diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 7651b4dc..2e4275ad 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -239,8 +239,17 @@ fn resolve_k8s_params(params: &ConnectionParams) -> Result<ConnectionParams, Str
         .ok_or("Missing K8s resource name")?;
     let port = params.k8s_port.ok_or("Missing K8s port")?;
 
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(
+        params.k8s_kubectl_path.clone(),
+        params.k8s_kubeconfig_path.clone(),
+    );
     let map_key = crate::k8s_tunnel::build_tunnel_key(
-        context, namespace, resource_type, resource_name, port,
+        context,
+        namespace,
+        resource_type,
+        resource_name,
+        port,
+        &options,
     );
 
     // Check for existing tunnel
@@ -262,7 +271,12 @@ fn resolve_k8s_params(params: &ConnectionParams) -> Result<ConnectionParams, Str
     );
 
     let tunnel = crate::k8s_tunnel::K8sTunnel::new(
-        context, namespace, resource_type, resource_name, port,
+        context,
+        namespace,
+        resource_type,
+        resource_name,
+        port,
+        &options,
     )
     .map_err(|e| {
         eprintln!("[Connection Error] K8s Tunnel setup failed: {}", e);
@@ -1453,6 +1467,8 @@ pub async fn save_k8s_connection<R: Runtime>(
         resource_type: k8s.resource_type,
         resource_name: k8s.resource_name,
         port: k8s.port,
+        kubectl_path: k8s.kubectl_path,
+        kubeconfig_path: k8s.kubeconfig_path,
     };
 
     connections.push(connection.clone());
@@ -1490,6 +1506,8 @@ pub async fn update_k8s_connection<R: Runtime>(
         resource_type: k8s.resource_type,
         resource_name: k8s.resource_name,
         port: k8s.port,
+        kubectl_path: k8s.kubectl_path,
+        kubeconfig_path: k8s.kubeconfig_path,
     };
 
     connections[idx] = connection.clone();
@@ -1526,23 +1544,32 @@ pub async fn test_k8s_connection_cmd<R: Runtime>(
     _app: AppHandle<R>,
     context: String,
     namespace: String,
+    kubectl_path: Option<String>,
+    kubeconfig_path: Option<String>,
 ) -> Result<String, String> {
-    crate::k8s_tunnel::test_k8s_connection(&context, &namespace)
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
+    crate::k8s_tunnel::test_k8s_connection(&context, &namespace, &options)
 }
 
 #[tauri::command]
 pub async fn get_k8s_contexts_cmd<R: Runtime>(
     _app: AppHandle<R>,
+    kubectl_path: Option<String>,
+    kubeconfig_path: Option<String>,
 ) -> Result<Vec<String>, String> {
-    crate::k8s_tunnel::get_k8s_contexts()
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
+    crate::k8s_tunnel::get_k8s_contexts(&options)
 }
 
 #[tauri::command]
 pub async fn get_k8s_namespaces_cmd<R: Runtime>(
     _app: AppHandle<R>,
     context: String,
+    kubectl_path: Option<String>,
+    kubeconfig_path: Option<String>,
 ) -> Result<Vec<String>, String> {
-    crate::k8s_tunnel::get_k8s_namespaces(&context)
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
+    crate::k8s_tunnel::get_k8s_namespaces(&context, &options)
 }
 
 #[tauri::command]
@@ -1551,8 +1578,11 @@ pub async fn get_k8s_resources_cmd<R: Runtime>(
     context: String,
     namespace: String,
     resource_type: String,
+    kubectl_path: Option<String>,
+    kubeconfig_path: Option<String>,
 ) -> Result<Vec<String>, String> {
-    crate::k8s_tunnel::get_k8s_resources(&context, &namespace, &resource_type)
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
+    crate::k8s_tunnel::get_k8s_resources(&context, &namespace, &resource_type, &options)
 }
 
 #[tauri::command]
@@ -1562,15 +1592,28 @@ pub async fn get_k8s_resource_ports_cmd<R: Runtime>(
     namespace: String,
     resource_type: String,
     resource_name: String,
+    kubectl_path: Option<String>,
+    kubeconfig_path: Option<String>,
 ) -> Result<Vec<u16>, String> {
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
     crate::k8s_tunnel::get_k8s_resource_ports(
         &context,
         &namespace,
         &resource_type,
         &resource_name,
+        &options,
     )
 }
 
+#[tauri::command]
+pub async fn validate_k8s_path_cmd<R: Runtime>(
+    _app: AppHandle<R>,
+    path: String,
+    kind: String,
+) -> Result<(), String> {
+    crate::k8s_tunnel::validate_k8s_path(&path, &kind)
+}
+
 /// Expand K8s connection params by loading saved config and creating/reusing a tunnel.
 pub async fn expand_k8s_connection_params<R: Runtime>(
     app: &AppHandle<R>,
@@ -1588,7 +1631,7 @@ pub async fn expand_k8s_connection_params<R: Runtime>(
     }
 
     // Resolve K8s params from saved connection if using connection_id
-    let (context, namespace, resource_type, resource_name, port) =
+    let (context, namespace, resource_type, resource_name, port, kubectl_path, kubeconfig_path) =
         if let Some(k8s_id) = &params.k8s_connection_id {
             let k8s_conn = get_k8s_connection_by_id(app, k8s_id).await?;
             (
@@ -1597,6 +1640,8 @@ pub async fn expand_k8s_connection_params<R: Runtime>(
                 k8s_conn.resource_type,
                 k8s_conn.resource_name,
                 k8s_conn.port,
+                k8s_conn.kubectl_path,
+                k8s_conn.kubeconfig_path,
             )
         } else {
             let ctx = params
@@ -1620,18 +1665,28 @@ pub async fn expand_k8s_connection_params<R: Runtime>(
                 .ok_or("Missing K8s resource name")?
                 .to_string();
             let p = params.k8s_port.ok_or("Missing K8s port")?;
-            (ctx, ns, rt, rn, p)
+            (
+                ctx,
+                ns,
+                rt,
+                rn,
+                p,
+                params.k8s_kubectl_path.clone(),
+                params.k8s_kubeconfig_path.clone(),
+            )
         };
 
     let _remote_host = params.host.as_deref().unwrap_or("localhost");
     let _remote_port = params.port.unwrap_or(DEFAULT_MYSQL_PORT);
 
+    let options = crate::k8s_tunnel::K8sCommandOptions::new(kubectl_path, kubeconfig_path);
     let map_key = crate::k8s_tunnel::build_tunnel_key(
         &context,
         &namespace,
         &resource_type,
         &resource_name,
         port,
+        &options,
     );
 
     // Check for existing tunnel
@@ -1666,6 +1721,7 @@ pub async fn expand_k8s_connection_params<R: Runtime>(
         &resource_type,
         &resource_name,
         port,
+        &options,
     )
     .map_err(|e| {
         eprintln!("[Connection Error] K8s Tunnel setup failed: {}", e);
diff --git a/src-tauri/src/k8s_tunnel.rs b/src-tauri/src/k8s_tunnel.rs
index 7781d43a..55e7db1e 100644
--- a/src-tauri/src/k8s_tunnel.rs
+++ b/src-tauri/src/k8s_tunnel.rs
@@ -1,7 +1,11 @@
 use std::collections::HashMap;
+use std::env;
+use std::ffi::OsString;
+use std::fs;
 use std::io::{BufRead, BufReader};
 use std::net::{TcpListener, TcpStream};
-use std::process::{Child, Command, Stdio};
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, Output, Stdio};
 use std::sync::{Arc, Mutex, OnceLock};
 use std::thread;
 use std::time::{Duration, Instant};
@@ -10,6 +14,7 @@ use std::time::{Duration, Instant};
 const K8S_TUNNEL_TIMEOUT_SECS: u64 = 15;
 const K8S_CONNECT_RETRY_MS: u64 = 200;
 const LOG_BUFFER_INITIAL_CAPACITY: usize = 64;
+const DEFAULT_KUBECTL: &str = "kubectl";
 
 #[derive(Clone)]
 pub struct K8sTunnel {
@@ -17,6 +22,41 @@ pub struct K8sTunnel {
     child: Arc<Mutex<Child>>,
 }
 
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct K8sCommandOptions {
+    pub kubectl_path: Option<String>,
+    pub kubeconfig_path: Option<String>,
+}
+
+impl K8sCommandOptions {
+    pub fn new(kubectl_path: Option<String>, kubeconfig_path: Option<String>) -> Self {
+        Self {
+            kubectl_path,
+            kubeconfig_path,
+        }
+    }
+
+    fn kubectl_path(&self) -> String {
+        normalized_path_option(&self.kubectl_path).unwrap_or_else(|| DEFAULT_KUBECTL.to_string())
+    }
+
+    fn explicit_kubeconfig_path(&self) -> Option<String> {
+        normalized_path_option(&self.kubeconfig_path)
+    }
+
+    fn effective_kubeconfig_path(&self) -> Option<OsString> {
+        self.explicit_kubeconfig_path()
+            .map(OsString::from)
+            .or_else(|| env::var_os("KUBECONFIG"))
+    }
+
+    fn effective_kubeconfig_label(&self) -> String {
+        self.effective_kubeconfig_path()
+            .map(|value| value.to_string_lossy().into_owned())
+            .unwrap_or_else(|| "<kubectl default>".to_string())
+    }
+}
+
 pub static TUNNELS: OnceLock<Mutex<HashMap<String, K8sTunnel>>> = OnceLock::new();
 
 pub fn get_tunnels() -> &'static Mutex<HashMap<String, K8sTunnel>> {
@@ -34,16 +74,17 @@ impl K8sTunnel {
         resource_type: &str,
         resource_name: &str,
         remote_port: u16,
+        options: &K8sCommandOptions,
     ) -> Result<Self, String> {
         println!(
             "[K8s Tunnel] New request: context={}, namespace={}, {}/{}:{}",
             context, namespace, resource_type, resource_name, remote_port
         );
 
-        // Verify kubectl is available
-        Self::verify_kubectl()?;
+        // Verify kubectl is available before starting a long-lived tunnel process.
+        Self::verify_kubectl(options)?;
 
-        // Allocate a free local port
+        // Allocate a free local port.
         let local_port = {
             let listener = TcpListener::bind("127.0.0.1:0").map_err(|e| {
                 let err = format!("Failed to find free local port: {}", e);
@@ -54,12 +95,9 @@ impl K8sTunnel {
         };
         println!("[K8s Tunnel] Assigned local port: {}", local_port);
 
-        // Build the kubectl port-forward command
         let port_forward_spec = format!("{}:{}", local_port, remote_port);
         let resource = format!("{}/{}", resource_type, resource_name);
-
-        let mut args = Vec::with_capacity(10);
-        args.extend([
+        let args = [
             "port-forward",
             "--context",
             context,
@@ -67,25 +105,27 @@ impl K8sTunnel {
             namespace,
             &resource,
             &port_forward_spec,
-        ]);
+        ];
 
-        println!("[K8s Tunnel] Executing: kubectl {:?}", args);
+        println!(
+            "[K8s Tunnel] Executing: {} {:?}",
+            options.kubectl_path(),
+            args
+        );
 
-        let mut child = Command::new("kubectl")
-            .args(&args)
+        let mut command = kubectl_command(options)?;
+        let mut child = command
+            .args(args)
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
             .spawn()
             .map_err(|e| {
-                let err = format!(
-                    "Failed to launch kubectl: {}. Ensure 'kubectl' is in PATH.",
-                    e
-                );
+                let err = kubectl_spawn_error(options, &e);
                 eprintln!("[K8s Tunnel Error] {}", err);
                 err
             })?;
 
-        // Capture stdout/stderr in background threads
+        // Capture stdout/stderr in background threads.
         let stdout_log = Arc::new(Mutex::new(Vec::with_capacity(LOG_BUFFER_INITIAL_CAPACITY)));
         let stderr_log = Arc::new(Mutex::new(Vec::with_capacity(LOG_BUFFER_INITIAL_CAPACITY)));
 
@@ -123,13 +163,13 @@ impl K8sTunnel {
 
         let child_arc = Arc::new(Mutex::new(child));
 
-        // Wait for the tunnel to become ready
+        // Wait for the tunnel to become ready.
         let start = Instant::now();
         let timeout = Duration::from_secs(K8S_TUNNEL_TIMEOUT_SECS);
         let mut ready = false;
 
         while start.elapsed() < timeout {
-            // Check if process is still alive
+            // Check if process is still alive.
             {
                 let mut c = child_arc.lock().unwrap();
                 if let Ok(Some(status)) = c.try_wait() {
@@ -144,7 +184,6 @@ impl K8sTunnel {
                 }
             }
 
-            // Try connecting to the local port
             match TcpStream::connect(format!("127.0.0.1:{}", local_port)) {
                 Ok(_) => {
                     println!(
@@ -182,37 +221,30 @@ impl K8sTunnel {
     pub fn stop(&self) {
         if let Ok(mut c) = self.child.lock() {
             let _ = c.kill();
-            println!(
-                "[K8s Tunnel] Stopped tunnel on port {}",
-                self.local_port
-            );
+            println!("[K8s Tunnel] Stopped tunnel on port {}", self.local_port);
         }
     }
 
-    /// Check that kubectl is available in PATH.
-    fn verify_kubectl() -> Result<(), String> {
-        let output = Command::new("kubectl")
-            .arg("version")
-            .arg("--client")
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .output()
-            .map_err(|e| {
-                format!(
-                    "kubectl not found: {}. Please install kubectl and ensure it is in PATH.",
-                    e
-                )
-            })?;
-
-        if !output.status.success() {
-            return Err("kubectl version check failed. Please verify your kubectl installation.".to_string());
+    /// Check that kubectl is available.
+    fn verify_kubectl(options: &K8sCommandOptions) -> Result<(), String> {
+        let output = run_kubectl(
+            &["version", "--client"],
+            options,
+            "kubectl version check failed. Please verify your kubectl installation",
+        )?;
+
+        if output.status.success() {
+            Ok(())
+        } else {
+            Err(
+                "kubectl version check failed. Please verify your kubectl installation."
+                    .to_string(),
+            )
         }
-
-        Ok(())
     }
 }
 
-/// Build a deterministic tunnel map key from K8s parameters.
+/// Build a deterministic tunnel map key from K8s parameters and kubectl configuration.
 #[inline]
 pub fn build_tunnel_key(
     context: &str,
@@ -220,10 +252,17 @@ pub fn build_tunnel_key(
     resource_type: &str,
     resource_name: &str,
     port: u16,
+    options: &K8sCommandOptions,
 ) -> String {
     format!(
-        "{}:{}:{}/{}:{}",
-        context, namespace, resource_type, resource_name, port
+        "{}:{}:{}/{}:{}:kubectl={}:kubeconfig={}",
+        context,
+        namespace,
+        resource_type,
+        resource_name,
+        port,
+        options.kubectl_path(),
+        options.effective_kubeconfig_label()
     )
 }
 
@@ -231,81 +270,67 @@ pub fn build_tunnel_key(
 pub fn test_k8s_connection(
     context: &str,
     namespace: &str,
+    options: &K8sCommandOptions,
 ) -> Result<String, String> {
     println!(
         "[K8s Test] Testing connection: context={}, namespace={}",
         context, namespace
     );
 
-    K8sTunnel::verify_kubectl()?;
+    K8sTunnel::verify_kubectl(options)?;
 
-    let output = Command::new("kubectl")
-        .args(["--context", context, "get", "namespace", namespace, "-o", "name"])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .output()
-        .map_err(|e| format!("Failed to execute kubectl: {}", e))?;
-
-    if output.status.success() {
-        let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        println!("[K8s Test] Connection successful: {}", stdout);
-        Ok(format!(
-            "Kubernetes connection to context '{}' namespace '{}' verified successfully!",
-            context, namespace
-        ))
-    } else {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        let err = format!("K8s connection test failed: {}", stderr.trim());
-        eprintln!("[K8s Test Error] {}", err);
-        Err(err)
-    }
+    let output = run_kubectl(
+        &[
+            "--context",
+            context,
+            "get",
+            "namespace",
+            namespace,
+            "-o",
+            "name",
+        ],
+        options,
+        "K8s connection test failed",
+    )?;
+
+    let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    println!("[K8s Test] Connection successful: {}", stdout);
+    Ok(format!(
+        "Kubernetes connection to context '{}' namespace '{}' verified successfully!",
+        context, namespace
+    ))
 }
 
 /// List available kubectl contexts from kubeconfig.
-pub fn get_k8s_contexts() -> Result<Vec<String>, String> {
-    let output = Command::new("kubectl")
-        .args(["config", "get-contexts", "-o", "name"])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .output()
-        .map_err(|e| format!("Failed to execute kubectl: {}", e))?;
+pub fn get_k8s_contexts(options: &K8sCommandOptions) -> Result<Vec<String>, String> {
+    let output = run_kubectl(
+        &["config", "get-contexts", "-o", "name"],
+        options,
+        "Failed to list K8s contexts",
+    )?;
 
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(format!("Failed to list K8s contexts: {}", stderr.trim()));
+    let contexts = parse_lines(&String::from_utf8_lossy(&output.stdout));
+    if contexts.is_empty() {
+        return Err(no_contexts_error(options));
     }
 
-    let contexts = parse_lines(&String::from_utf8_lossy(&output.stdout));
     println!("[K8s Discovery] Found {} contexts", contexts.len());
     Ok(contexts)
 }
 
