (`/usr/bin/kubectl`). **`kubectx`** and **`kubens`** from Arch **`extra/kubectx`** (same install; context / namespace helpers). **`rancher`** CLI is downloaded from GitHub releases to `/usr/local/bin` when missing.
+- **`terraform`** installed to **`/usr/local/bin/terraform`** from [HashiCorp releases](https://releases.hashicorp.com/terraform/) (pinned version in startup script; upgraded when the pin changes). Uses **`unzip`** from **`pacman`** for the official Linux amd64 zip.
 - **Tool config volume** — one **ReadWriteMany** PVC per **Coder user** at **`/mnt/coder-tool-config`** named **`coder-<owner-id>-tool-config`**. At **plan** time the template checks the cluster (in-cluster API or `kubectl`); if the PVC is missing Terraform **creates** it; if it already exists (another workspace or a prior apply), Terraform **imports** it into this workspace’s state so updates never **destroy** the claim. The PVC resource uses **`lifecycle { prevent_destroy = true }`** so Terraform will not delete it on workspace teardown (shared across your dkai-agent workspaces; remove from state manually if you must drop the claim). **`tool_config_disk_size`** sizes that shared volume. On each boot the startup script **`mkdir`**s layout there, **merges** legacy **`/home/coder`** paths into the PVC (including **`glab-cli`**), then **`ln -sfn`** the same paths for **both** **`/root`** and **`/home/coder`**: **`~/.kube`**, **`~/.config/gh`**, **`~/.config/glab-cli`**, **`~/.config/coderv2`**, **`~/.rancher`**. **Coder CLI** uses **`~/.config/coderv2`** (same as **`coder --global-config`** / default **`$CODER_CONFIG_DIR`**). The PVC dirs are **`chown`’d `coder:coder`** each boot so **`gh`**, **`glab`**, **`kubectl`**, **`coder`**, and **`rancher`** see the same files whether you use **`HOME=/home/coder`** or **`HOME=/root`** (root still reads/writes everything).
 - **Workspace parameter `cursor_api_key`** (optional, masked in the UI): when set, Coder injects **`CURSOR_API_KEY`** into the workspace via `coder_env`. Use the API key from **Cursor Dashboard → Settings → Cursor Settings → API Keys** for the user who owns usage. Leave empty and export it yourself if you prefer not to store the key on the workspace.
 - **`start-cursor-worker`** in `~/bin` and `/usr/local/bin`: runs `agent worker start` (without `--pool`) with your workspace’s **idle-release timeout** (build parameter `cursor_worker_idle_timeout`, default 600 seconds). Honors:
@@ -67,7 +68,7 @@ The idle timeout is **`cursor_worker_idle_timeout`** (seconds).
 
 ## Relationship to DKAI Arch
 
-Same Kubernetes layout (Deployment + **two** PVCs on `truenas-csi-nfs`, pod anti-affinity) and startup behavior (pacman, `gh`/`glab`, `kubectl`, `rancher`, Cursor sandbox `.deb` extract, `coder` CLI). Unlike **DKAI Arch**, this template does **not** include the `coder/cursor` registry module (no **Open in Cursor Desktop** app in Coder). Adds worker parameters, `coder_env` + end-of-startup autostart when **`cursor_api_key`** is set, `start-cursor-worker`, and related docs.
+Same Kubernetes layout (Deployment + **two** PVCs on `truenas-csi-nfs`, pod anti-affinity) and startup behavior (pacman, `gh`/`glab`, `kubectl`, `rancher`, `terraform`, Cursor sandbox `.deb` extract, `coder` CLI). Unlike **DKAI Arch**, this template does **not** include the `coder/cursor` registry module (no **Open in Cursor Desktop** app in Coder). Adds worker parameters, `coder_env` + end-of-startup autostart when **`cursor_api_key`** is set, `start-cursor-worker`, and related docs.
 
 ## Prerequisites
 
diff --git a/templates/dkai-agent/main.tf b/templates/dkai-agent/main.tf
index d73d65e..a38727d 100644
--- a/templates/dkai-agent/main.tf
+++ b/templates/dkai-agent/main.tf
@@ -195,7 +195,7 @@ resource "coder_agent" "main" {
       "Exec = /usr/bin/true" \
       >/etc/pacman.d/hooks/detect-old-perl-modules.hook
     pacman -Sy --needed --noconfirm --disable-sandbox \
-      apparmor bash binutils curl git kubectl kubectx nano nodejs zstd
+      apparmor bash binutils curl git kubectl kubectx nano nodejs unzip zstd
     # Git 2.35+: "dubious ownership" when .git owner != invoking user (NFS root_squash → nobody, or root in a coder-owned tree).
     git config --system --add safe.directory '*' 2>/dev/null || true
     # Coder often sets GIT_ASKPASS for git; neutralize so gh/glab credential helpers can supply HTTPS tokens.
@@ -264,6 +264,20 @@ resource "coder_agent" "main" {
         rm -rf /tmp/rancher-cli.tgz /tmp/rancher-extract
       fi
     fi
+    # HashiCorp Terraform: zip from releases.hashicorp.com (Arch community/terraform pulls extra deps).
+    TF_VERSION=1.13.5
+    if command -v terraform >/dev/null 2>&1; then
+      TF_CUR=$(terraform version -json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('terraform_version',''))" 2>/dev/null || true)
+    else
+      TF_CUR=
+    fi
+    if [ "$${TF_CUR}" != "$${TF_VERSION}" ]; then
+      if curl -fsSL "https://releases.hashicorp.com/terraform/$${TF_VERSION}/terraform_$${TF_VERSION}_linux_amd64.zip" -o /tmp/terraform.zip; then
+        unzip -o -q /tmp/terraform.zip -d /tmp/terraform-extract
+        install -m 0755 /tmp/terraform-extract/terraform /usr/local/bin/terraform
+        rm -rf /tmp/terraform-extract /tmp/terraform.zip
+      fi
+    fi
     set -e
     if ! id -u coder >/dev/null 2>&1; then
       # PVC is usually mounted at /home/coder before this runs; -m would warn and skip skel.
@@ -504,6 +518,7 @@ WORKERHELPER
     if command -v kubectx >/dev/null 2>&1; then echo "  kubectx: installed"; else echo "  kubectx: not found"; fi
     if command -v kubens >/dev/null 2>&1; then echo "  kubens: installed"; else echo "  kubens: not found"; fi
     if command -v rancher >/dev/null 2>&1; then rancher --version 2>/dev/null | head -n1 || echo "  rancher: installed"; else echo "  rancher: not found"; fi
+    if command -v terraform >/dev/null 2>&1; then terraform version 2>/dev/null | head -n1 || echo "  terraform: installed"; else echo "  terraform: not found"; fi
     if command -v coder >/dev/null 2>&1; then coder version 2>/dev/null | head -n1; else echo "  coder: not found"; fi
     if command -v agent >/dev/null 2>&1; then
       echo -n "  cursor (agent): "