diff --git a/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp b/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
index f3a7815..58b4d11 100644
--- a/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
+++ b/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
@@ -51,6 +51,18 @@ class cdn::ca(
     content => file('cdn/ca/set-provisioner-pw'),
   }
 
+  file { '/opt/step-ca/init/deb':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+
+  exec { 'curl -LO https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.27.4/step-cli_0.27.4-1_amd64.deb':
+    cwd     => '/opt/step-ca/init/deb',
+    creates => '/opt/step-ca/init/deb/step-cli_0.27.4-1_amd64.deb',
+  }
+
   if $ca_secrets {
     if $ca_secrets['key_password'] {
       file { '/opt/step-ca/init/secrets/key-password':