 /// List namespaces in a given kubectl context.
-pub fn get_k8s_namespaces(context: &str) -> Result<Vec<String>, String> {
-    let output = Command::new("kubectl")
-        .args([
-            "--context",
-            context,
-            "get",
-            "namespaces",
-            "-o",
-            "name",
-        ])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .output()
-        .map_err(|e| format!("Failed to execute kubectl: {}", e))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(format!(
-            "Failed to list namespaces in context '{}': {}",
-            context,
-            stderr.trim()
-        ));
-    }
-
-    let namespaces = parse_lines_with_prefix(&String::from_utf8_lossy(&output.stdout), "namespace/");
+pub fn get_k8s_namespaces(
+    context: &str,
+    options: &K8sCommandOptions,
+) -> Result<Vec<String>, String> {
+    let output = run_kubectl(
+        &["--context", context, "get", "namespaces", "-o", "name"],
+        options,
+        &format!("Failed to list namespaces in context '{}'", context),
+    )?;
+
+    let namespaces =
+        parse_lines_with_prefix(&String::from_utf8_lossy(&output.stdout), "namespace/");
     println!(
         "[K8s Discovery] Found {} namespaces in context '{}'",
         namespaces.len(),
@@ -319,8 +344,8 @@ pub fn get_k8s_resources(
     context: &str,
     namespace: &str,
     resource_type: &str,
+    options: &K8sCommandOptions,
 ) -> Result<Vec<String>, String> {
-    // Validate resource type
     if resource_type != "service" && resource_type != "pod" {
         return Err(format!(
             "Unsupported resource type '{}'. Only 'service' and 'pod' are supported.",
@@ -328,8 +353,8 @@ pub fn get_k8s_resources(
         ));
     }
 
-    let output = Command::new("kubectl")
-        .args([
+    let output = run_kubectl(
+        &[
             "--context",
             context,
             "--namespace",
@@ -338,22 +363,13 @@ pub fn get_k8s_resources(
             resource_type,
             "-o",
             "name",
-        ])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .output()
-        .map_err(|e| format!("Failed to execute kubectl: {}", e))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(format!(
-            "Failed to list {} in context '{}' namespace '{}': {}",
-            resource_type,
-            context,
-            namespace,
-            stderr.trim()
-        ));
-    }
+        ],
+        options,
+        &format!(
+            "Failed to list {} in context '{}' namespace '{}'",
+            resource_type, context, namespace
+        ),
+    )?;
 
     let prefix = format!("{}/", resource_type);
     let resources = parse_lines_with_prefix(&String::from_utf8_lossy(&output.stdout), &prefix);
@@ -373,6 +389,7 @@ pub fn get_k8s_resource_ports(
     namespace: &str,
     resource_type: &str,
     resource_name: &str,
+    options: &K8sCommandOptions,
 ) -> Result<Vec<u16>, String> {
     if resource_type != "service" {
         return Err(format!(
@@ -381,8 +398,8 @@ pub fn get_k8s_resource_ports(
         ));
     }
 
-    let output = Command::new("kubectl")
-        .args([
+    let output = run_kubectl(
+        &[
             "--context",
             context,
             "--namespace",
@@ -392,194 +409,321 @@ pub fn get_k8s_resource_ports(
             resource_name,
             "-o",
             "jsonpath={.spec.ports[*].port}",
-        ])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .output()
-        .map_err(|e| format!("Failed to execute kubectl: {}", e))?;
+        ],
+        options,
+        &format!(
+            "Failed to list ports for {} '{}' in context '{}' namespace '{}'",
+            resource_type, resource_name, context, namespace
+        ),
+    )?;
+
+    Ok(parse_resource_ports(&String::from_utf8_lossy(
+        &output.stdout,
+    )))
+}
 
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
+fn kubectl_command(options: &K8sCommandOptions) -> Result<Command, String> {
+    if let Some(kubectl_path) = normalized_path_option(&options.kubectl_path) {
+        validate_kubectl_path(&kubectl_path)?;
+    }
+
+    if let Some(kubeconfig_path) = options.explicit_kubeconfig_path() {
+        validate_kubeconfig_path(&kubeconfig_path)?;
+    }
+
+    let mut command = Command::new(options.kubectl_path());
+    if let Some(kubeconfig_path) = options.effective_kubeconfig_path() {
+        command.env("KUBECONFIG", kubeconfig_path);
+    }
+    Ok(command)
+}
+
+pub fn validate_k8s_path(path: &str, kind: &str) -> Result<(), String> {
+    match kind {
+        "kubectl" => validate_kubectl_path(&expand_home_path(path.trim())),
+        "kubeconfig" => validate_kubeconfig_path(&expand_home_path(path.trim())),
+        other => Err(format!(
+            "Unsupported Kubernetes path validation kind: {}",
+            other
+        )),
+    }
+}
+
+fn validate_kubectl_path(path: &str) -> Result<(), String> {
+    if path.trim().is_empty() {
+        return Ok(());
+    }
+
+    let resolved_path = resolve_kubectl_path(path).ok_or_else(|| {
+        format!(
+            "kubectl executable was not found at '{}' or in PATH. Choose an existing executable file.",
+            path
+        )
+    })?;
+    let metadata = fs::metadata(&resolved_path).map_err(|e| {
+        format!(
+            "kubectl executable was not found at '{}': {}",
+            resolved_path.display(),
+            e
+        )
+    })?;
+
+    if !metadata.is_file() {
         return Err(format!(
-            "Failed to list ports for {} '{}' in context '{}' namespace '{}': {}",
-            resource_type,
-            resource_name,
-            context,
-            namespace,
-            stderr.trim()
+            "kubectl path must point to a file: {}",
+            resolved_path.display()
+        ));
+    }
+
+    if !is_executable_file(&resolved_path, &metadata) {
+        return Err(format!(
+            "kubectl path is not executable: {}",
+            resolved_path.display()
         ));
     }
 
-    Ok(parse_resource_ports(&String::from_utf8_lossy(&output.stdout)))
+    Ok(())
 }
 
-/// Parse newline-separated output into a list of trimmed, non-empty strings.
-fn parse_lines(output: &str) -> Vec<String> {
-    output
-        .lines()
-        .map(|l| l.trim())
-        .filter(|l| !l.is_empty())
-        .map(String::from)
-        .collect()
+fn validate_kubeconfig_path(path: &str) -> Result<(), String> {
+    if path.trim().is_empty() {
+        return Ok(());
+    }
+
+    let path_buf = PathBuf::from(path);
+    let metadata = fs::metadata(&path_buf).map_err(|e| {
+        format!(
+            "Kubeconfig file was not found at '{}': {}",
+            path_buf.display(),
+            e
+        )
+    })?;
+
+    if !metadata.is_file() {
+        return Err(format!(
+            "Kubeconfig path must point to a file: {}",
+            path_buf.display()
+        ));
+    }
+
+    Ok(())
 }
 
-/// Parse newline-separated output, stripping a prefix from each line.
-fn parse_lines_with_prefix(output: &str, prefix: &str) -> Vec<String> {
-    output
-        .lines()
-        .map(|l| l.trim().strip_prefix(prefix).unwrap_or(l.trim()))
-        .filter(|l| !l.is_empty())
-        .map(String::from)
-        .collect()
+fn resolve_kubectl_path(path: &str) -> Option<PathBuf> {
+    let path_buf = PathBuf::from(path);
+    if path_buf.is_absolute() || contains_path_separator(path) {
+        return Some(path_buf);
+    }
+
+    find_executable_in_path(path)
 }
 
-fn parse_resource_ports(output: &str) -> Vec<u16> {
-    output
-        .split_whitespace()
-        .filter_map(|value| value.parse::<u16>().ok())
-        .collect()
+fn contains_path_separator(path: &str) -> bool {
+    path.contains('/') || path.contains('\\')
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    mod build_tunnel_key_tests {
-        use super::*;
-
-        #[test]
-        fn test_basic_key_format() {
-            let key = build_tunnel_key(
-                "my-cluster",
-                "default",
-                "service",
-                "my-db",
-                3306,
-            );
-            assert_eq!(key, "my-cluster:default:service/my-db:3306");
-        }
+fn find_executable_in_path(command: &str) -> Option<PathBuf> {
+    let path_var = env::var_os("PATH")?;
+    env::split_paths(&path_var).find_map(|dir| {
+        executable_candidate_names(command)
+            .into_iter()
+            .map(|candidate| dir.join(candidate))
+            .find(|candidate| {
+                fs::metadata(candidate)
+                    .map(|metadata| metadata.is_file() && is_executable_file(candidate, &metadata))
+                    .unwrap_or(false)
+            })
+    })
+}
 
-        #[test]
-        fn test_pod_resource_type() {
-            let key = build_tunnel_key(
-                "prod-cluster",
-                "database",
-                "pod",
-                "mysql-0",
-                5432,
-            );
-            assert_eq!(key, "prod-cluster:database:pod/mysql-0:5432");
+fn executable_candidate_names(command: &str) -> Vec<OsString> {
+    #[cfg(windows)]
+    {
+        let command_path = Path::new(command);
+        if command_path.extension().is_some() {
+            return vec![OsString::from(command)];
         }
 
-        #[test]
-        fn test_empty_context() {
-            let key = build_tunnel_key("", "default", "service", "db", 80);
-            assert_eq!(key, ":default:service/db:80");
-        }
+        windows_executable_extensions()
+            .into_iter()
+            .map(|extension| OsString::from(format!("{}{}", command, extension)))
+            .collect()
+    }
 
-        #[test]
-        fn test_special_characters() {
-            let key = build_tunnel_key(
-                "gke_project_us-central1_cluster",
-                "my-namespace",
-                "service",
-                "my-db-svc",
-                3306,
-            );
-            assert_eq!(
-                key,
-                "gke_project_us-central1_cluster:my-namespace:service/my-db-svc:3306"
-            );
-        }
+    #[cfg(not(windows))]
+    {
+        vec![OsString::from(command)]
     }
+}
 
-    mod parse_lines_tests {
-        use super::*;
+fn is_executable_file(path: &Path, metadata: &fs::Metadata) -> bool {
+    if !metadata.is_file() {
+        return false;
+    }
 
-        #[test]
-        fn test_basic_lines() {
-            let output = "line1\nline2\nline3\n";
-            let result = parse_lines(output);
-            assert_eq!(result, vec!["line1", "line2", "line3"]);
-        }
+    #[cfg(unix)]
+    {
+        let _ = path;
+        use std::os::unix::fs::PermissionsExt;
+        metadata.permissions().mode() & 0o111 != 0
+    }
 
-        #[test]
-        fn test_empty_output() {
-            let result = parse_lines("");
-            assert!(result.is_empty());
-        }
+    #[cfg(windows)]
+    {
+        path.extension()
+            .and_then(|extension| extension.to_str())
+            .map(|extension| format!(".{}", extension).to_ascii_lowercase())
+            .map(|extension| {
+                windows_executable_extensions()
+                    .iter()
+                    .any(|candidate| candidate.eq_ignore_ascii_case(&extension))
+            })
+            .unwrap_or(false)
+    }
 
-        #[test]
-        fn test_whitespace_handling() {
-            let output = "  line1  \n\n  line2  \n";
-            let result = parse_lines(output);
-            assert_eq!(result, vec!["line1", "line2"]);
-        }
+    #[cfg(not(any(unix, windows)))]
+    {
+        let _ = path;
+        true
     }
+}
 
-    mod parse_lines_with_prefix_tests {
-        use super::*;
+#[cfg(windows)]
+fn windows_executable_extensions() -> Vec<String> {
+    env::var_os("PATHEXT")
+        .map(|value| {
+            env::split_paths(&value)
+                .filter_map(|path| path.as_os_str().to_str().map(String::from))
+                .collect::<Vec<_>>()
+        })
+        .filter(|extensions| !extensions.is_empty())
+        .unwrap_or_else(|| {
+            vec![
+                ".COM".to_string(),
+                ".EXE".to_string(),
+                ".BAT".to_string(),
+                ".CMD".to_string(),
+            ]
+        })
+}
 
-        #[test]
-        fn test_namespace_prefix() {
-            let output = "namespace/default\nnamespace/kube-system\nnamespace/my-ns\n";
-            let result = parse_lines_with_prefix(output, "namespace/");
-            assert_eq!(result, vec!["default", "kube-system", "my-ns"]);
-        }
+fn run_kubectl(
+    args: &[&str],
+    options: &K8sCommandOptions,
+    failure_context: &str,
+) -> Result<Output, String> {
+    let mut command = kubectl_command(options)?;
+    let output = command
+        .args(args)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .output()
+        .map_err(|e| kubectl_spawn_error(options, &e))?;
 
-        #[test]
-        fn test_service_prefix() {
-            let output = "service/my-db\nservice/api-gateway\n";
-            let result = parse_lines_with_prefix(output, "service/");
-            assert_eq!(result, vec!["my-db", "api-gateway"]);
-        }
+    if output.status.success() {
+        return Ok(output);
+    }
 
-        #[test]
-        fn test_pod_prefix() {
-            let output = "pod/mysql-0\npod/mysql-1\n";
-            let result = parse_lines_with_prefix(output, "pod/");
-            assert_eq!(result, vec!["mysql-0", "mysql-1"]);
-        }
+    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+    if stderr.is_empty() {
+        Err(format!(
+            "{}: kubectl exited with status {}",
+            failure_context, output.status
+        ))
+    } else {
+        Err(format!("{}: {}", failure_context, stderr))
+    }
+}
 
-        #[test]
-        fn test_no_match_returns_full_line() {
-            let output = "something/else\n";
-            let result = parse_lines_with_prefix(output, "namespace/");
-            assert_eq!(result, vec!["something/else"]);
-        }
+fn kubectl_spawn_error(options: &K8sCommandOptions, error: &std::io::Error) -> String {
+    if let Some(kubectl_path) = normalized_path_option(&options.kubectl_path) {
+        format!(
+            "kubectl executable was not found at '{}': {}. Set a valid kubectl path.",
+            kubectl_path, error
+        )
+    } else {
+        format!(
+            "kubectl executable was not found: {}. Install kubectl or set a kubectl path.",
+            error
+        )
+    }
+}
 
-        #[test]
-        fn test_empty_output() {
-            let result = parse_lines_with_prefix("", "namespace/");
-            assert!(result.is_empty());
-        }
+fn no_contexts_error(options: &K8sCommandOptions) -> String {
+    if let Some(kubeconfig_path) = options.explicit_kubeconfig_path() {
+        format!(
+            "kubectl did not find any Kubernetes contexts in configured kubeconfig '{}'. Choose a different kubeconfig path or verify the file contains contexts.",
+            kubeconfig_path
+        )
+    } else if let Some(kubeconfig_path) = env::var_os("KUBECONFIG") {
+        format!(
+            "kubectl did not find any Kubernetes contexts using KUBECONFIG='{}'. Choose a kubeconfig path or verify the file contains contexts.",
+            kubeconfig_path.to_string_lossy()
+        )
+    } else {
+        "kubectl did not find any Kubernetes contexts. Set KUBECONFIG or choose a kubeconfig path."
+            .to_string()
     }
+}
 
-    mod parse_resource_ports_tests {
-        use super::*;
+fn normalized_option(value: &Option<String>) -> Option<String> {
+    value
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(String::from)
+}
 
-        #[test]
-        fn test_single_port() {
-            let result = parse_resource_ports("5432");
-            assert_eq!(result, vec![5432]);
-        }
+fn normalized_path_option(value: &Option<String>) -> Option<String> {
+    normalized_option(value).map(|value| expand_home_path(&value))
+}
 
-        #[test]
-        fn test_multiple_ports() {
-            let result = parse_resource_ports("80 443 5432");
-            assert_eq!(result, vec![80, 443, 5432]);
-        }
+fn expand_home_path(value: &str) -> String {
+    let Some(rest) = value
+        .strip_prefix("~/")
+        .or_else(|| value.strip_prefix("~\\"))
+    else {
+        return value.to_string();
+    };
+
+    match home_dir() {
+        Some(home) => home.join(rest).to_string_lossy().into_owned(),
+        None => value.to_string(),
+    }
+}
 
-        #[test]
-        fn test_ignores_invalid_values() {
-            let result = parse_resource_ports("abc 3306 70000 8123");
-            assert_eq!(result, vec![3306, 8123]);
-        }
+fn home_dir() -> Option<PathBuf> {
+    env::var_os("HOME")
+        .map(PathBuf::from)
+        .or_else(|| env::var_os("USERPROFILE").map(PathBuf::from))
+}
 
