diff --git a/internal/cbm/cbm.h b/internal/cbm/cbm.h
index 16b9dd083..1dbab2615 100644
--- a/internal/cbm/cbm.h
+++ b/internal/cbm/cbm.h
@@ -75,6 +75,8 @@ typedef enum {
     CBM_LANG_FORM,
     CBM_LANG_MAGMA,
     CBM_LANG_WOLFRAM,
+    CBM_LANG_KUSTOMIZE,  // kustomization.yaml — Kubernetes overlay tool
+    CBM_LANG_K8S,        // Generic Kubernetes manifest (apiVersion: detected)
     CBM_LANG_COUNT
 } CBMLanguage;
 
diff --git a/src/discover/language.c b/src/discover/language.c
index b7eb7e439..cad73e012 100644
--- a/src/discover/language.c
+++ b/src/discover/language.c
@@ -273,6 +273,8 @@ static const filename_entry_t FILENAME_TABLE[] = {
     {"GNUmakefile", CBM_LANG_MAKEFILE}, {"Makefile", CBM_LANG_MAKEFILE},
     {"makefile", CBM_LANG_MAKEFILE},    {"meson.build", CBM_LANG_MESON},
     {"meson.options", CBM_LANG_MESON},  {"meson_options.txt", CBM_LANG_MESON},
+    {"kustomization.yaml", CBM_LANG_KUSTOMIZE},
+    {"kustomization.yml",  CBM_LANG_KUSTOMIZE},
     {".vimrc", CBM_LANG_VIMSCRIPT},
 };
 
@@ -345,6 +347,8 @@ static const char *LANG_NAMES[CBM_LANG_COUNT] = {
     [CBM_LANG_FORM] = "FORM",
     [CBM_LANG_MAGMA] = "Magma",
     [CBM_LANG_WOLFRAM] = "Wolfram",
+    [CBM_LANG_KUSTOMIZE] = "Kustomize",
+    [CBM_LANG_K8S]       = "Kubernetes",
 };
 
 /* ── Public API ──────────────────────────────────────────────────── */
diff --git a/src/pipeline/pass_infrascan.c b/src/pipeline/pass_infrascan.c
index 30c47d95e..307973f5c 100644
--- a/src/pipeline/pass_infrascan.c
+++ b/src/pipeline/pass_infrascan.c
@@ -192,6 +192,25 @@ bool cbm_is_env_file(const char *name) {
     return false;
 }
 
+bool cbm_is_kustomize_file(const char *name) {
+    if (!name) { return false; }
+    char lower[256];
+    to_lower(name, lower, sizeof(lower));
+    return (strcmp(lower, "kustomization.yaml") == 0 ||
+            strcmp(lower, "kustomization.yml") == 0);
+}
+
+// NOLINTNEXTLINE(bugprone-easily-swappable-parameters)
+bool cbm_is_k8s_manifest(const char *name, const char *content) {
+    if (!name || !content || cbm_is_kustomize_file(name)) { return false; }
+    char buf[4097];
+    size_t n = strlen(content);
+    if (n > 4096) { n = 4096; }
+    memcpy(buf, content, n);
+    buf[n] = '\0';
+    return ci_strstr(buf, "apiVersion:") != NULL;
+}
+
 // NOLINTNEXTLINE(bugprone-easily-swappable-parameters)
 bool cbm_is_shell_script(const char *name, const char *ext) {
     (void)name;
diff --git a/src/pipeline/pipeline_internal.h b/src/pipeline/pipeline_internal.h
index c1d45f14f..ea5c1d73f 100644
--- a/src/pipeline/pipeline_internal.h
+++ b/src/pipeline/pipeline_internal.h
@@ -218,6 +218,8 @@ bool cbm_is_compose_file(const char *name);
 bool cbm_is_cloudbuild_file(const char *name);
 bool cbm_is_env_file(const char *name);
 bool cbm_is_shell_script(const char *name, const char *ext);
+bool cbm_is_kustomize_file(const char *name);
+bool cbm_is_k8s_manifest(const char *name, const char *content);
 
 /* Secret detection */
 bool cbm_is_secret_binding(const char *key, const char *value);