diff --git a/ci/java-builder/Dockerfile b/ci/java-builder/Dockerfile
index ce78353..d1814cd 100644
--- a/ci/java-builder/Dockerfile
+++ b/ci/java-builder/Dockerfile
@@ -33,6 +33,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         jq \
         unzip \
         openssl \
+        openssh-client \
+        sshpass \
     && mkdir -p /etc/apt/keyrings \
     && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
         | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
@@ -130,4 +132,6 @@ RUN java -version \
     && pnpm --version \
     && buf --version \
     && oras version \
-    && jq --version
+    && jq --version \
+    && ssh -V \
+    && sshpass -V
diff --git a/ci/java-builder/README.md b/ci/java-builder/README.md
index 7894b98..e74eb50 100644
--- a/ci/java-builder/README.md
+++ b/ci/java-builder/README.md
@@ -12,6 +12,7 @@ Pre-baked build environment for KollectAI-ETL backend and plugin CI jobs.
 - Node.js 24 + pnpm 11 (via corepack)
 - [buf](https://buf.build) CLI — for `buf lint` parity with pre-push
 - ORAS CLI (Harbor artifact uploads)
+- `openssh-client` + `sshpass` — for SSH-direct SIT/UAT deploy jobs (no runtime apt-get needed)
 - git, jq, curl
 
 > **Note**: Backend Java protobuf codegen lives in the Maven build via