-        #[test]
-        fn test_empty_output() {
-            let result = parse_resource_ports("");
-            assert!(result.is_empty());
-        }
-    }
+/// Parse newline-separated output into a list of trimmed, non-empty strings.
+fn parse_lines(output: &str) -> Vec<String> {
+    output
+        .lines()
+        .map(|l| l.trim())
+        .filter(|l| !l.is_empty())
+        .map(String::from)
+        .collect()
 }
+
+/// Parse newline-separated output, stripping a prefix from each line.
+fn parse_lines_with_prefix(output: &str, prefix: &str) -> Vec<String> {
+    output
+        .lines()
+        .map(|l| l.trim().strip_prefix(prefix).unwrap_or(l.trim()))
+        .filter(|l| !l.is_empty())
+        .map(String::from)
+        .collect()
+}
+
+fn parse_resource_ports(output: &str) -> Vec<u16> {
+    output
+        .split_whitespace()
+        .filter_map(|value| value.parse::<u16>().ok())
+        .collect()
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src-tauri/src/k8s_tunnel/tests.rs b/src-tauri/src/k8s_tunnel/tests.rs
new file mode 100644
index 00000000..aa854186
--- /dev/null
+++ b/src-tauri/src/k8s_tunnel/tests.rs
@@ -0,0 +1,248 @@
+use super::*;
+
+mod build_tunnel_key_tests {
+    use super::*;
+
+    #[test]
+    fn test_basic_key_format() {
+        let options = K8sCommandOptions::default();
+        let key = build_tunnel_key("my-cluster", "default", "service", "my-db", 3306, &options);
+        assert_eq!(
+            key,
+            "my-cluster:default:service/my-db:3306:kubectl=kubectl:kubeconfig=<kubectl default>"
+        );
+    }
+
+    #[test]
+    fn test_key_includes_overrides() {
+        let options = K8sCommandOptions::new(
+            Some("/usr/local/bin/kubectl".to_string()),
+            Some("/tmp/kubeconfig".to_string()),
+        );
+        let key = build_tunnel_key("prod", "database", "pod", "mysql-0", 5432, &options);
+        assert_eq!(
+            key,
+            "prod:database:pod/mysql-0:5432:kubectl=/usr/local/bin/kubectl:kubeconfig=/tmp/kubeconfig"
+        );
+    }
+
+    #[test]
+    fn test_empty_context() {
+        let options = K8sCommandOptions::default();
+        let key = build_tunnel_key("", "default", "service", "db", 80, &options);
+        assert_eq!(
+            key,
+            ":default:service/db:80:kubectl=kubectl:kubeconfig=<kubectl default>"
+        );
+    }
+}
+
+mod command_options_tests {
+    use super::*;
+
+    #[test]
+    fn test_empty_overrides_are_ignored() {
+        let options = K8sCommandOptions::new(Some("  ".to_string()), Some("".to_string()));
+        assert_eq!(options.kubectl_path(), "kubectl");
+        assert_eq!(options.explicit_kubeconfig_path(), None);
+    }
+
+    #[test]
+    fn test_tilde_paths_are_expanded() {
+        if let Some(home) = home_dir() {
+            let options = K8sCommandOptions::new(
+                Some("~/bin/kubectl".to_string()),
+                Some("~/.kube.bak/config".to_string()),
+            );
+            assert_eq!(
+                options.kubectl_path(),
+                home.join("bin/kubectl").to_string_lossy()
+            );
+            assert_eq!(
+                options.explicit_kubeconfig_path().as_deref(),
+                Some(home.join(".kube.bak/config").to_string_lossy().as_ref())
+            );
+        }
+    }
+
+    #[test]
+    fn test_no_contexts_error_mentions_explicit_kubeconfig() {
+        let options = K8sCommandOptions::new(None, Some("/tmp/missing-contexts".to_string()));
+        assert!(
+            no_contexts_error(&options).contains("configured kubeconfig '/tmp/missing-contexts'")
+        );
+    }
+}
+
+mod path_validation_tests {
+    use super::*;
+
+    fn write_temp_file(dir: &tempfile::TempDir, name: &str) -> PathBuf {
+        let path = dir.path().join(name);
+        std::fs::write(&path, "test").unwrap();
+        path
+    }
+
+    fn make_executable(path: &Path) {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mut permissions = std::fs::metadata(path).unwrap().permissions();
+            permissions.set_mode(0o755);
+            std::fs::set_permissions(path, permissions).unwrap();
+        }
+
+        #[cfg(not(unix))]
+        {
+            let _ = path;
+        }
+    }
+
+    #[test]
+    fn test_empty_paths_are_valid() {
+        assert!(validate_k8s_path("", "kubectl").is_ok());
+        assert!(validate_k8s_path("  ", "kubeconfig").is_ok());
+    }
+
+    #[test]
+    fn test_kubeconfig_file_must_exist() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-config");
+        let err = validate_k8s_path(missing.to_str().unwrap(), "kubeconfig").unwrap_err();
+        assert!(err.contains("Kubeconfig file was not found"));
+    }
+
+    #[test]
+    fn test_kubeconfig_file_is_valid() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_temp_file(&dir, "config");
+        assert!(validate_k8s_path(path.to_str().unwrap(), "kubeconfig").is_ok());
+    }
+
+    #[test]
+    fn test_kubeconfig_directory_is_invalid() {
+        let dir = tempfile::tempdir().unwrap();
+        let err = validate_k8s_path(dir.path().to_str().unwrap(), "kubeconfig").unwrap_err();
+        assert!(err.contains("Kubeconfig path must point to a file"));
+    }
+
+    #[test]
+    fn test_kubectl_file_must_exist() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-kubectl");
+        let err = validate_k8s_path(missing.to_str().unwrap(), "kubectl").unwrap_err();
+        assert!(err.contains("kubectl executable was not found"));
+    }
+
+    #[test]
+    fn test_kubectl_executable_file_is_valid() {
+        let dir = tempfile::tempdir().unwrap();
+        let file_name = if cfg!(windows) {
+            "kubectl.exe"
+        } else {
+            "kubectl"
+        };
+        let path = write_temp_file(&dir, file_name);
+        make_executable(&path);
+        assert!(validate_k8s_path(path.to_str().unwrap(), "kubectl").is_ok());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_kubectl_non_executable_file_is_invalid() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_temp_file(&dir, "kubectl");
+        let err = validate_k8s_path(path.to_str().unwrap(), "kubectl").unwrap_err();
+        assert!(err.contains("kubectl path is not executable"));
+    }
+}
+
+mod parse_lines_tests {
+    use super::*;
+
+    #[test]
+    fn test_basic_lines() {
+        let output = "line1\nline2\nline3\n";
+        let result = parse_lines(output);
+        assert_eq!(result, vec!["line1", "line2", "line3"]);
+    }
+
+    #[test]
+    fn test_empty_output() {
+        let result = parse_lines("");
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn test_whitespace_handling() {
+        let output = "  line1  \n\n  line2  \n";
+        let result = parse_lines(output);
+        assert_eq!(result, vec!["line1", "line2"]);
+    }
+}
+
+mod parse_lines_with_prefix_tests {
+    use super::*;
+
+    #[test]
+    fn test_namespace_prefix() {
+        let output = "namespace/default\nnamespace/kube-system\nnamespace/my-ns\n";
+        let result = parse_lines_with_prefix(output, "namespace/");
+        assert_eq!(result, vec!["default", "kube-system", "my-ns"]);
+    }
+
+    #[test]
+    fn test_service_prefix() {
+        let output = "service/my-db\nservice/api-gateway\n";
+        let result = parse_lines_with_prefix(output, "service/");
+        assert_eq!(result, vec!["my-db", "api-gateway"]);
+    }
+
+    #[test]
+    fn test_pod_prefix() {
+        let output = "pod/mysql-0\npod/mysql-1\n";
+        let result = parse_lines_with_prefix(output, "pod/");
+        assert_eq!(result, vec!["mysql-0", "mysql-1"]);
+    }
+
+    #[test]
+    fn test_no_match_returns_full_line() {
+        let output = "something/else\n";
+        let result = parse_lines_with_prefix(output, "namespace/");
+        assert_eq!(result, vec!["something/else"]);
+    }
+
+    #[test]
+    fn test_empty_output() {
+        let result = parse_lines_with_prefix("", "namespace/");
+        assert!(result.is_empty());
+    }
+}
+
+mod parse_resource_ports_tests {
+    use super::*;
+
+    #[test]
+    fn test_single_port() {
+        let result = parse_resource_ports("5432");
+        assert_eq!(result, vec![5432]);
+    }
+
+    #[test]
+    fn test_multiple_ports() {
+        let result = parse_resource_ports("80 443 5432");
+        assert_eq!(result, vec![80, 443, 5432]);
+    }
+
+    #[test]
+    fn test_ignores_invalid_values() {
+        let result = parse_resource_ports("abc 3306 70000 8123");
+        assert_eq!(result, vec![3306, 8123]);
+    }
+
+    #[test]
+    fn test_empty_output() {
+        let result = parse_resource_ports("");
+        assert!(result.is_empty());
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index bcdd0f93..24ccf271 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -292,6 +292,7 @@ pub fn run() {
             commands::get_k8s_namespaces_cmd,
             commands::get_k8s_resources_cmd,
             commands::get_k8s_resource_ports_cmd,
+            commands::validate_k8s_path_cmd,
             // Connection Groups
             commands::get_connection_groups,
             commands::get_connections_with_groups,
diff --git a/src-tauri/src/mcp/mod.rs b/src-tauri/src/mcp/mod.rs
index 687062b2..85018da1 100644
--- a/src-tauri/src/mcp/mod.rs
+++ b/src-tauri/src/mcp/mod.rs
@@ -212,6 +212,8 @@ async fn expand_k8s_params_for_mcp(
     expanded.k8s_resource_type = Some(k8s.resource_type);
     expanded.k8s_resource_name = Some(k8s.resource_name);
     expanded.k8s_port = Some(k8s.port);
+    expanded.k8s_kubectl_path = k8s.kubectl_path;
+    expanded.k8s_kubeconfig_path = k8s.kubeconfig_path;
 
     Ok(expanded)
 }
diff --git a/src-tauri/src/models.rs b/src-tauri/src/models.rs
index eba9d080..c895d8c4 100644
--- a/src-tauri/src/models.rs
+++ b/src-tauri/src/models.rs
@@ -157,6 +157,10 @@ pub struct ConnectionParams {
     pub k8s_resource_name: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub k8s_port: Option<u16>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub k8s_kubectl_path: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub k8s_kubeconfig_path: Option<String>,
     // Connection ID for stable pooling (not persisted, set at runtime)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub connection_id: Option<String>,
@@ -221,6 +225,10 @@ pub struct K8sConnection {
     pub resource_type: String, // "service" or "pod"
     pub resource_name: String,
     pub port: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub kubectl_path: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub kubeconfig_path: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
@@ -231,6 +239,10 @@ pub struct K8sConnectionInput {
     pub resource_type: String,
     pub resource_name: String,
     pub port: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub kubectl_path: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub kubeconfig_path: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
diff --git a/src-tauri/src/plugins/driver.rs b/src-tauri/src/plugins/driver.rs
index 70aa77b9..bed371ff 100644
--- a/src-tauri/src/plugins/driver.rs
+++ b/src-tauri/src/plugins/driver.rs
@@ -840,6 +840,8 @@ mod tests {
             k8s_resource_type: None,
             k8s_resource_name: None,
             k8s_port: None,
+            k8s_kubectl_path: None,
+            k8s_kubeconfig_path: None,
             connection_id: Some("conn-1".to_string()),
         }
     }
diff --git a/src/components/modals/K8sConnectionsModal.tsx b/src/components/modals/K8sConnectionsModal.tsx
index 5225f1d0..08bf1820 100644
--- a/src/components/modals/K8sConnectionsModal.tsx
+++ b/src/components/modals/K8sConnectionsModal.tsx
@@ -1,5 +1,6 @@
 import { useState, useEffect, useCallback } from "react";
 import { useTranslation } from "react-i18next";
+import { useLatestAsync } from "../../hooks/useLatestAsync";
 import {
   X,
   Plus,
@@ -9,6 +10,8 @@ import {
   Loader2,
   Zap,
   XCircle,
+  AlertCircle,
+  ChevronDown,
 } from "lucide-react";
 import {
   loadK8sConnections,
@@ -21,8 +24,10 @@ import {
   getK8sResources,
   getK8sResourcePorts,
   validateK8sConnection,
+  validateK8sPath,
   type K8sConnection,
   type K8sConnectionInput,
+  type K8sPathValidationKind,
 } from "../../utils/k8s";
 import { toErrorMessage } from "../../utils/errors";
 import { Modal } from "../ui/Modal";
@@ -39,6 +44,20 @@ const InputClass =
   "w-full px-3 pt-2 pb-1 bg-base border border-strong rounded-lg text-primary focus:border-blue-500 focus:outline-none leading-tight";
 const LabelClass = "block text-xs uppercase font-bold text-muted mb-1";
 
+type PathValidationStatus = "idle" | "validating" | "valid" | "invalid";
+
+interface PathValidationState {
+  status: PathValidationStatus;
+  value: string;
+  message: string | null;
+}
+
+const EmptyPathValidationState: PathValidationState = {
+  status: "idle",
+  value: "",
+  message: null,
+};
+
 export function K8sConnectionsModal({
   isOpen,
   onClose,
@@ -59,11 +78,19 @@ export function K8sConnectionsModal({
   const [port, setPort] = useState<number | undefined>(undefined);
   const effectivePort = port ?? effectiveDefaultPort;
   const [isPortOverridden, setIsPortOverridden] = useState(false);
+  const [kubectlPath, setKubectlPath] = useState("");
+  const [kubeconfigPath, setKubeconfigPath] = useState("");
+  const [appliedKubectlPath, setAppliedKubectlPath] = useState("");
+  const [appliedKubeconfigPath, setAppliedKubeconfigPath] = useState("");
+  const [kubectlPathValidation, setKubectlPathValidation] = useState<PathValidationState>(EmptyPathValidationState);
+  const [kubeconfigPathValidation, setKubeconfigPathValidation] = useState<PathValidationState>(EmptyPathValidationState);
+  const [showAdvanced, setShowAdvanced] = useState(false);
 
   // Discovery state
   const [contexts, setContexts] = useState<string[]>([]);
   const [namespaces, setNamespaces] = useState<string[]>([]);
   const [resources, setResources] = useState<string[]>([]);
+  const [discoveryError, setDiscoveryError] = useState<string | null>(null);
 
   // Status
   const [testStatus, setTestStatus] = useState<
@@ -72,19 +99,36 @@ export function K8sConnectionsModal({
   const [testMessage, setTestMessage] = useState("");
   const [validationError, setValidationError] = useState<string | null>(null);
 
+  // Guards fire-and-forget async so only the latest call per key can write state.
+  const run = useLatestAsync();
+
   const loadConnections = useCallback(async () => {
     const result = await loadK8sConnections();
     setConnections(result);
   }, []);
 
+  const getCommandOptions = useCallback(
+    () => ({
+      kubectl_path: appliedKubectlPath,
+      kubeconfig_path: appliedKubeconfigPath,
+    }),
+    [appliedKubectlPath, appliedKubeconfigPath],
+  );
+
   const loadContexts = useCallback(async () => {
-    try {
-      const result = await getK8sContexts();
-      setContexts(result);
-    } catch {
-      setContexts([]);
-    }
-  }, []);
+    await run("contexts", async (isLatest) => {
+      try {
+        const result = await getK8sContexts(getCommandOptions());
+        if (!isLatest()) return;
+        setContexts(result);
+        setDiscoveryError(null);
+      } catch (error) {
+        if (!isLatest()) return;
+        setContexts([]);
+        setDiscoveryError(toErrorMessage(error));
+      }
+    });
+  }, [getCommandOptions, run]);
 
   useEffect(() => {
     if (!isOpen) return;
@@ -96,34 +140,42 @@ export function K8sConnectionsModal({
   }, [isOpen, loadConnections, loadContexts]);
 
   useEffect(() => {
-    void (async () => {
+    void run("namespaces", async (isLatest) => {
       if (!context) {
         setNamespaces([]);
         return;
       }
-
       try {
-        setNamespaces(await getK8sNamespaces(context));
-      } catch {
+        const result = await getK8sNamespaces(context, getCommandOptions());
+        if (!isLatest()) return;
+        setNamespaces(result);
+        setDiscoveryError(null);
+      } catch (error) {
+        if (!isLatest()) return;
         setNamespaces([]);
+        setDiscoveryError(toErrorMessage(error));
       }
-    })();
-  }, [context]);
+    });
+  }, [context, getCommandOptions, run]);
 
   useEffect(() => {
-    void (async () => {
+    void run("resources", async (isLatest) => {
       if (!context || !namespace || !resourceType) {
         setResources([]);
         return;
       }
-
       try {
-        setResources(await getK8sResources(context, namespace, resourceType));
-      } catch {
+        const result = await getK8sResources(context, namespace, resourceType, getCommandOptions());
+        if (!isLatest()) return;
+        setResources(result);
+        setDiscoveryError(null);
+      } catch (error) {
+        if (!isLatest()) return;
         setResources([]);
+        setDiscoveryError(toErrorMessage(error));
       }
-    })();
-  }, [context, namespace, resourceType]);
+    });
+  }, [context, namespace, resourceType, getCommandOptions, run]);
 
   useEffect(() => {
     if (
@@ -144,6 +196,7 @@ export function K8sConnectionsModal({
           namespace,
           resourceType,
           resourceName,
+          getCommandOptions(),
         );
         if (!cancelled && ports.length === 1) {
           setPort((prev) => (prev === ports[0] ? prev : ports[0]));
@@ -156,7 +209,7 @@ export function K8sConnectionsModal({
     return () => {
       cancelled = true;
     };
-  }, [context, namespace, resourceType, resourceName, isPortOverridden]);
+  }, [context, namespace, resourceType, resourceName, isPortOverridden, getCommandOptions]);
 
   const resetForm = () => {
     setName("");
@@ -166,9 +219,17 @@ export function K8sConnectionsModal({
     setResourceName("");
     setPort(undefined);
     setIsPortOverridden(false);
+    setKubectlPath("");
+    setKubeconfigPath("");
+    setAppliedKubectlPath("");
+    setAppliedKubeconfigPath("");
+    setKubectlPathValidation(EmptyPathValidationState);
+    setKubeconfigPathValidation(EmptyPathValidationState);
+    setShowAdvanced(false);
     setTestStatus("idle");
     setTestMessage("");
     setValidationError(null);
+    setDiscoveryError(null);
   };
 
