diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96963c2a8..e5ebfec84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ All notable changes to this project will be documented in this file.
 - hadoop: Add patch "HADOOP-18516: Support Fixed SAS Token for ABFS Authentication" ([#852]).
 - hbase: Add hadoop-azure.jar to the lib directory to support the Azure Blob Filesystem and
   the Azure Data Lake Storage ([#853]).
+- kafka: Add cyrus-sasl-gssapi package for kerberos ([#874]).
 
 ### Changed
 
@@ -64,6 +65,7 @@ All notable changes to this project will be documented in this file.
 [#866]: https://github.com/stackabletech/docker-images/pull/866
 [#867]: https://github.com/stackabletech/docker-images/pull/867
 [#868]: https://github.com/stackabletech/docker-images/pull/868
+[#874]: https://github.com/stackabletech/docker-images/pull/874
 
 ## [24.7.0] - 2024-07-24
 
diff --git a/kafka/Dockerfile b/kafka/Dockerfile
index 663481b5d..7b710803b 100644
--- a/kafka/Dockerfile
+++ b/kafka/Dockerfile
@@ -68,6 +68,8 @@ LABEL name="Apache Kafka" \
 COPY kafka/kubernetes.repo /etc/yum.repos.d/kubernetes.repo
 RUN microdnf update && \
     microdnf install \
+    # needed by kcat for kerberos
+    cyrus-sasl-gssapi \
     # Can be removed once listener-operator integration is used
     kubectl && \
     microdnf clean all && \