diff --git a/backend/services/deploy-mining.sh b/backend/services/deploy-mining.sh
index 46298963..067bafab 100755
--- a/backend/services/deploy-mining.sh
+++ b/backend/services/deploy-mining.sh
@@ -330,13 +330,21 @@ run_psql() {
 # ===========================================================================
 # Helper: Execute Kafka admin command (auto-detect Docker or remote)
 # ===========================================================================
+ensure_kafka_image() {
+    local image="confluentinc/cp-kafka:7.5.0"
+    if ! docker image inspect "$image" &>/dev/null; then
+        log_info "Pulling Kafka CLI image: $image (first time only)..."
+        docker pull "$image"
+    fi
+}
+
 run_kafka_cmd() {
     local cmd="$1"
     shift
 
     if [ "$DEPLOY_MODE" = "standalone" ]; then
         # Standalone: Kafka is remote, use temporary container with host networking
-        # Add timeout to prevent hangs when Kafka is unreachable across servers
+        ensure_kafka_image
         timeout 30 docker run --rm --network host confluentinc/cp-kafka:7.5.0 \
             $cmd --bootstrap-server "$KAFKA_BROKERS" "$@"
         return $?
@@ -364,6 +372,7 @@ run_kafka_cmd_stdin() {
     shift
 
     if [ "$DEPLOY_MODE" = "standalone" ]; then
+        ensure_kafka_image
         timeout 30 docker run --rm -i --network host confluentinc/cp-kafka:7.5.0 \
             $cmd --bootstrap-server "$KAFKA_BROKERS" "$@"
         return $?