   const handleCreate = () => {
@@ -185,11 +246,19 @@ export function K8sConnectionsModal({
     setResourceName(conn.resource_name);
     setPort(conn.port);
     setIsPortOverridden(true);
+    setKubectlPath(conn.kubectl_path ?? "");
+    setKubeconfigPath(conn.kubeconfig_path ?? "");
+    setAppliedKubectlPath(conn.kubectl_path ?? "");
+    setAppliedKubeconfigPath(conn.kubeconfig_path ?? "");
+    setKubectlPathValidation(EmptyPathValidationState);
+    setKubeconfigPathValidation(EmptyPathValidationState);
+    setShowAdvanced(Boolean(conn.kubectl_path || conn.kubeconfig_path));
     setEditingId(conn.id);
     setIsCreating(false);
     setTestStatus("idle");
     setTestMessage("");
     setValidationError(null);
+    setDiscoveryError(null);
   };
 
   const handleCancel = () => {
@@ -199,6 +268,27 @@ export function K8sConnectionsModal({
   };
 
   const handleSave = async () => {
+    const pathsValid = await validateAdvancedPathsForSave();
+    if (!pathsValid) {
+      setValidationError(
+        t("k8sConnections.pathValidationFailed", {
+          defaultValue: "Fix invalid advanced path fields before saving.",
+        }),
+      );
+      return;
+    }
+
+    if (haveAdvancedPathInputsChanged()) {
+      applyAdvancedPaths();
+      setValidationError(
+        t("k8sConnections.pathSelectionReset", {
+          defaultValue:
+            "Advanced paths changed. Choose the context, namespace, and resource again.",
+        }),
+      );
+      return;
+    }
+
     const validation = validateK8sConnection({
       name,
       context,
@@ -206,6 +296,8 @@ export function K8sConnectionsModal({
       resource_type: resourceType,
       resource_name: resourceName,
       port: effectivePort,
+      kubectl_path: kubectlPath.trim() || undefined,
+      kubeconfig_path: kubeconfigPath.trim() || undefined,
     });
     if (!validation.isValid) {
       setValidationError(t(validation.errorKey));
@@ -240,7 +332,7 @@ export function K8sConnectionsModal({
     if (!context || !namespace) return;
     setTestStatus("testing");
     try {
-      const result = await testK8sConnection(context, namespace);
+      const result = await testK8sConnection(context, namespace, getCommandOptions());
       setTestStatus("success");
       setTestMessage(result);
     } catch (error) {
@@ -249,6 +341,154 @@ export function K8sConnectionsModal({
     }
   };
 
+  const handleContextChange = (value: string) => {
+    setContext(value);
+    setNamespace("");
+    setResourceName("");
+    setResources([]);
+    setDiscoveryError(null);
+  };
+
+  const handleNamespaceChange = (value: string) => {
+    setNamespace(value);
+    setResourceName("");
+    setResources([]);
+    setDiscoveryError(null);
+  };
+
+  const applyAdvancedPaths = useCallback(() => {
+    const nextKubectlPath = kubectlPath.trim();
+    const nextKubeconfigPath = kubeconfigPath.trim();
+    if (
+      nextKubectlPath === appliedKubectlPath &&
+      nextKubeconfigPath === appliedKubeconfigPath
+    ) {
+      return;
+    }
+
+    setAppliedKubectlPath(nextKubectlPath);
+    setAppliedKubeconfigPath(nextKubeconfigPath);
+    setContext("");
+    setNamespace("");
+    setResourceName("");
+    setNamespaces([]);
+    setResources([]);
+    setDiscoveryError(null);
+    setTestStatus("idle");
+    setTestMessage("");
+  }, [appliedKubeconfigPath, appliedKubectlPath, kubeconfigPath, kubectlPath]);
+
+  const isPathReadyToApply = useCallback(
+    (
+      kind: K8sPathValidationKind,
+      currentValue: string,
+      state: PathValidationState,
+      nextValidPath?: { kind: K8sPathValidationKind; value: string },
+    ) => {
+      if (!currentValue) return true;
+      if (nextValidPath?.kind === kind && nextValidPath.value === currentValue) {
+        return true;
+      }
+
+      return state.status === "valid" && state.value === currentValue;
+    },
+    [],
+  );
+
+  const areAdvancedPathsReadyToApply = useCallback(
+    (nextValidPath?: { kind: K8sPathValidationKind; value: string }) => {
+      const nextKubectlPath = kubectlPath.trim();
+      const nextKubeconfigPath = kubeconfigPath.trim();
+
+      return (
+        isPathReadyToApply(
+          "kubectl",
+          nextKubectlPath,
+          kubectlPathValidation,
+          nextValidPath,
+        ) &&
+        isPathReadyToApply(
+          "kubeconfig",
+          nextKubeconfigPath,
+          kubeconfigPathValidation,
+          nextValidPath,
+        )
+      );
+    },
+    [
+      isPathReadyToApply,
+      kubeconfigPath,
+      kubeconfigPathValidation,
+      kubectlPath,
+      kubectlPathValidation,
+    ],
+  );
+
+  const validateAdvancedPath = async (
+    kind: K8sPathValidationKind,
+    applyOnSuccess = true,
+  ) => {
+    const path = kind === "kubectl" ? kubectlPath : kubeconfigPath;
+    const trimmedPath = path.trim();
+    const setPathValidation =
+      kind === "kubectl" ? setKubectlPathValidation : setKubeconfigPathValidation;
+
+    if (!trimmedPath) {
+      setPathValidation(EmptyPathValidationState);
+      if (applyOnSuccess && areAdvancedPathsReadyToApply({ kind, value: "" })) {
+        applyAdvancedPaths();
+      }
+      return true;
+    }
+
+    setPathValidation({ status: "validating", value: trimmedPath, message: null });
+    return run(kind, async (isLatest) => {
+      try {
+        await validateK8sPath(trimmedPath, kind);
+        if (isLatest()) {
+          setPathValidation({ status: "valid", value: trimmedPath, message: null });
+        }
+        if (isLatest() && applyOnSuccess && areAdvancedPathsReadyToApply({ kind, value: trimmedPath })) {
+          applyAdvancedPaths();
+        }
+        return true;
+      } catch (error) {
+        if (isLatest()) {
+          setPathValidation({
+            status: "invalid",
+            value: trimmedPath,
+            message: toErrorMessage(error),
+          });
+        }
+        return false;
+      }
+    });
+  };
+
+  const haveAdvancedPathInputsChanged = useCallback(() => {
+    return (
+      kubectlPath.trim() !== appliedKubectlPath ||
+      kubeconfigPath.trim() !== appliedKubeconfigPath
+    );
+  }, [appliedKubeconfigPath, appliedKubectlPath, kubeconfigPath, kubectlPath]);
+
+  const validateAdvancedPathsForSave = async () => {
+    const kubectlPathValid = await validateAdvancedPath("kubectl", false);
+    const kubeconfigPathValid = await validateAdvancedPath("kubeconfig", false);
+
+    return kubectlPathValid && kubeconfigPathValid;
+  };
+
+  const handleKubectlPathChange = (value: string) => {
+    setKubectlPath(value);
+    setKubectlPathValidation(EmptyPathValidationState);
+  };
+
+  const handleKubeconfigPathChange = (value: string) => {
+    setKubeconfigPath(value);
+    setKubeconfigPathValidation(EmptyPathValidationState);
+  };
+
   return (
     <Modal
       isOpen={isOpen}
@@ -295,9 +535,9 @@ export function K8sConnectionsModal({
                   name={name}
                   setName={setName}
                   context={context}
-                  setContext={setContext}
+                  setContext={handleContextChange}
                   namespace={namespace}
-                  setNamespace={setNamespace}
+                  setNamespace={handleNamespaceChange}
                   resourceType={resourceType}
                   setResourceType={setResourceType}
                   resourceName={resourceName}
@@ -311,6 +551,17 @@ export function K8sConnectionsModal({
                   contexts={contexts}
                   namespaces={namespaces}
                   resources={resources}
+                  kubectlPath={kubectlPath}
+                  setKubectlPath={handleKubectlPathChange}
+                  kubectlPathValidation={kubectlPathValidation}
+                  onKubectlPathBlur={() => void validateAdvancedPath("kubectl")}
+                  kubeconfigPath={kubeconfigPath}
+                  setKubeconfigPath={handleKubeconfigPathChange}
+                  kubeconfigPathValidation={kubeconfigPathValidation}
+                  onKubeconfigPathBlur={() => void validateAdvancedPath("kubeconfig")}
+                  showAdvanced={showAdvanced}
+                  setShowAdvanced={setShowAdvanced}
+                  discoveryError={discoveryError}
                   validationError={validationError}
                   testStatus={testStatus}
                   testMessage={testMessage}
@@ -357,9 +608,9 @@ export function K8sConnectionsModal({
                 name={name}
                 setName={setName}
                 context={context}
-                setContext={setContext}
+                setContext={handleContextChange}
                 namespace={namespace}
-                setNamespace={setNamespace}
+                setNamespace={handleNamespaceChange}
                 resourceType={resourceType}
                 setResourceType={setResourceType}
                 resourceName={resourceName}
@@ -373,6 +624,17 @@ export function K8sConnectionsModal({
                 contexts={contexts}
                 namespaces={namespaces}
                 resources={resources}
+                kubectlPath={kubectlPath}
+                setKubectlPath={handleKubectlPathChange}
+                kubectlPathValidation={kubectlPathValidation}
+                onKubectlPathBlur={() => void validateAdvancedPath("kubectl")}
+                kubeconfigPath={kubeconfigPath}
+                setKubeconfigPath={handleKubeconfigPathChange}
+                kubeconfigPathValidation={kubeconfigPathValidation}
+                onKubeconfigPathBlur={() => void validateAdvancedPath("kubeconfig")}
+                showAdvanced={showAdvanced}
+                setShowAdvanced={setShowAdvanced}
+                discoveryError={discoveryError}
                 validationError={validationError}
                 testStatus={testStatus}
                 testMessage={testMessage}
@@ -417,6 +679,17 @@ interface EditFormProps {
   contexts: string[];
   namespaces: string[];
   resources: string[];
+  kubectlPath: string;
+  setKubectlPath: (v: string) => void;
+  kubectlPathValidation: PathValidationState;
+  onKubectlPathBlur: () => void;
+  kubeconfigPath: string;
+  setKubeconfigPath: (v: string) => void;
+  kubeconfigPathValidation: PathValidationState;
+  onKubeconfigPathBlur: () => void;
+  showAdvanced: boolean;
+  setShowAdvanced: (v: boolean) => void;
+  discoveryError: string | null;
   validationError: string | null;
   testStatus: "idle" | "testing" | "success" | "error";
   testMessage: string;
@@ -442,6 +715,17 @@ function EditForm({
   contexts,
   namespaces,
   resources,
+  kubectlPath,
+  setKubectlPath,
+  kubectlPathValidation,
+  onKubectlPathBlur,
+  kubeconfigPath,
+  setKubeconfigPath,
+  kubeconfigPathValidation,
+  onKubeconfigPathBlur,
+  showAdvanced,
+  setShowAdvanced,
+  discoveryError,
   validationError,
   testStatus,
   testMessage,
@@ -470,7 +754,9 @@ function EditForm({
           onChange={(val) => setContext(val)}
           placeholder={t("k8sConnections.chooseContext")}
           searchPlaceholder={t("common.search")}
-          noResultsLabel={t("common.noResults")}
+          noResultsLabel={t("k8sConnections.noContexts", {
+            defaultValue: "No contexts available",
+          })}
         />
       </div>
 
@@ -482,7 +768,9 @@ function EditForm({
           onChange={(val) => setNamespace(val)}
           placeholder={t("k8sConnections.chooseNamespace")}
           searchPlaceholder={t("common.search")}
-          noResultsLabel={t("common.noResults")}
+          noResultsLabel={t("k8sConnections.noNamespaces", {
+            defaultValue: "No namespaces available",
+          })}
         />
       </div>
 
@@ -498,7 +786,10 @@ function EditForm({
               service: t("k8sConnections.resourceTypeService"),
               pod: t("k8sConnections.resourceTypePod"),
             }}
-            onChange={(val) => setResourceType(val)}
+            onChange={(val) => {
+              setResourceType(val);
+              setResourceName("");
+            }}
             searchable={false}
           />
         </div>
@@ -513,7 +804,9 @@ function EditForm({
             onChange={(val) => setResourceName(val)}
             placeholder={t("k8sConnections.chooseResource")}
             searchPlaceholder={t("common.search")}
-            noResultsLabel={t("common.noResults")}
+            noResultsLabel={t("k8sConnections.noResources", {
+              defaultValue: "No resources available",
+            })}
           />
         </div>
       </div>
@@ -531,6 +824,56 @@ function EditForm({
         />
       </div>
 
+      <DiscoveryError message={discoveryError} />
+
+      <div className="border border-default rounded-lg bg-base/40">
+        <button
+          type="button"
+          onClick={() => setShowAdvanced(!showAdvanced)}
+          className="w-full flex items-center justify-between px-3 py-2 text-xs font-medium text-secondary hover:text-primary transition-colors"
+        >
+          <span>{t("k8sConnections.advancedSettings")}</span>
+          <ChevronDown
+            size={14}
+            className={clsx("transition-transform", showAdvanced && "rotate-180")}
+          />
+        </button>
+        {showAdvanced && (
+          <div className="px-3 pb-3 space-y-3">
+            <div>
+              <label className={LabelClass}>{t("k8sConnections.kubectlPath")}</label>
+              <div className="relative">
+                <input
+                  value={kubectlPath}
+                  onChange={(e) => setKubectlPath(e.target.value)}
+                  onBlur={onKubectlPathBlur}
+                  className={getPathInputClass(kubectlPathValidation.status)}
+                  placeholder={t("k8sConnections.kubectlPathPlaceholder")}
+                  aria-invalid={kubectlPathValidation.status === "invalid"}
+                />
+                <PathValidationAdornment status={kubectlPathValidation.status} />
+              </div>
+              <PathValidationMessage validation={kubectlPathValidation} />
+            </div>
+            <div>
+              <label className={LabelClass}>{t("k8sConnections.kubeconfigPath")}</label>
+              <div className="relative">
+                <input
+                  value={kubeconfigPath}
+                  onChange={(e) => setKubeconfigPath(e.target.value)}
+                  onBlur={onKubeconfigPathBlur}
+                  className={getPathInputClass(kubeconfigPathValidation.status)}
+                  placeholder={t("k8sConnections.kubeconfigPathPlaceholder")}
+                  aria-invalid={kubeconfigPathValidation.status === "invalid"}
+                />
+                <PathValidationAdornment status={kubeconfigPathValidation.status} />
+              </div>
+              <PathValidationMessage validation={kubeconfigPathValidation} />
+            </div>
+          </div>
+        )}
+      </div>
+
       {/* Test result */}
       {testStatus !== "idle" && (
         <div
@@ -598,3 +941,44 @@ function EditForm({
     </div>
   );
 }
+
+function getPathInputClass(status: PathValidationStatus) {
+  return clsx(
+    InputClass,
+    "pr-8 transition-colors",
+    status === "validating" && "border-blue-500 focus:border-blue-500",
+    status === "valid" && "border-green-500 focus:border-green-500 focus:ring-1 focus:ring-green-500/40",
+    status === "invalid" && "border-red-500 focus:border-red-500 focus:ring-1 focus:ring-red-500/40",
+  );
+}
+
+function PathValidationAdornment({ status }: { status: PathValidationStatus }) {
+  if (status === "idle") return null;
+
+  return (
+    <span className="absolute right-2 top-1/2 -translate-y-1/2 pointer-events-none">
+      {status === "validating" && (
+        <Loader2 size={14} className="animate-spin text-muted" />
+      )}
+      {status === "valid" && <Check size={14} className="text-green-400" />}
+      {status === "invalid" && <XCircle size={14} className="text-red-400" />}
+    </span>
+  );
+}
+
+function PathValidationMessage({ validation }: { validation: PathValidationState }) {
+  if (!validation.message) return null;
+
+  return <p className="mt-1 text-[10px] text-red-400">{validation.message}</p>;
+}
+
+function DiscoveryError({ message }: { message: string | null }) {
+  if (!message) return null;
+
+  return (
+    <div className="flex items-start gap-2 text-xs px-3 py-2 rounded-md text-red-400 bg-red-500/10">
+      <AlertCircle size={14} className="mt-0.5 shrink-0" />
+      <span>{message}</span>
+    </div>
+  );
+}
diff --git a/src/components/modals/NewConnectionModal.tsx b/src/components/modals/NewConnectionModal.tsx
index 093a2d2e..204de1ae 100644
--- a/src/components/modals/NewConnectionModal.tsx
+++ b/src/components/modals/NewConnectionModal.tsx
@@ -15,6 +15,7 @@ import {
   Info,
   Eye,
   EyeOff,
+  ChevronDown,
 } from "lucide-react";
 import { invoke } from "@tauri-apps/api/core";
 import type { ConnectionAppearance } from "../../contexts/DatabaseContext";
@@ -23,6 +24,7 @@ import { open } from "@tauri-apps/plugin-dialog";
 import clsx from "clsx";
 import { SshConnectionsModal } from "./SshConnectionsModal";
 import { K8sConnectionsModal } from "./K8sConnectionsModal";
+import { useLatestAsync } from "../../hooks/useLatestAsync";
 import { Select } from "../ui/Select";
 import { SlotAnchor } from "../ui/SlotAnchor";
 import { useDrivers } from "../../hooks/useDrivers";
@@ -36,7 +38,9 @@ import {
   getK8sNamespaces,
   getK8sResources,
   getK8sResourcePorts,
+  validateK8sPath,
   type K8sConnection,
+  type K8sPathValidationKind,
 } from "../../utils/k8s";
 import { isMultiDatabaseCapable } from "../../utils/database";
 import { fetchConnectionWithCredentials } from "../../utils/credentials";
@@ -45,6 +49,7 @@ import {
   parseConnectionString,
   toConnectionParams,
 } from "../../utils/connectionStringParser";
+import { toErrorMessage } from "../../utils/errors";
 
 interface ConnectionParams {
   driver: string;
@@ -76,6 +81,8 @@ interface ConnectionParams {
   k8s_resource_type?: string;
   k8s_resource_name?: string;
   k8s_port?: number;
+  k8s_kubectl_path?: string;
+  k8s_kubeconfig_path?: string;
 }
 
 interface SavedConnection {
@@ -93,25 +100,63 @@ interface NewConnectionModalProps {
   initialConnection?: SavedConnection | null;
 }
 
