diff --git a/docs/custom-registries.md b/docs/custom-registries.md
index 9eb1b3210..230cc5b95 100644
--- a/docs/custom-registries.md
+++ b/docs/custom-registries.md
@@ -578,3 +578,16 @@ Samples:
 ```txt
 https://github.com/vmware-tanzu/carvel-vendir/releases/download/v0.22.0/vendir-linux-amd64
 ```
+
+## `wally`
+
+Wally releases are downloaded from:
+
+- `https://github.com/containerbase/wally-prebuild/releases`
+
+Samples:
+
+```txt
+https://github.com/containerbase/wally-prebuild/releases/download/0.3.2/wally-0.3.2-jammy-x86_x64.tar.xz.sha512
+https://github.com/containerbase/wally-prebuild/releases/download/0.3.2/wally-0.3.2-jammy-x86_x64.tar.xz
+```
diff --git a/renovate.json b/renovate.json
index 776fff888..6ed368e3c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -90,7 +90,8 @@
         "sops",
         "swift",
         "uv",
-        "vendir"
+        "vendir",
+        "wally"
       ],
       "separateMinorPatch": false
     },
@@ -129,7 +130,8 @@
         "sops",
         "swift",
         "uv",
-        "vendir"
+        "vendir",
+        "wally"
       ],
       "matchUpdateTypes": ["minor", "patch"],
       "automerge": true
diff --git a/src/cli/install-tool/index.ts b/src/cli/install-tool/index.ts
index b7b4a6a49..634367514 100644
--- a/src/cli/install-tool/index.ts
+++ b/src/cli/install-tool/index.ts
@@ -62,6 +62,7 @@ import {
 } from '../tools/ruby/utils';
 import { SkopeoInstallService } from '../tools/skopeo';
 import { SopsInstallService } from '../tools/sops';
+import { WallyInstallService } from '../tools/wally';
 import { logger } from '../utils';
 import { LegacyToolInstallService } from './install-legacy-tool.service';
 import { INSTALL_TOOL_TOKEN, InstallToolService } from './install-tool.service';
@@ -106,6 +107,7 @@ function prepareInstallContainer(): Container {
   container.bind(INSTALL_TOOL_TOKEN).to(RenovateInstallService);
   container.bind(INSTALL_TOOL_TOKEN).to(SkopeoInstallService);
   container.bind(INSTALL_TOOL_TOKEN).to(SopsInstallService);
+  container.bind(INSTALL_TOOL_TOKEN).to(WallyInstallService);
   container.bind(INSTALL_TOOL_TOKEN).to(YarnInstallService);
   container.bind(INSTALL_TOOL_TOKEN).to(YarnSlimInstallService);
 
diff --git a/src/cli/tools/index.ts b/src/cli/tools/index.ts
index 9cc5f32f4..a236617f6 100644
--- a/src/cli/tools/index.ts
+++ b/src/cli/tools/index.ts
@@ -31,6 +31,7 @@ export const NoPrepareTools = [
   'skopeo',
   'sops',
   'uv',
+  'wally',
   'yarn',
   'yarn-slim',
 ];
diff --git a/src/cli/tools/wally.ts b/src/cli/tools/wally.ts
new file mode 100644
index 000000000..7d6fce168
--- /dev/null
+++ b/src/cli/tools/wally.ts
@@ -0,0 +1,76 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { execa } from 'execa';
+import { inject, injectable } from 'inversify';
+import { BaseInstallService } from '../install-tool/base-install.service';
+import {
+  CompressionService,
+  EnvService,
+  HttpService,
+  PathService,
+} from '../services';
+import { getDistro, logger } from '../utils';
+
+@injectable()
+export class WallyInstallService extends BaseInstallService {
+  readonly name = 'wally';
+
+  private get ghArch(): string {
+    switch (this.envSvc.arch) {
+      case 'arm64':
+        return 'aarch64';
+      case 'amd64':
+        return 'x86_64';
+    }
+  }
+
+  constructor(
+    @inject(EnvService) envSvc: EnvService,
+    @inject(PathService) pathSvc: PathService,
+    @inject(HttpService) private http: HttpService,
+    @inject(CompressionService) private compress: CompressionService,
+  ) {
+    super(pathSvc, envSvc);
+  }
+
+  override async install(version: string): Promise<void> {
+    const name = this.name;
+    const distro = await getDistro();
+    let code = distro.versionCode;
+
+    if (code === 'noble') {
+      logger.debug(`Using jammy prebuild for ${name} on ${code}`);
+      code = 'jammy';
+    }
+    const filename = `${name}-${version}-${code}-${this.ghArch}.tar.xz`;
+    const url = `https://github.com/containerbase/${name}-prebuild/releases/download/${version}/${filename}`;
+    const checksumFileUrl = `${url}.sha512`;
+
+    const checksumFile = await this.http.download({ url: checksumFileUrl });
+    const expectedChecksum = (await fs.readFile(checksumFile, 'utf-8')).trim();
+
+    const file = await this.http.download({
+      url,
+      checksumType: 'sha512',
+      expectedChecksum,
+    });
+
+    const cwd = await this.pathSvc.ensureToolPath(name);
+
+    await this.compress.extract({ file, cwd });
+  }
+
+  override async link(version: string): Promise<void> {
+    const src = path.join(
+      this.pathSvc.versionedToolPath(this.name, version),
+      'bin',
+    );
+    await this.shellwrapper({ srcDir: src });
+  }
+
+  override async test(_version: string): Promise<void> {
+    await execa(this.name, ['--version'], {
+      stdio: ['inherit', 'inherit', 1],
+    });
+  }
+}
diff --git a/test/Dockerfile.distro b/test/Dockerfile.distro
index 340ef5325..204f1d274 100644
--- a/test/Dockerfile.distro
+++ b/test/Dockerfile.distro
@@ -116,6 +116,9 @@ RUN install-tool jb v0.6.0
 # renovate: datasource=github-releases packageName=vmware-tanzu/carvel-vendir
 RUN install-tool vendir v0.43.0
 
+# renovate: datasource=github-releases packageName=containerbase/wally-prebuild
+RUN install-tool wally 0.3.2
+
 #--------------------------------------
 # Image: test-erlang
 #--------------------------------------
diff --git a/test/latest/Dockerfile.arm64 b/test/latest/Dockerfile.arm64
index fa2301163..b46ed9560 100644
--- a/test/latest/Dockerfile.arm64
+++ b/test/latest/Dockerfile.arm64
@@ -134,6 +134,9 @@ RUN install-tool skopeo 1.17.0
 # renovate: datasource=github-releases packageName=getsops/sops
 RUN install-tool sops v3.9.2
 
+# renovate: datasource=github-releases packageName=containerbase/wally-prebuild
+RUN install-tool wally 0.3.2
+
 #--------------------------------------
 # Image: final
 #--------------------------------------