diff --git a/Makefile b/Makefile
index 3bee0a6..293e794 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,7 @@
+GO ?= $(shell which go)
+OS ?= $(shell $(GO) env GOOS)
+ARCH ?= $(shell $(GO) env GOARCH)
+
 IMAGE_NAME := "cert-manager-webhook-hetzner"
 IMAGE_TAG := "latest"
 
@@ -5,8 +9,23 @@ OUT := $(shell pwd)/deploy
 
 $(shell mkdir -p "$(OUT)")
 
-verify:
-	go test -v .
+KUBEBUILDER_VERSION=1.28.0
+
+test: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl
+	TEST_ASSET_ETCD=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd \
+	TEST_ASSET_KUBE_APISERVER=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver \
+	TEST_ASSET_KUBECTL=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl \
+	$(GO) test -v .
+
+_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH).tar.gz: | _test
+	curl -fsSL https://go.kubebuilder.io/test-tools/$(KUBEBUILDER_VERSION)/$(OS)/$(ARCH) -o $@
+
+_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH).tar.gz | _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)
+	tar xfO $< kubebuilder/bin/$(notdir $@) > $@ && chmod +x $@
+
+.PHONY: clean
+clean:
+	rm -r _test
 
 build:
 	docker build -t "$(IMAGE_NAME):$(IMAGE_TAG)" .
@@ -19,3 +38,6 @@ rendered-manifest.yaml:
         --set image.tag=$(IMAGE_TAG) \
 		--namespace cert-manager \
         deploy/cert-manager-webhook-oci > "$(OUT)/rendered-manifest.yaml"
+
+_test $(OUT) _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH):
+	mkdir -p $@