+type PathValidationStatus = "idle" | "validating" | "valid" | "invalid";
+
+interface PathValidationState {
+  status: PathValidationStatus;
+  value: string;
+  message: string | null;
+}
+
+const EmptyPathValidationState: PathValidationState = {
+  status: "idle",
+  value: "",
+  message: null,
+};
+
+function PathValidationAdornment({ status }: { status: PathValidationStatus }) {
+  return (
+    <span className="absolute right-2 top-1/2 -translate-y-1/2 pointer-events-none">
+      {status === "validating" && (
+        <Loader2 size={14} className="animate-spin text-muted" />
+      )}
+      {status === "valid" && <Check size={14} className="text-green-400" />}
+      {status === "invalid" && <XCircle size={14} className="text-red-400" />}
+    </span>
+  );
+}
+
+function PathValidationMessage({ validation }: { validation: PathValidationState }) {
+  if (!validation.message) return null;
+
+  return <p className="text-[10px] text-red-400">{validation.message}</p>;
+}
+
 const FieldInput = ({
   label,
   value,
   onChange,
+  onBlur,
   type = "text",
   placeholder,
   autoFocus,
   className,
+  validation,
 }: {
   label: string;
   value: string | number | undefined;
   onChange: (v: string) => void;
+  onBlur?: () => void;
   type?: string;
   placeholder?: string;
   autoFocus?: boolean;
   className?: string;
+  validation?: PathValidationState;
 }) => {
   const [showPassword, setShowPassword] = useState(false);
   const isPassword = type === "password";
+  const validationStatus = validation?.status ?? "idle";
+  const hasValidationIcon = validationStatus !== "idle";
 
   return (
     <div className={clsx("flex flex-col gap-1", className)}>
@@ -124,6 +169,7 @@ const FieldInput = ({
           value={value ?? ""}
           onChange={(e) => onChange(e.target.value)}
           placeholder={placeholder}
+          onBlur={onBlur}
           autoFocus={autoFocus}
           autoCorrect="off"
           autoCapitalize="off"
@@ -131,9 +177,16 @@ const FieldInput = ({
           spellCheck={false}
           className={clsx(
             "w-full px-3 py-2 bg-base border border-strong rounded-md text-sm text-primary placeholder:text-muted placeholder:italic focus:border-blue-500 focus:outline-none transition-colors",
-            isPassword && "pr-10"
+            (isPassword || hasValidationIcon) && "pr-10",
+            validationStatus === "validating" && "border-blue-500 focus:border-blue-500",
+            validationStatus === "valid" && "border-green-500 focus:border-green-500 focus:ring-1 focus:ring-green-500/40",
+            validationStatus === "invalid" && "border-red-500 focus:border-red-500 focus:ring-1 focus:ring-red-500/40",
           )}
+          aria-invalid={validationStatus === "invalid"}
         />
+        {hasValidationIcon && !isPassword && (
+          <PathValidationAdornment status={validationStatus} />
+        )}
         {isPassword && (
           <button
             type="button"
@@ -145,6 +198,7 @@ const FieldInput = ({
           </button>
         )}
       </div>
+      {validation && <PathValidationMessage validation={validation} />}
     </div>
   );
 };
@@ -209,6 +263,12 @@ export const NewConnectionModal = ({
   const [k8sContexts, setK8sContexts] = useState<string[]>([]);
   const [k8sNamespaces, setK8sNamespaces] = useState<string[]>([]);
   const [k8sResources, setK8sResources] = useState<string[]>([]);
+  const [k8sDiscoveryError, setK8sDiscoveryError] = useState<string | null>(null);
+  const [showK8sAdvanced, setShowK8sAdvanced] = useState(false);
+  const [k8sKubectlPathInput, setK8sKubectlPathInput] = useState("");
+  const [k8sKubeconfigPathInput, setK8sKubeconfigPathInput] = useState("");
+  const [k8sKubectlPathValidation, setK8sKubectlPathValidation] = useState<PathValidationState>(EmptyPathValidationState);
+  const [k8sKubeconfigPathValidation, setK8sKubeconfigPathValidation] = useState<PathValidationState>(EmptyPathValidationState);
 
   // ── databases ──
   const [availableDatabases, setAvailableDatabases] = useState<string[]>([]);
@@ -309,6 +369,13 @@ export const NewConnectionModal = ({
       ? params.k8s_port ?? getK8sAutoPort(params) ?? k8sDefaultPort
       : params.k8s_port;
   const effectiveK8sPort = resolveK8sPort(formData);
+  const k8sCommandOptions = useMemo(
+    () => ({
+      kubectl_path: formData.k8s_kubectl_path,
+      kubeconfig_path: formData.k8s_kubeconfig_path,
+    }),
+    [formData.k8s_kubectl_path, formData.k8s_kubeconfig_path],
+  );
   const connectionStringEnabled =
     activeDriver?.capabilities?.connection_string ??
     activeDriver?.capabilities?.connectionString ??
@@ -343,6 +410,9 @@ export const NewConnectionModal = ({
     ).length > 0;
 
   // ── helpers ──
+  // Guards fire-and-forget async so only the latest call per key can write state.
+  const run = useLatestAsync();
+
   const loadSshConnectionsList = async () => {
     const result = await loadSshConnections();
     setSshConnections(result);
@@ -353,41 +423,72 @@ export const NewConnectionModal = ({
     setK8sConnections(result);
   };
 
-  const loadK8sContextsList = async () => {
-    try {
-      const result = await getK8sContexts();
-      setK8sContexts(result);
-    } catch {
-      setK8sContexts([]);
-    }
-  };
-
-  const loadK8sNamespacesList = async (context: string) => {
-    try {
-      const result = await getK8sNamespaces(context);
-      setK8sNamespaces(result);
-    } catch {
-      setK8sNamespaces([]);
-    }
-  };
+  const loadK8sNamespacesList = useCallback(
+    async (context: string) => {
+      await run("namespaces", async (isLatest) => {
+        try {
+          const result = await getK8sNamespaces(context, k8sCommandOptions);
+          if (!isLatest()) return;
+          setK8sNamespaces(result);
+          setK8sDiscoveryError(null);
+        } catch (error) {
+          if (!isLatest()) return;
+          setK8sNamespaces([]);
+          setK8sDiscoveryError(toErrorMessage(error));
+        }
+      });
+    },
+    [k8sCommandOptions, run],
+  );
 
-  const loadK8sResourcesList = async (context: string, namespace: string, resourceType: string) => {
-    try {
-      const result = await getK8sResources(context, namespace, resourceType);
-      setK8sResources(result);
-    } catch {
-      setK8sResources([]);
-    }
-  };
+  const loadK8sResourcesList = useCallback(
+    async (context: string, namespace: string, resourceType: string) => {
+      await run("resources", async (isLatest) => {
+        try {
+          const result = await getK8sResources(
+            context,
+            namespace,
+            resourceType,
+            k8sCommandOptions,
+          );
+          if (!isLatest()) return;
+          setK8sResources(result);
+          setK8sDiscoveryError(null);
+        } catch (error) {
+          if (!isLatest()) return;
+          setK8sResources([]);
+          setK8sDiscoveryError(toErrorMessage(error));
+        }
+      });
+    },
+    [k8sCommandOptions, run],
+  );
 
   // ── K8s cascading dropdown loading ──
+  useEffect(() => {
+    if (!isOpen || !formData.k8s_enabled || k8sMode !== "inline") return;
+
+    void run("contexts", async (isLatest) => {
+      try {
+        const result = await getK8sContexts(k8sCommandOptions);
+        if (!isLatest()) return;
+        setK8sContexts(result);
+        setK8sDiscoveryError(null);
+      } catch (error) {
+        if (!isLatest()) return;
+        setK8sContexts([]);
+        setK8sDiscoveryError(toErrorMessage(error));
+      }
+    });
+  }, [isOpen, formData.k8s_enabled, k8sMode, k8sCommandOptions, run]);
+
   useEffect(() => {
     if (formData.k8s_context) {
       loadK8sNamespacesList(formData.k8s_context);
     } else {
       setK8sNamespaces([]);
     }
-  }, [formData.k8s_context]);
+  }, [formData.k8s_context, loadK8sNamespacesList]);
 
   useEffect(() => {
     if (formData.k8s_context && formData.k8s_namespace && formData.k8s_resource_type) {
@@ -399,7 +500,12 @@ export const NewConnectionModal = ({
     } else {
       setK8sResources([]);
     }
-  }, [formData.k8s_context, formData.k8s_namespace, formData.k8s_resource_type]);
+  }, [
+    formData.k8s_context,
+    formData.k8s_namespace,
+    formData.k8s_resource_type,
+    loadK8sResourcesList,
+  ]);
 
   useEffect(() => {
     const context = formData.k8s_context;
@@ -426,6 +532,7 @@ export const NewConnectionModal = ({
           namespace,
           resourceType,
           resourceName,
+          k8sCommandOptions,
         );
         if (!cancelled) {
           setK8sAutoPort(
@@ -450,6 +557,7 @@ export const NewConnectionModal = ({
     formData.k8s_resource_name,
     isK8sPortOverridden,
     k8sMode,
+    k8sCommandOptions,
   ]);
 
   const updateField = (
@@ -459,6 +567,178 @@ export const NewConnectionModal = ({
     setFormData((prev) => ({ ...prev, [field]: value }));
   };
 
+  const applyK8sAdvancedFields = useCallback(() => {
+    const nextKubectlPath = k8sKubectlPathInput.trim() || undefined;
+    const nextKubeconfigPath = k8sKubeconfigPathInput.trim() || undefined;
+    if (
+      formData.k8s_kubectl_path === nextKubectlPath &&
+      formData.k8s_kubeconfig_path === nextKubeconfigPath
+    ) {
+      return;
+    }
+
+    setFormData((prev) => ({
+      ...prev,
+      k8s_kubectl_path: nextKubectlPath,
+      k8s_kubeconfig_path: nextKubeconfigPath,
+      k8s_context: undefined,
+      k8s_namespace: undefined,
+      k8s_resource_name: undefined,
+    }));
+    setK8sNamespaces([]);
+    setK8sResources([]);
+    setK8sDiscoveryError(null);
+  }, [
+    formData.k8s_kubeconfig_path,
+    formData.k8s_kubectl_path,
+    k8sKubeconfigPathInput,
+    k8sKubectlPathInput,
+  ]);
+
+  const isK8sPathReadyToApply = useCallback(
+    (
+      kind: K8sPathValidationKind,
+      currentValue: string,
+      state: PathValidationState,
+      nextValidPath?: { kind: K8sPathValidationKind; value: string },
+    ) => {
+      if (!currentValue) return true;
+      if (nextValidPath?.kind === kind && nextValidPath.value === currentValue) {
+        return true;
+      }
+
+      return state.status === "valid" && state.value === currentValue;
+    },
+    [],
+  );
+
+  const areK8sAdvancedPathsReadyToApply = useCallback(
+    (nextValidPath?: { kind: K8sPathValidationKind; value: string }) => {
+      const nextKubectlPath = k8sKubectlPathInput.trim();
+      const nextKubeconfigPath = k8sKubeconfigPathInput.trim();
+
+      return (
+        isK8sPathReadyToApply(
+          "kubectl",
+          nextKubectlPath,
+          k8sKubectlPathValidation,
+          nextValidPath,
+        ) &&
+        isK8sPathReadyToApply(
+          "kubeconfig",
+          nextKubeconfigPath,
+          k8sKubeconfigPathValidation,
+          nextValidPath,
+        )
+      );
+    },
+    [
+      isK8sPathReadyToApply,
+      k8sKubeconfigPathInput,
+      k8sKubeconfigPathValidation,
+      k8sKubectlPathInput,
+      k8sKubectlPathValidation,
+    ],
+  );
+
+  const validateK8sAdvancedPath = async (
+    kind: K8sPathValidationKind,
+    applyOnSuccess = true,
+  ) => {
+    const path = kind === "kubectl" ? k8sKubectlPathInput : k8sKubeconfigPathInput;
+    const trimmedPath = path.trim();
+    const setPathValidation =
+      kind === "kubectl"
+        ? setK8sKubectlPathValidation
+        : setK8sKubeconfigPathValidation;
+
+    if (!trimmedPath) {
+      setPathValidation(EmptyPathValidationState);
+      if (applyOnSuccess && areK8sAdvancedPathsReadyToApply({ kind, value: "" })) {
+        applyK8sAdvancedFields();
+      }
+      return true;
+    }
+
+    setPathValidation({ status: "validating", value: trimmedPath, message: null });
+    return run(kind, async (isLatest) => {
+      try {
+        await validateK8sPath(trimmedPath, kind);
+        if (isLatest()) {
+          setPathValidation({ status: "valid", value: trimmedPath, message: null });
+        }
+        if (isLatest() && applyOnSuccess && areK8sAdvancedPathsReadyToApply({ kind, value: trimmedPath })) {
+          applyK8sAdvancedFields();
+        }
+        return true;
+      } catch (error) {
+        if (isLatest()) {
+          setPathValidation({
+            status: "invalid",
+            value: trimmedPath,
+            message: toErrorMessage(error),
+          });
+        }
+        return false;
+      }
+    });
+  };
+
+  const validateK8sAdvancedPathsForSave = async () => {
+    if (!formData.k8s_enabled || k8sMode !== "inline") {
+      return true;
+    }
+
+    const kubectlPathValid = await validateK8sAdvancedPath("kubectl", false);
+    const kubeconfigPathValid = await validateK8sAdvancedPath("kubeconfig", false);
+
+    return kubectlPathValid && kubeconfigPathValid;
+  };
+
+  const getK8sAdvancedPathParams = useCallback((): Partial<ConnectionParams> => {
+    if (!formData.k8s_enabled || k8sMode !== "inline") {
+      return {};
+    }
+
+    return {
+      k8s_kubectl_path: k8sKubectlPathInput.trim() || undefined,
+      k8s_kubeconfig_path: k8sKubeconfigPathInput.trim() || undefined,
+    };
+  }, [
+    formData.k8s_enabled,
+    k8sKubeconfigPathInput,
+    k8sKubectlPathInput,
+    k8sMode,
+  ]);
+
+  const haveK8sAdvancedPathInputsChanged = useCallback(() => {
+    if (!formData.k8s_enabled || k8sMode !== "inline") {
+      return false;
+    }
+
+    const currentPaths = getK8sAdvancedPathParams();
+    return (
+      formData.k8s_kubectl_path !== currentPaths.k8s_kubectl_path ||
+      formData.k8s_kubeconfig_path !== currentPaths.k8s_kubeconfig_path
+    );
+  }, [
+    formData.k8s_enabled,
+    formData.k8s_kubeconfig_path,
+    formData.k8s_kubectl_path,
+    getK8sAdvancedPathParams,
+    k8sMode,
+  ]);
+
+  const handleK8sKubectlPathInputChange = (value: string) => {
+    setK8sKubectlPathInput(value);
+    setK8sKubectlPathValidation(EmptyPathValidationState);
+  };
+
+  const handleK8sKubeconfigPathInputChange = (value: string) => {
+    setK8sKubeconfigPathInput(value);
+    setK8sKubeconfigPathValidation(EmptyPathValidationState);
+  };
+
   const loadDatabases = async (overrides?: Partial<ConnectionParams>) => {
     const effectiveDriver = overrides?.driver ?? driver;
     const targetDriver = drivers.find((d) => d.id === effectiveDriver);
@@ -539,6 +819,8 @@ export const NewConnectionModal = ({
       setConnectionStringError(null);
       setNameError(false);
       setDatabasesTabError(false);
+      setK8sDiscoveryError(null);
+      setShowK8sAdvanced(false);
       setIsK8sPortOverridden(false);
 
       if (initialConnection) {
@@ -567,6 +849,9 @@ export const NewConnectionModal = ({
         }
 
         setIsK8sPortOverridden(params.k8s_port != null);
+        setShowK8sAdvanced(Boolean(params.k8s_kubectl_path || params.k8s_kubeconfig_path));
+        setK8sKubectlPathInput(params.k8s_kubectl_path ?? "");
+        setK8sKubeconfigPathInput(params.k8s_kubeconfig_path ?? "");
         if (Array.isArray(db)) {
           setSelectedDatabasesState(db);
           setFormData({ ...params, database: db[0] ?? "" });
@@ -593,18 +878,23 @@ export const NewConnectionModal = ({
           ssh_enabled: false,
           ssh_port: 22,
           k8s_enabled: false,
+          k8s_kubectl_path: undefined,
+          k8s_kubeconfig_path: undefined,
         });
         setSelectedDatabasesState([]);
         setSshMode("existing");
         setK8sMode("existing");
         setIsK8sPortOverridden(false);
+        setK8sDiscoveryError(null);
+        setShowK8sAdvanced(false);
+        setK8sKubectlPathInput("");
+        setK8sKubeconfigPathInput("");
         setDetectJsonInTextColumns(false);
         setAppearance({});
       }
 
       await loadSshConnectionsList();
       await loadK8sConnectionsList();
-      await loadK8sContextsList();
     };
     void init();
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -636,8 +926,14 @@ export const NewConnectionModal = ({
       k8s_resource_type: undefined,
       k8s_resource_name: undefined,
       k8s_port: undefined,
+      k8s_kubectl_path: undefined,
+      k8s_kubeconfig_path: undefined,
     });
     setIsK8sPortOverridden(false);
+    setK8sKubectlPathInput("");
+    setK8sKubeconfigPathInput("");
+    setK8sKubectlPathValidation(EmptyPathValidationState);
+    setK8sKubeconfigPathValidation(EmptyPathValidationState);
     setSelectedDatabasesState([]);
     setDbSearchQuery("");
     setAvailableDatabases([]);
@@ -652,6 +948,33 @@ export const NewConnectionModal = ({
   };
 
   const testConnection = async () => {
+    const k8sAdvancedPathsValid = await validateK8sAdvancedPathsForSave();
+    if (!k8sAdvancedPathsValid) {
+      setStatus("error");
+      setMessage(
+        t("newConnection.k8sPathValidationFailed", {
+          defaultValue: "Fix invalid Kubernetes advanced path fields before saving.",
+        }),
+      );
+      setTestResult("error");
+      setActiveTab("k8s");
+      return false;
+    }
+
+    if (haveK8sAdvancedPathInputsChanged()) {
+      applyK8sAdvancedFields();
+      setStatus("error");
+      setMessage(
+        t("newConnection.k8sPathSelectionReset", {
+          defaultValue:
+            "Advanced Kubernetes paths changed. Choose the context, namespace, and resource again.",
+        }),
+      );
+      setTestResult("error");
+      setActiveTab("k8s");
+      return false;
+    }
+
     setStatus("testing");
     setMessage("");
     setTestResult(null);
@@ -659,6 +982,7 @@ export const NewConnectionModal = ({
       const testParams: Partial<ConnectionParams> = {
         driver,
         ...formData,
+        ...getK8sAdvancedPathParams(),
         port: formData.port != null ? Number(formData.port) : undefined,
         k8s_port: effectiveK8sPort,
         database: isMultiDb
@@ -727,6 +1051,34 @@ export const NewConnectionModal = ({
       setTestResult("error");
       return;
     }
+
+    const k8sAdvancedPathsValid = await validateK8sAdvancedPathsForSave();
+    if (!k8sAdvancedPathsValid) {
+      setStatus("error");
+      setMessage(
+        t("newConnection.k8sPathValidationFailed", {
+          defaultValue: "Fix invalid Kubernetes advanced path fields before saving.",
+        }),
+      );
+      setTestResult("error");
+      setActiveTab("k8s");
+      return;
+    }
+
+    if (haveK8sAdvancedPathInputsChanged()) {
+      applyK8sAdvancedFields();
+      setStatus("error");
+      setMessage(
+        t("newConnection.k8sPathSelectionReset", {
+          defaultValue:
+            "Advanced Kubernetes paths changed. Choose the context, namespace, and resource again.",
+        }),
+      );
+      setTestResult("error");
+      setActiveTab("k8s");
+      return;
+    }
+
     setStatus("saving");
     setMessage("");
     setTestResult(null);
@@ -734,6 +1086,7 @@ export const NewConnectionModal = ({
       const params: Partial<ConnectionParams> = {
         driver,
         ...formData,
+        ...getK8sAdvancedPathParams(),
         port: formData.port != null ? Number(formData.port) : undefined,
         k8s_port: effectiveK8sPort,
         database: isMultiDb
@@ -1677,6 +2030,14 @@ export const NewConnectionModal = ({
                     updateField("k8s_resource_type", undefined);
                     updateField("k8s_resource_name", undefined);
                     updateField("k8s_port", undefined);
+                    updateField("k8s_kubectl_path", undefined);
+                    updateField("k8s_kubeconfig_path", undefined);
+                    setK8sDiscoveryError(null);
+                    setShowK8sAdvanced(false);
+                    setK8sKubectlPathInput("");
+                    setK8sKubeconfigPathInput("");
+                    setK8sKubectlPathValidation(EmptyPathValidationState);
+                    setK8sKubeconfigPathValidation(EmptyPathValidationState);
                     setIsK8sPortOverridden(false);
                   } else {
                     updateField("k8s_connection_id", undefined);
@@ -1761,13 +2122,18 @@ export const NewConnectionModal = ({
                   options={k8sContexts}
                   onChange={(val) => {
                     updateField("k8s_context", val);
+                    updateField("k8s_namespace", undefined);
+                    updateField("k8s_resource_name", undefined);
+                    setK8sDiscoveryError(null);
                   }}
                   searchPlaceholder={t("common.search")}
-                  noResultsLabel={t("common.noResults")}
+                  noResultsLabel={t("newConnection.noK8sContexts", {
+                    defaultValue: "No contexts available",
+                  })}
                   placeholder={
                     k8sContexts.length === 0
                       ? t("newConnection.noK8sContexts", {
-                          defaultValue: "No contexts found (is kubectl installed?)",
+                          defaultValue: "No contexts available",
                         })
                       : t("newConnection.chooseContext", {
                           defaultValue: "Choose a context...",
@@ -1787,9 +2153,13 @@ export const NewConnectionModal = ({
                   options={k8sNamespaces}
                   onChange={(val) => {
                     updateField("k8s_namespace", val);
+                    updateField("k8s_resource_name", undefined);
+                    setK8sDiscoveryError(null);
                   }}
                   searchPlaceholder={t("common.search")}
-                  noResultsLabel={t("common.noResults")}
+                  noResultsLabel={t("newConnection.noK8sNamespaces", {
+                    defaultValue: "No namespaces available",
+                  })}
                   placeholder={
                     k8sNamespaces.length === 0
                       ? t("newConnection.selectContextFirst", {
@@ -1822,6 +2192,7 @@ export const NewConnectionModal = ({
                     }}
                     onChange={(val) => {
                       updateField("k8s_resource_type", val);
+                      updateField("k8s_resource_name", undefined);
                     }}
                     placeholder={t("newConnection.k8sSelectType", {
                       defaultValue: "Select type...",
@@ -1839,11 +2210,14 @@ export const NewConnectionModal = ({
                   <Select
                     value={formData.k8s_resource_name || null}
                     options={k8sResources}
-                    onChange={(val) =>
-                      updateField("k8s_resource_name", val)
-                    }
+                    onChange={(val) => {
+                      updateField("k8s_resource_name", val);
+                      setK8sDiscoveryError(null);
+                    }}
                     searchPlaceholder={t("common.search")}
-                    noResultsLabel={t("common.noResults")}
+                    noResultsLabel={t("newConnection.noK8sResources", {
+                      defaultValue: "No resources available",
+                    })}
                     placeholder={
                       k8sResources.length === 0
                         ? t("newConnection.selectTypeFirst", {
@@ -1869,6 +2243,62 @@ export const NewConnectionModal = ({
                 }}
                 placeholder={k8sDefaultPort != null ? String(k8sDefaultPort) : undefined}
               />
+
+              {k8sDiscoveryError && (
+                <div className="flex items-start gap-2 text-xs px-3 py-2 rounded-md text-red-400 bg-red-500/10">
+                  <AlertCircle size={14} className="mt-0.5 shrink-0" />
+                  <span>{k8sDiscoveryError}</span>
+                </div>
+              )}
+
+              <div className="border border-default rounded-lg bg-base/40">
+                <button
+                  type="button"
+                  onClick={() => setShowK8sAdvanced(!showK8sAdvanced)}
+                  className="w-full flex items-center justify-between px-3 py-2 text-xs font-medium text-secondary hover:text-primary transition-colors"
+                >
+                  <span>
+                    {t("newConnection.k8sAdvancedSettings", {
+                      defaultValue: "Advanced kubectl settings",
+                    })}
+                  </span>
+                  <ChevronDown
+                    size={14}
+                    className={clsx(
+                      "transition-transform",
+                      showK8sAdvanced && "rotate-180",
+                    )}
+                  />
+                </button>
+                {showK8sAdvanced && (
+                  <div className="px-3 pb-3 space-y-3">
+                    <FieldInput
+                      label={t("newConnection.kubectlPath", {
+                        defaultValue: "kubectl Path",
+                      })}
+                      value={k8sKubectlPathInput}
+                      onChange={handleK8sKubectlPathInputChange}
+                      onBlur={() => void validateK8sAdvancedPath("kubectl")}
+                      placeholder={t("newConnection.kubectlPathPlaceholder", {
+                        defaultValue: "kubectl",
+                      })}
+                      validation={k8sKubectlPathValidation}
+                    />
+                    <FieldInput
+                      label={t("newConnection.kubeconfigPath", {
+                        defaultValue: "Kubeconfig Path",
+                      })}
+                      value={k8sKubeconfigPathInput}
+                      onChange={handleK8sKubeconfigPathInputChange}
+                      onBlur={() => void validateK8sAdvancedPath("kubeconfig")}
+                      placeholder={t("newConnection.kubeconfigPathPlaceholder", {
+                        defaultValue: "Path to kubeconfig",
+                      })}
+                      validation={k8sKubeconfigPathValidation}
+                    />
+                  </div>
+                )}
+              </div>
             </div>
           )}
         </div>
diff --git a/src/hooks/useLatestAsync.ts b/src/hooks/useLatestAsync.ts
new file mode 100644
index 00000000..3e80dd9b
--- /dev/null
+++ b/src/hooks/useLatestAsync.ts
@@ -0,0 +1,53 @@
+import { useCallback, useEffect, useRef } from "react";
+
+/**
+ * "Latest-wins" guard for fire-and-forget async work in components.
+ *
+ * Returns a stable `run(key, fn)` function. Only the most recent call for a
+ * given `key` is considered active; earlier in-flight calls for that same key
+ * observe `isLatest() === false` once a newer call starts, and should skip
+ * their state writes. Calls under different keys are fully independent, so
+ * e.g. fetching namespaces does not cancel an in-flight path validation.
+ *
+ * All keys are invalidated on unmount (the ref map is dropped), preventing
+ * state writes after the component is gone.
+ *
+ * @example
+ *   const run = useLatestAsync();
+ *   useEffect(() => {
+ *     if (!context) { setNamespaces([]); return; }
+ *     void run("namespaces", async (isLatest) => {
+ *       try {
+ *         const result = await getK8sNamespaces(context);
+ *         if (!isLatest()) return;
+ *         setNamespaces(result);
+ *       } catch (error) {
+ *         if (!isLatest()) return;
+ *         setDiscoveryError(toErrorMessage(error));
+ *       }
+ *     });
+ *   }, [context, run]);
+ */
+export function useLatestAsync() {
+  const tokensRef = useRef<Record<string, number>>({});
+
+  // Invalidate every key on unmount so late resolves skip state writes.
+  useEffect(
+    () => () => {
+      tokensRef.current = {};
+    },
+    [],
+  );
+
+  return useCallback(
+    <T>(
+      key: string,
+      fn: (isLatest: () => boolean) => Promise<T>,
+    ): Promise<T> => {
+      const token = (tokensRef.current[key] ?? 0) + 1;
+      tokensRef.current[key] = token;
+      return fn(() => tokensRef.current[key] === token);
+    },
+    [],
+  );
+}
diff --git a/src/i18n/locales/de.json b/src/i18n/locales/de.json
index b9cde171..3cdf9f11 100644
--- a/src/i18n/locales/de.json
+++ b/src/i18n/locales/de.json
@@ -699,12 +699,21 @@
     "k8sSelectType": "Typ auswählen...",
     "manageK8s": "Verwalten",
     "noK8sConnections": "Keine gespeicherten Verbindungen — erstelle unten eine",
-    "noK8sContexts": "Keine Kontexte gefunden (ist kubectl installiert?)",
+    "noK8sContexts": "Keine Kontexte verfügbar",
+    "noK8sNamespaces": "Keine Namespaces verfügbar",
+    "noK8sResources": "Keine Ressourcen verfügbar",
     "selectContextFirst": "Zuerst einen Kontext auswählen",
     "selectK8sConnection": "K8s-Verbindung auswählen",
     "selectTypeFirst": "Zuerst Kontext/Namespace/Typ auswählen",
     "useK8s": "Kubernetes-Port-Forward verwenden",
-    "useK8sConnection": "Gespeicherte Verbindung"
+    "useK8sConnection": "Gespeicherte Verbindung",
+    "k8sAdvancedSettings": "Erweiterte kubectl-Einstellungen",
+    "kubectlPath": "kubectl-Pfad",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Kubeconfig-Pfad",
+    "kubeconfigPathPlaceholder": "Pfad zur kubeconfig",
+    "k8sPathValidationFailed": "Korrigiere ungültige erweiterte Kubernetes-Pfadfelder vor dem Speichern.",
+    "k8sPathSelectionReset": "Die erweiterten Kubernetes-Pfade haben sich geändert. Wähle Kontext, Namespace und Ressource erneut aus."
   },
   "sshConnections": {
     "title": "SSH-Verbindungen",
@@ -1565,6 +1574,16 @@
       "resourceTypeInvalid": "Der Ressourcentyp muss \"service\" oder \"pod\" sein",
       "resourceNameRequired": "Der Ressourcenname ist erforderlich",
       "portInvalid": "Der Port muss zwischen 1 und 65535 liegen"
-    }
+    },
+    "advancedSettings": "Erweiterte kubectl-Einstellungen",
+    "kubectlPath": "kubectl-Pfad",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Kubeconfig-Pfad",
+    "kubeconfigPathPlaceholder": "Pfad zur kubeconfig",
+    "pathValidationFailed": "Korrigiere ungültige erweiterte Pfadfelder vor dem Speichern.",
+    "pathSelectionReset": "Die erweiterten Pfade haben sich geändert. Wähle Kontext, Namespace und Ressource erneut aus.",
+    "noContexts": "Keine Kontexte verfügbar",
+    "noNamespaces": "Keine Namespaces verfügbar",
+    "noResources": "Keine Ressourcen verfügbar"
   }
 }
diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index dd16a5a0..3fbfdd2b 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -733,12 +733,21 @@
     "k8sSelectType": "Select type...",
     "manageK8s": "Manage",
     "noK8sConnections": "No saved connections — create one below",
-    "noK8sContexts": "No contexts found (is kubectl installed?)",
+    "noK8sContexts": "No contexts available",
+    "noK8sNamespaces": "No namespaces available",
+    "noK8sResources": "No resources available",
     "selectContextFirst": "Select a context first",
     "selectK8sConnection": "Select K8s Connection",
     "selectTypeFirst": "Select context/namespace/type first",
     "useK8s": "Use Kubernetes Port-Forward",
-    "useK8sConnection": "Saved Connection"
+    "useK8sConnection": "Saved Connection",
+    "k8sAdvancedSettings": "Advanced kubectl settings",
+    "kubectlPath": "kubectl Path",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Kubeconfig Path",
+    "kubeconfigPathPlaceholder": "Path to kubeconfig",
+    "k8sPathValidationFailed": "Fix invalid Kubernetes advanced path fields before saving.",
+    "k8sPathSelectionReset": "Advanced Kubernetes paths changed. Choose the context, namespace, and resource again."
   },
   "sshConnections": {
     "title": "SSH Connections",
@@ -1641,6 +1650,16 @@
       "resourceTypeInvalid": "Resource type must be \"service\" or \"pod\"",
       "resourceNameRequired": "Resource name is required",
       "portInvalid": "Port must be between 1 and 65535"
-    }
+    },
+    "advancedSettings": "Advanced kubectl settings",
+    "kubectlPath": "kubectl Path",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Kubeconfig Path",
+    "kubeconfigPathPlaceholder": "Path to kubeconfig",
+    "pathValidationFailed": "Fix invalid advanced path fields before saving.",
+    "pathSelectionReset": "Advanced paths changed. Choose the context, namespace, and resource again.",
+    "noContexts": "No contexts available",
+    "noNamespaces": "No namespaces available",
+    "noResources": "No resources available"
   }
 }
diff --git a/src/i18n/locales/es.json b/src/i18n/locales/es.json
index 0bed3012..93e34a8f 100644
--- a/src/i18n/locales/es.json
+++ b/src/i18n/locales/es.json
@@ -704,12 +704,21 @@
     "k8sSelectType": "Selecciona tipo...",
     "manageK8s": "Gestionar",
     "noK8sConnections": "No hay conexiones guardadas — crea una abajo",
-    "noK8sContexts": "No se encontraron contextos (¿está kubectl instalado?)",
+    "noK8sContexts": "No hay contextos disponibles",
+    "noK8sNamespaces": "No hay namespaces disponibles",
+    "noK8sResources": "No hay recursos disponibles",
     "selectContextFirst": "Selecciona primero un contexto",
     "selectK8sConnection": "Selecciona conexión de K8s",
     "selectTypeFirst": "Selecciona primero contexto/namespace/tipo",
     "useK8s": "Usar Port-Forward de Kubernetes",
-    "useK8sConnection": "Conexión guardada"
+    "useK8sConnection": "Conexión guardada",
+    "k8sAdvancedSettings": "Configuración avanzada de kubectl",
+    "kubectlPath": "Ruta de kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Ruta de kubeconfig",
+    "kubeconfigPathPlaceholder": "Ruta al kubeconfig",
+    "k8sPathValidationFailed": "Corrige los campos de ruta avanzada de Kubernetes no válidos antes de guardar.",
+    "k8sPathSelectionReset": "Las rutas avanzadas de Kubernetes cambiaron. Elige de nuevo el contexto, el espacio de nombres y el recurso."
   },
   "sshConnections": {
     "title": "Conexiones SSH",
@@ -1522,6 +1531,16 @@
       "resourceTypeInvalid": "El tipo de recurso debe ser \"service\" o \"pod\"",
       "resourceNameRequired": "El nombre del recurso es obligatorio",
       "portInvalid": "El puerto debe estar entre 1 y 65535"
-    }
+    },
+    "advancedSettings": "Configuración avanzada de kubectl",
+    "kubectlPath": "Ruta de kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Ruta de kubeconfig",
+    "kubeconfigPathPlaceholder": "Ruta al kubeconfig",
+    "pathValidationFailed": "Corrige los campos de ruta avanzada no válidos antes de guardar.",
+    "pathSelectionReset": "Las rutas avanzadas cambiaron. Elige de nuevo el contexto, el espacio de nombres y el recurso.",
+    "noContexts": "No hay contextos disponibles",
+    "noNamespaces": "No hay namespaces disponibles",
+    "noResources": "No hay recursos disponibles"
   }
 }
diff --git a/src/i18n/locales/fr.json b/src/i18n/locales/fr.json
index 1235d39b..e666b8ae 100644
--- a/src/i18n/locales/fr.json
+++ b/src/i18n/locales/fr.json
@@ -699,12 +699,21 @@
     "k8sSelectType": "Sélectionner le type...",
     "manageK8s": "Gérer",
     "noK8sConnections": "Aucune connexion enregistrée — créez-en une ci-dessous",
-    "noK8sContexts": "Aucun contexte trouvé (kubectl est-il installé ?)",
+    "noK8sContexts": "Aucun contexte disponible",
+    "noK8sNamespaces": "Aucun namespace disponible",
+    "noK8sResources": "Aucune ressource disponible",
     "selectContextFirst": "Sélectionnez d'abord un contexte",
     "selectK8sConnection": "Sélectionner une connexion K8s",
     "selectTypeFirst": "Sélectionnez d'abord contexte/namespace/type",
     "useK8s": "Utiliser le Port-Forward Kubernetes",
-    "useK8sConnection": "Connexion enregistrée"
+    "useK8sConnection": "Connexion enregistrée",
+    "k8sAdvancedSettings": "Paramètres kubectl avancés",
+    "kubectlPath": "Chemin de kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Chemin du kubeconfig",
+    "kubeconfigPathPlaceholder": "Chemin vers le kubeconfig",
+    "k8sPathValidationFailed": "Corrigez les champs de chemin Kubernetes avancés non valides avant d’enregistrer.",
+    "k8sPathSelectionReset": "Les chemins Kubernetes avancés ont changé. Choisissez à nouveau le contexte, l’espace de noms et la ressource."
   },
   "sshConnections": {
     "title": "Connexions SSH",
@@ -1565,6 +1574,16 @@
       "resourceTypeInvalid": "Le type de ressource doit être \"service\" ou \"pod\"",
       "resourceNameRequired": "Le nom de la ressource est requis",
       "portInvalid": "Le port doit être compris entre 1 et 65535"
-    }
+    },
+    "advancedSettings": "Paramètres kubectl avancés",
+    "kubectlPath": "Chemin de kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Chemin du kubeconfig",
+    "kubeconfigPathPlaceholder": "Chemin vers le kubeconfig",
+    "pathValidationFailed": "Corrigez les champs de chemin avancés non valides avant d’enregistrer.",
+    "pathSelectionReset": "Les chemins avancés ont changé. Choisissez à nouveau le contexte, l’espace de noms et la ressource.",
+    "noContexts": "Aucun contexte disponible",
+    "noNamespaces": "Aucun namespace disponible",
+    "noResources": "Aucune ressource disponible"
   }
 }
diff --git a/src/i18n/locales/it.json b/src/i18n/locales/it.json
index 2080d924..ddaf7015 100644
--- a/src/i18n/locales/it.json
+++ b/src/i18n/locales/it.json
@@ -704,12 +704,21 @@
     "k8sSelectType": "Seleziona tipo...",
     "manageK8s": "Gestisci",
     "noK8sConnections": "Nessuna connessione salvata — creane una qui sotto",
-    "noK8sContexts": "Nessun contesto trovato (kubectl è installato?)",
+    "noK8sContexts": "Nessun contesto disponibile",
+    "noK8sNamespaces": "Nessun namespace disponibile",
+    "noK8sResources": "Nessuna risorsa disponibile",
     "selectContextFirst": "Seleziona prima un contesto",
     "selectK8sConnection": "Seleziona connessione K8s",
     "selectTypeFirst": "Seleziona prima contesto/namespace/tipo",
     "useK8s": "Usa Port-Forward Kubernetes",
-    "useK8sConnection": "Connessione salvata"
+    "useK8sConnection": "Connessione salvata",
+    "k8sAdvancedSettings": "Impostazioni kubectl avanzate",
+    "kubectlPath": "Percorso kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Percorso kubeconfig",
+    "kubeconfigPathPlaceholder": "Percorso del kubeconfig",
+    "k8sPathValidationFailed": "Correggi i campi percorso avanzati Kubernetes non validi prima di salvare.",
+    "k8sPathSelectionReset": "I percorsi Kubernetes avanzati sono cambiati. Scegli di nuovo contesto, namespace e risorsa."
   },
   "sshConnections": {
     "title": "Connessioni SSH",
@@ -1548,6 +1557,16 @@
       "resourceTypeInvalid": "Il tipo di risorsa deve essere \"service\" o \"pod\"",
       "resourceNameRequired": "Il nome della risorsa è obbligatorio",
       "portInvalid": "La porta deve essere compresa tra 1 e 65535"
-    }
+    },
+    "advancedSettings": "Impostazioni kubectl avanzate",
+    "kubectlPath": "Percorso kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Percorso kubeconfig",
+    "kubeconfigPathPlaceholder": "Percorso del kubeconfig",
+    "pathValidationFailed": "Correggi i campi percorso avanzati non validi prima di salvare.",
+    "pathSelectionReset": "I percorsi avanzati sono cambiati. Scegli di nuovo contesto, namespace e risorsa.",
+    "noContexts": "Nessun contesto disponibile",
+    "noNamespaces": "Nessun namespace disponibile",
+    "noResources": "Nessuna risorsa disponibile"
   }
 }
diff --git a/src/i18n/locales/ja.json b/src/i18n/locales/ja.json
index b9a73430..d8dca06f 100644
--- a/src/i18n/locales/ja.json
+++ b/src/i18n/locales/ja.json
@@ -713,12 +713,21 @@
     "k8sSelectType": "タイプを選択...",
     "manageK8s": "管理",
     "noK8sConnections": "保存された接続がありません — 下で作成してください",
-    "noK8sContexts": "コンテキストが見つかりません（kubectl はインストールされていますか？）",
+    "noK8sContexts": "利用可能なコンテキストはありません",
+    "noK8sNamespaces": "利用可能なネームスペースはありません",
+    "noK8sResources": "利用可能なリソースはありません",
     "selectContextFirst": "先にコンテキストを選択してください",
     "selectK8sConnection": "K8s 接続を選択",
     "selectTypeFirst": "先にコンテキスト/ネームスペース/タイプを選択してください",
     "useK8s": "Kubernetes ポートフォワードを使用",
-    "useK8sConnection": "保存された接続"
+    "useK8sConnection": "保存された接続",
+    "k8sAdvancedSettings": "kubectl の詳細設定",
+    "kubectlPath": "kubectl のパス",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "kubeconfig のパス",
+    "kubeconfigPathPlaceholder": "kubeconfig へのパス",
+    "k8sPathValidationFailed": "保存する前に、無効な Kubernetes の詳細パス項目を修正してください。",
+    "k8sPathSelectionReset": "Kubernetes の詳細パスが変更されました。コンテキスト、名前空間、リソースをもう一度選択してください。"
   },
   "sshConnections": {
     "title": "SSH 接続",
@@ -1584,6 +1593,16 @@
       "resourceTypeInvalid": "リソースタイプは \"service\" または \"pod\" である必要があります",
       "resourceNameRequired": "リソース名は必須です",
       "portInvalid": "ポートは 1 から 65535 の範囲で指定してください"
-    }
+    },
+    "advancedSettings": "kubectl の詳細設定",
+    "kubectlPath": "kubectl のパス",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "kubeconfig のパス",
+    "kubeconfigPathPlaceholder": "kubeconfig へのパス",
+    "pathValidationFailed": "保存する前に、無効な詳細パス項目を修正してください。",
+    "pathSelectionReset": "詳細パスが変更されました。コンテキスト、名前空間、リソースをもう一度選択してください。",
+    "noContexts": "利用可能なコンテキストはありません",
+    "noNamespaces": "利用可能なネームスペースはありません",
+    "noResources": "利用可能なリソースはありません"
   }
 }
diff --git a/src/i18n/locales/ru.json b/src/i18n/locales/ru.json
index e5e83560..9d308b0a 100644
--- a/src/i18n/locales/ru.json
+++ b/src/i18n/locales/ru.json
@@ -691,12 +691,21 @@
     "k8sSelectType": "Выберите тип...",
     "manageK8s": "Управление",
     "noK8sConnections": "Нет сохранённых подключений — создайте ниже",
-    "noK8sContexts": "Контексты не найдены (установлен ли kubectl?)",
+    "noK8sContexts": "Нет доступных контекстов",
+    "noK8sNamespaces": "Нет доступных пространств имён",
+    "noK8sResources": "Нет доступных ресурсов",
     "selectContextFirst": "Сначала выберите контекст",
     "selectK8sConnection": "Выберите подключение K8s",
     "selectTypeFirst": "Сначала выберите контекст/пространство имён/тип",
     "useK8s": "Использовать проброс портов Kubernetes",
     "useK8sConnection": "Сохранённое подключение",
+    "k8sAdvancedSettings": "Расширенные настройки kubectl",
+    "kubectlPath": "Путь к kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Путь к kubeconfig",
+    "kubeconfigPathPlaceholder": "Путь к kubeconfig",
+    "k8sPathValidationFailed": "Исправьте недопустимые расширенные поля путей Kubernetes перед сохранением.",
+    "k8sPathSelectionReset": "Расширенные пути Kubernetes изменились. Снова выберите контекст, пространство имён и ресурс.",
     "appearance": "Внешний вид"
   },
   "sshConnections": {
@@ -1637,6 +1646,16 @@
       "resourceTypeInvalid": "Тип ресурса должен быть \"service\" или \"pod\"",
       "resourceNameRequired": "Имя ресурса обязательно",
       "portInvalid": "Порт должен быть в диапазоне от 1 до 65535"
-    }
+    },
+    "advancedSettings": "Расширенные настройки kubectl",
+    "kubectlPath": "Путь к kubectl",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "Путь к kubeconfig",
+    "kubeconfigPathPlaceholder": "Путь к kubeconfig",
+    "pathValidationFailed": "Исправьте недопустимые расширенные поля путей перед сохранением.",
+    "pathSelectionReset": "Расширенные пути изменились. Снова выберите контекст, пространство имён и ресурс.",
+    "noContexts": "Нет доступных контекстов",
+    "noNamespaces": "Нет доступных пространств имён",
+    "noResources": "Нет доступных ресурсов"
   }
 }
diff --git a/src/i18n/locales/zh.json b/src/i18n/locales/zh.json
index 334f7343..b195685d 100644
--- a/src/i18n/locales/zh.json
+++ b/src/i18n/locales/zh.json
@@ -667,12 +667,21 @@
     "k8sSelectType": "选择类型...",
     "manageK8s": "管理",
     "noK8sConnections": "没有已保存的连接 — 在下方创建一个",
-    "noK8sContexts": "未找到上下文（是否已安装 kubectl？）",
+    "noK8sContexts": "没有可用的上下文",
+    "noK8sNamespaces": "没有可用的命名空间",
+    "noK8sResources": "没有可用的资源",
     "selectContextFirst": "请先选择上下文",
     "selectK8sConnection": "选择 K8s 连接",
     "selectTypeFirst": "请先选择上下文/命名空间/类型",
     "useK8s": "使用 Kubernetes 端口转发",
-    "useK8sConnection": "已保存的连接"
+    "useK8sConnection": "已保存的连接",
+    "k8sAdvancedSettings": "kubectl 高级设置",
+    "kubectlPath": "kubectl 路径",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "kubeconfig 路径",
+    "kubeconfigPathPlaceholder": "kubeconfig 的路径",
+    "k8sPathValidationFailed": "保存前请修正无效的 Kubernetes 高级路径字段。",
+    "k8sPathSelectionReset": "Kubernetes 高级路径已更改。请重新选择上下文、命名空间和资源。"
   },
   "sshConnections": {
     "title": "SSH 连接",
@@ -1506,6 +1515,16 @@
       "resourceTypeInvalid": "资源类型必须为 \"service\" 或 \"pod\"",
       "resourceNameRequired": "资源名称为必填项",
       "portInvalid": "端口必须介于 1 和 65535 之间"
-    }
+    },
+    "advancedSettings": "kubectl 高级设置",
+    "kubectlPath": "kubectl 路径",
+    "kubectlPathPlaceholder": "kubectl",
+    "kubeconfigPath": "kubeconfig 路径",
+    "kubeconfigPathPlaceholder": "kubeconfig 的路径",
+    "pathValidationFailed": "保存前请修正无效的高级路径字段。",
+    "pathSelectionReset": "高级路径已更改。请重新选择上下文、命名空间和资源。",
+    "noContexts": "没有可用的上下文",
+    "noNamespaces": "没有可用的命名空间",
+    "noResources": "没有可用的资源"
   }
 }
diff --git a/src/utils/k8s.ts b/src/utils/k8s.ts
index c97c2783..0cd4ce78 100644
--- a/src/utils/k8s.ts
+++ b/src/utils/k8s.ts
@@ -13,6 +13,8 @@ export interface K8sConnection {
   resource_type: "service" | "pod";
   resource_name: string;
   port: number;
+  kubectl_path?: string;
+  kubeconfig_path?: string;
 }
 
 export interface K8sConnectionInput {
@@ -22,6 +24,25 @@ export interface K8sConnectionInput {
   resource_type: string;
   resource_name: string;
   port: number;
+  kubectl_path?: string;
+  kubeconfig_path?: string;
+}
+
+export interface K8sCommandOptions {
+  kubectl_path?: string;
+  kubeconfig_path?: string;
+}
+
+export type K8sPathValidationKind = "kubectl" | "kubeconfig";
+
+function toK8sCommandPayload(options?: K8sCommandOptions): {
+  kubectlPath?: string;
+  kubeconfigPath?: string;
+} {
+  return {
+    kubectlPath: options?.kubectl_path,
+    kubeconfigPath: options?.kubeconfig_path,
+  };
 }
 
 /**
@@ -67,23 +88,36 @@ export async function deleteK8sConnection(id: string): Promise<void> {
  */
 export async function testK8sConnection(
   context: string,
-  namespace: string
+  namespace: string,
+  options?: K8sCommandOptions
 ): Promise<string> {
-  return await invoke<string>("test_k8s_connection_cmd", { context, namespace });
+  return await invoke<string>("test_k8s_connection_cmd", {
+    context,
+    namespace,
+    ...toK8sCommandPayload(options),
+  });
 }
 
 /**
  * List available kubectl contexts
  */
-export async function getK8sContexts(): Promise<string[]> {
-  return await invoke<string[]>("get_k8s_contexts_cmd");
+export async function getK8sContexts(
+  options?: K8sCommandOptions
+): Promise<string[]> {
+  return await invoke<string[]>("get_k8s_contexts_cmd", toK8sCommandPayload(options));
 }
 
 /**
  * List namespaces in a kubectl context
  */
-export async function getK8sNamespaces(context: string): Promise<string[]> {
-  return await invoke<string[]>("get_k8s_namespaces_cmd", { context });
+export async function getK8sNamespaces(
+  context: string,
+  options?: K8sCommandOptions
+): Promise<string[]> {
+  return await invoke<string[]>("get_k8s_namespaces_cmd", {
+    context,
+    ...toK8sCommandPayload(options),
+  });
 }
 
 /**
@@ -92,12 +126,14 @@ export async function getK8sNamespaces(context: string): Promise<string[]> {
 export async function getK8sResources(
   context: string,
   namespace: string,
-  resourceType: string
+  resourceType: string,
+  options?: K8sCommandOptions
 ): Promise<string[]> {
   return await invoke<string[]>("get_k8s_resources_cmd", {
     context,
     namespace,
     resourceType,
+    ...toK8sCommandPayload(options),
   });
 }
 
@@ -109,15 +145,27 @@ export async function getK8sResourcePorts(
   namespace: string,
   resourceType: string,
   resourceName: string,
+  options?: K8sCommandOptions
 ): Promise<number[]> {
   return await invoke<number[]>("get_k8s_resource_ports_cmd", {
     context,
     namespace,
     resourceType,
     resourceName,
+    ...toK8sCommandPayload(options),
   });
 }
 
+/**
+ * Validate an advanced K8s path override.
+ */
+export async function validateK8sPath(
+  path: string,
+  kind: K8sPathValidationKind,
+): Promise<void> {
+  await invoke("validate_k8s_path_cmd", { path, kind });
+}
+
 /**
  * Format a K8s connection for display
  */
@@ -179,6 +227,8 @@ export function validateK8sConnection(
       resource_type: k8s.resource_type,
       resource_name: k8s.resource_name,
       port: k8s.port,
+      kubectl_path: k8s.kubectl_path,
+      kubeconfig_path: k8s.kubeconfig_path,
     },
   };
 }
diff --git a/tests/components/modals/K8sConnectionsModal.test.tsx b/tests/components/modals/K8sConnectionsModal.test.tsx
index 007dac00..9b10ffa2 100644
--- a/tests/components/modals/K8sConnectionsModal.test.tsx
+++ b/tests/components/modals/K8sConnectionsModal.test.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from "react";
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, fireEvent, waitFor } from "@testing-library/react";
+import { render, screen, fireEvent, waitFor, act } from "@testing-library/react";
 import { K8sConnectionsModal } from "../../../src/components/modals/K8sConnectionsModal";
 
 interface MockSelectProps {
@@ -180,3 +180,70 @@ describe("K8sConnectionsModal port defaults", () => {
     });
   });
 });
+
+describe("K8sConnectionsModal async cancellation", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    k8sMocks.loadK8sConnections.mockResolvedValue([]);
+    k8sMocks.saveK8sConnection.mockResolvedValue({ id: "new" });
+    k8sMocks.getK8sResourcePorts.mockResolvedValue([]);
+    k8sMocks.validateK8sConnection.mockImplementation(
+      (input: K8sValidationInput) =>
+        input.port != null && input.port >= 1 && input.port <= 65535
+          ? {
+              isValid: true,
+              value: {
+                name: input.name ?? "",
+                context: input.context ?? "",
+                namespace: input.namespace ?? "",
+                resource_type: input.resource_type ?? "service",
+                resource_name: input.resource_name ?? "",
+                port: input.port,
+              },
+            }
+          : { isValid: false, errorKey: "k8sConnections.errors.portInvalid" },
+    );
+  });
+
+  it("ignores stale namespace fetches when context changes rapidly", async () => {
+    k8sMocks.getK8sContexts.mockResolvedValue(["ctx-a", "ctx-b"]);
+    let resolveFirst: (value: string[]) => void = () => {};
+    k8sMocks.getK8sNamespaces.mockImplementation((ctx: string) => {
+      if (ctx === "ctx-a") {
+        return new Promise<string[]>((res) => {
+          resolveFirst = res;
+        });
+      }
+      return Promise.resolve(["ns-b-1", "ns-b-2"]);
+    });
+
+    renderModal(null);
+    fireEvent.click(screen.getByText("k8sConnections.add"));
+
+    await waitFor(() =>
+      expect(screen.getByRole("option", { name: "ctx-a" })).toBeInTheDocument(),
+    );
+
+    fireEvent.change(screen.getByLabelText("k8sConnections.chooseContext"), {
+      target: { value: "ctx-a" },
+    });
+    // Switch immediately to ctx-b so its (fast) fetch supersedes ctx-a's slow one.
+    fireEvent.change(screen.getByLabelText("k8sConnections.chooseContext"), {
+      target: { value: "ctx-b" },
+    });
+
+    await waitFor(() =>
+      expect(screen.getByRole("option", { name: "ns-b-1" })).toBeInTheDocument(),
+    );
+
+    // Resolve the stale ctx-a fetch with outdated namespaces.
+    await act(async () => {
+      resolveFirst(["ns-a-1", "ns-a-2"]);
+      await Promise.resolve();
+    });
+
+    // Stale namespaces must not leak into the dropdown; ctx-b's list stays.
+    expect(screen.queryByRole("option", { name: "ns-a-1" })).not.toBeInTheDocument();
+    expect(screen.getByRole("option", { name: "ns-b-2" })).toBeInTheDocument();
+  });
+});
diff --git a/tests/components/modals/NewConnectionModal.test.tsx b/tests/components/modals/NewConnectionModal.test.tsx
index 87103539..c938fb36 100644
--- a/tests/components/modals/NewConnectionModal.test.tsx
+++ b/tests/components/modals/NewConnectionModal.test.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from "react";
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, fireEvent, waitFor } from "@testing-library/react";
+import { render, screen, fireEvent, waitFor, act } from "@testing-library/react";
 import { invoke } from "@tauri-apps/api/core";
 import { NewConnectionModal } from "../../../src/components/modals/NewConnectionModal";
 
@@ -201,6 +201,7 @@ describe("NewConnectionModal K8s port defaults", () => {
         "db",
         "service",
         "mysql-svc",
+        expect.anything(),
       );
       expect(portInput).toHaveValue(6543);
     });
@@ -221,3 +222,78 @@ describe("NewConnectionModal K8s port defaults", () => {
     });
   });
 });
+
+describe("NewConnectionModal K8s async cancellation", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    driverState.defaultPort = 15432;
+    vi.mocked(invoke).mockResolvedValue("ok");
+    sshMocks.loadSshConnections.mockResolvedValue([]);
+    k8sMocks.loadK8sConnections.mockResolvedValue([]);
+    k8sMocks.getK8sResources.mockResolvedValue([]);
+    k8sMocks.getK8sResourcePorts.mockResolvedValue([]);
+  });
+
+  it("fetches k8s contexts once when entering inline mode (no duplicate fetch)", async () => {
+    k8sMocks.getK8sContexts.mockResolvedValue(["ctx"]);
+    k8sMocks.getK8sNamespaces.mockResolvedValue(["db"]);
+
+    renderModal();
+    fireEvent.click(screen.getByText("Kubernetes"));
+    fireEvent.click(screen.getByLabelText("newConnection.useK8s"));
+    fireEvent.click(screen.getByText("newConnection.createInlineK8s"));
+
+    await waitFor(() =>
+      expect(screen.getByRole("option", { name: "ctx" })).toBeInTheDocument(),
+    );
+    // Flush any duplicate call that the old init-based path would have produced.
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(k8sMocks.getK8sContexts).toHaveBeenCalledTimes(1);
+  });
+
+  it("ignores stale namespace fetches when context changes rapidly", async () => {
+    k8sMocks.getK8sContexts.mockResolvedValue(["ctx-a", "ctx-b"]);
+    let resolveFirst: (value: string[]) => void = () => {};
+    k8sMocks.getK8sNamespaces.mockImplementation((ctx: string) => {
+      if (ctx === "ctx-a") {
+        return new Promise<string[]>((res) => {
+          resolveFirst = res;
+        });
+      }
+      return Promise.resolve(["ns-b-1", "ns-b-2"]);
+    });
+
+    renderModal();
+    fireEvent.click(screen.getByText("Kubernetes"));
+    fireEvent.click(screen.getByLabelText("newConnection.useK8s"));
+    fireEvent.click(screen.getByText("newConnection.createInlineK8s"));
+
+    await waitFor(() =>
+      expect(screen.getByRole("option", { name: "ctx-a" })).toBeInTheDocument(),
+    );
+
+    fireEvent.change(screen.getByLabelText("newConnection.chooseContext"), {
+      target: { value: "ctx-a" },
+    });
+    fireEvent.change(screen.getByLabelText("newConnection.chooseContext"), {
+      target: { value: "ctx-b" },
+    });
+
+    await waitFor(() =>
+      expect(screen.getByRole("option", { name: "ns-b-1" })).toBeInTheDocument(),
+    );
+
+    await act(async () => {
+      resolveFirst(["ns-a-1", "ns-a-2"]);
+      await Promise.resolve();
+    });
+
+    expect(
+      screen.queryByRole("option", { name: "ns-a-1" }),
+    ).not.toBeInTheDocument();
+    expect(screen.getByRole("option", { name: "ns-b-2" })).toBeInTheDocument();
+  });
+});
diff --git a/tests/hooks/useLatestAsync.test.ts b/tests/hooks/useLatestAsync.test.ts
new file mode 100644
index 00000000..0aecec31
--- /dev/null
+++ b/tests/hooks/useLatestAsync.test.ts
@@ -0,0 +1,123 @@
+import { describe, it, expect, vi } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+import { useLatestAsync } from "../../src/hooks/useLatestAsync";
+
+// Helper: a deferred promise we can resolve on demand.
+function deferred<T = void>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+describe("useLatestAsync", () => {
+  it("marks a prior call for the same key as stale when a newer call starts", async () => {
+    const { result } = renderHook(() => useLatestAsync());
+    const run = result.current;
+
+    let firstIsLatest: (() => boolean) | null = null;
+    let secondIsLatest: (() => boolean) | null = null;
+    const first = deferred<string>();
+    const second = deferred<string>();
+
+    void run("k", async (isLatest) => {
+      firstIsLatest = isLatest;
+      return first.promise;
+    });
+    void run("k", async (isLatest) => {
+      secondIsLatest = isLatest;
+      return second.promise;
+    });
+
+    expect(firstIsLatest).not.toBeNull();
+    expect(secondIsLatest).not.toBeNull();
+    // Second call bumped the token: first is now stale, second is current.
+    expect(firstIsLatest!()).toBe(false);
+    expect(secondIsLatest!()).toBe(true);
+
+    // Resolving the stale call must not throw; it still returns its value.
+    await act(async () => {
+      first.resolve("first");
+      await Promise.resolve();
+    });
+    await act(async () => {
+      second.resolve("second");
+      await Promise.resolve();
+    });
+
+    // Guards remain stable references reflecting the latest token.
+    expect(firstIsLatest!()).toBe(false);
+    expect(secondIsLatest!()).toBe(true);
+  });
+
+  it("keeps different keys independent", async () => {
+    const { result } = renderHook(() => useLatestAsync());
+    const run = result.current;
+
+    let aIsLatest: (() => boolean) | null = null;
+    let bIsLatest: (() => boolean) | null = null;
+
+    void run("a", async (isLatest) => {
+      aIsLatest = isLatest;
+      await Promise.resolve();
+      return "a";
+    });
+    void run("b", async (isLatest) => {
+      bIsLatest = isLatest;
+      await Promise.resolve();
+      return "b";
+    });
+
+    // Calling key "b" must not invalidate key "a".
+    expect(aIsLatest!()).toBe(true);
+    expect(bIsLatest!()).toBe(true);
+
+    // A second call under "b" invalidates only the first "b", not "a".
+    let b2IsLatest: (() => boolean) | null = null;
+    void run("b", async (isLatest) => {
+      b2IsLatest = isLatest;
+      await Promise.resolve();
+      return "b2";
+    });
+
+    expect(aIsLatest!()).toBe(true);
+    expect(bIsLatest!()).toBe(false);
+    expect(b2IsLatest!()).toBe(true);
+  });
+
+  it("preserves the natural return value of the callback", async () => {
+    const { result } = renderHook(() => useLatestAsync());
+    const run = result.current;
+
+    let resolved: string | undefined;
+    await act(async () => {
+      resolved = await run("once", async () => {
+        await Promise.resolve();
+        return "done";
+      });
+    });
+
+    expect(resolved).toBe("done");
+  });
+
+  it("invalidates all keys on unmount", async () => {
+    const { result, unmount } = renderHook(() => useLatestAsync());
+    const run = result.current;
+
+    let guard: (() => boolean) | null = null;
+    const pending = deferred<string>();
+
+    void run("ns", async (isLatest) => {
+      guard = isLatest;
+      return pending.promise;
+    });
+
+    expect(guard!()).toBe(true);
+
+    unmount();
+
+    // After unmount the guard must report stale so late resolves skip writes.
+    expect(guard!()).toBe(false);
+  });
+});
diff --git a/tests/utils/k8s.test.ts b/tests/utils/k8s.test.ts
index a8dc39e0..b6a6260a 100644
--- a/tests/utils/k8s.test.ts
+++ b/tests/utils/k8s.test.ts
@@ -7,6 +7,7 @@ import {
   getK8sNamespaces,
   getK8sResources,
   getK8sResourcePorts,
+  validateK8sPath,
   loadK8sConnections,
   saveK8sConnection,
   updateK8sConnection,
@@ -179,6 +180,8 @@ describe("k8s", () => {
       expect(invoke).toHaveBeenCalledWith("test_k8s_connection_cmd", {
         context: "my-context",
         namespace: "my-namespace",
+        kubectlPath: undefined,
+        kubeconfigPath: undefined,
       });
       expect(result).toBe("K8s connection verified!");
     });
@@ -191,6 +194,49 @@ describe("k8s", () => {
         testK8sConnection("bad-context", "default"),
       ).rejects.toThrow("Context not found");
     });
+
+    it("should pass kubectl and kubeconfig overrides", async () => {
+      const { invoke } = await import("@tauri-apps/api/core");
+      vi.mocked(invoke).mockResolvedValue("K8s connection verified!");
+
+      await testK8sConnection("my-context", "default", {
+        kubectl_path: "/opt/bin/kubectl",
+        kubeconfig_path: "/tmp/kubeconfig",
+      });
+
+      expect(invoke).toHaveBeenCalledWith("test_k8s_connection_cmd", {
+        context: "my-context",
+        namespace: "default",
+        kubectlPath: "/opt/bin/kubectl",
+        kubeconfigPath: "/tmp/kubeconfig",
+      });
+    });
+  });
+
+  describe("validateK8sPath", () => {
+    it("should call invoke with the kubectl validation kind", async () => {
+      const { invoke } = await import("@tauri-apps/api/core");
+      vi.mocked(invoke).mockResolvedValue(undefined);
+
+      await validateK8sPath("/usr/local/bin/kubectl", "kubectl");
+
+      expect(invoke).toHaveBeenCalledWith("validate_k8s_path_cmd", {
+        path: "/usr/local/bin/kubectl",
+        kind: "kubectl",
+      });
+    });
+
+    it("should call invoke with the kubeconfig validation kind", async () => {
+      const { invoke } = await import("@tauri-apps/api/core");
+      vi.mocked(invoke).mockResolvedValue(undefined);
+
+      await validateK8sPath("/tmp/kubeconfig", "kubeconfig");
+
+      expect(invoke).toHaveBeenCalledWith("validate_k8s_path_cmd", {
+        path: "/tmp/kubeconfig",
+        kind: "kubeconfig",
+      });
+    });
   });
 
   describe("getK8sContexts", () => {
@@ -203,7 +249,10 @@ describe("k8s", () => {
 
       const result = await getK8sContexts();
 
-      expect(invoke).toHaveBeenCalledWith("get_k8s_contexts_cmd");
+      expect(invoke).toHaveBeenCalledWith("get_k8s_contexts_cmd", {
+        kubectlPath: undefined,
+        kubeconfigPath: undefined,
+      });
       expect(result).toEqual(["minikube", "gke_project_cluster"]);
     });
   });
@@ -217,6 +266,8 @@ describe("k8s", () => {
 
       expect(invoke).toHaveBeenCalledWith("get_k8s_namespaces_cmd", {
         context: "minikube",
+        kubectlPath: undefined,
+        kubeconfigPath: undefined,
       });
       expect(result).toEqual(["default", "kube-system"]);
     });
@@ -237,6 +288,8 @@ describe("k8s", () => {
         context: "minikube",
         namespace: "database",
         resourceType: "service",
+        kubectlPath: undefined,
+        kubeconfigPath: undefined,
       });
       expect(result).toEqual(["mysql-svc", "postgres-svc"]);
     });
@@ -259,6 +312,8 @@ describe("k8s", () => {
         namespace: "database",
         resourceType: "service",
         resourceName: "postgres-svc",
+        kubectlPath: undefined,
+        kubeconfigPath: undefined,
       });
       expect(result).toEqual([5432]);
     });
@@ -285,6 +340,8 @@ describe("k8s", () => {
         resource_type: "service",
         resource_name: "db",
         port: 3306,
+        kubectl_path: "/opt/bin/kubectl",
+        kubeconfig_path: "/tmp/kubeconfig",
       };
       vi.mocked(invoke).mockResolvedValue(saved);
 
@@ -295,6 +352,8 @@ describe("k8s", () => {
         resource_type: "service",
         resource_name: "db",
         port: 3306,
+        kubectl_path: "/opt/bin/kubectl",
+        kubeconfig_path: "/tmp/kubeconfig",
       };
 
       const result = await saveK8sConnection(input);
@@ -317,6 +376,8 @@ describe("k8s", () => {
         resource_type: "pod",
         resource_name: "db-0",
         port: 5432,
+        kubectl_path: "/opt/bin/kubectl",
+        kubeconfig_path: "/tmp/kubeconfig",
       };
       vi.mocked(invoke).mockResolvedValue(updated);
 
@@ -327,6 +388,8 @@ describe("k8s", () => {
         resource_type: "pod",
         resource_name: "db-0",
         port: 5432,
+        kubectl_path: "/opt/bin/kubectl",
+        kubeconfig_path: "/tmp/kubeconfig",
       };
 
       const result = await updateK8sConnection("abc-123", input);